Hello and welcome back to another section on unpacking.
So we have a new sample of malware here called Hanseter.
Download this from the resource section, unzip it and put it in your desktop folder called malware
called samples.
So the technique that we are going to use for unpacking this is by following the steps in the notes
here, which you can also download from the resource section.
And then the first part of the notes is about Hanseter.
You can read about it here.
And then there are two references to the two APIs we will be hooking in order to help us unpack this
malware.
First is Virtualprotect and here is the mSDN reference.
Second is virtual lock X and here is a mSDN reference.
And here is the steps for unpacking and unmapping.
First we are going to put Virtualalloc and Virtualprotect breakpoints and then run F9 through all breakpoints
until there is no more.
So the first step is just to see how many times Virtualalloc and Virtualprotect has been hit.
We want to get a count then from the breakpoint tab in Xdebug we note down how many times each Virtualprotect
and Virtualalloc was hit.
Now we know when is the last breakpoint, When we should jump.
Then we restore the virtual machine and repeat.
But this time we follow each arguments and return x value for the virtual lock until the last breakpoint.
You will note that the last breakpoint is virtual alloc with the return of x equals to 0X23 followed
by four zeros.
And your return address might be different from mine.
After that, we dump the 0X234 zeros using process hacker and unmap it with bare.
And then we check with Ida.
So this is the basic steps for this particular sample.
So let's get started.
The first thing we do is we want to check with Ida whether it is already unpacked.
So we use Ida to open Hanseter.
King a new.
Select the sample from the folder, click open.
Click.
Okay.
And from the function name window, you will see there is only one function.
That means it is definitely packed in the real program.
That cannot be just one function.
There will be hundreds of functions.
So from here, you can see there are suspicious calls.
Those calls to X are suspicious.
Cause like any time you see a call to a register, for example, in this case, call EB.
This is a very highly suspicious call.
Most probably it is calling some kind of routine to unpack the code or maybe even to call the part of
the code that has already been unpacked.
Another suspicious cause would be any jump to unknown, for example, jump to a register.
So this confirms that it is probably packed.
So now we can close this and we can go to xdebug and open this sample.
So we click on X32 debug since this is a 32 bit 32 bit sample.
We click on the options and the preferences and uncheck system breakpoints and uncheck callbacks leaving
only the entry breakpoint checked.
And then we click on Save.
Now we open the sample.
Go to the desktop malware code samples folder.
Click on the all files here and then select the install bin and open it.
So we are now at the entry point.
So we are going to set two breakpoints.
First, breakpoint is virtual alloc.
Hit Enter.
Second breakpoint is virtualprotect.
Hit Enter.
Now we confirm by looking at the breakpoint.
Step two Make sure that you have both breakpoints set Virtualalloc is to allocate memory for unpacking
code Virtualprotect is to change the permission bits for the memory.
So now this first round, we just want to run through each of these breakpoints and let it count how
many, how many times each API has been hit.
So let's run.
So now this one has been hit one time.
Run again.
Now, this one has been hit twice.
This one, one time.
Just click through until it finishes.
Keep on clicking until you see in the bottom left is in the running state.
So now we found that the virtual lock has been hit five times and virtual protect has been hit one time,
which are lock being hit six times.
You can see now six times is false.
Again, hit one more time.
Seven times.
Run again.
This button is F9.
Shortcut is F9.
Okay, So now it's really in a running state.
So virtual lock has been hit seven times and virtual protect one time.
So we make a note here using a notepad.
To keep track so that we can remember.
So here in our notepad we note down, which all along has been hit seven times and Virtualprotect has
been hit one time.
So we need now, now that we know these numbers, we will know when to dump.
So now we are going to reset the virtual machine.
So make sure you save this first so that when you reset virtual machine, you still have this note.
So let's save this note in your malware core samples.
Folder and says count.
Breakpoint count.
BP Count, in short, and save it.
Okay, so now we can reset the virtual machine.
We close everything.
Then close this.
Now, this breakpoint count.
You need to save it out somewhere.
Because when you reset the virtual machine, this will be lost.
So you need to save this.
Copy it and put it in your shared folder somewhere.
Okay, so I'll leave that to you on how you want to save it.
You can also directly open a folder in your host machine and write down the notes instead of inside
here.
So now we are going to reset this machine and then we are going to I'm going to see you in the next
video where we will do the unpacking.
Thank you for watching.