Hello.
Welcome back.
Now I've already restored the virtual machine to undo any changes made by the malware.
And now I'm going to use Xdebug to unpack malware.
So open Xdebug and click on options and then click on preferences.
Uncheck System Breakpoint and callbacks.
And click save and then open the ANC tile from the malware core sample folder on the desktop.
Click on all files here and click on install and open it.
Now you'll add a breakpoint.
We are going to set two breakpoints like we did earlier.
Breakpoint on Virtual lock.
Hit enter and then breakpoint on Virtualprotect.
Hit Enter.
Click on the breakpoint tab to confirm you have both over there.
And now we can run to the first breakpoint.
Click on F9 or this button here.
And now you have the first breakpoint.
So we step over it by pressing F8 or you can click this button here.
To step over.
So if we jump to virtual product and now it's pushing the parameters to the stack and getting it ready
to run virtual product, which is down here.
So continue this tab will let it push its parameters.
There are five parameters this virtual product has got at the back.
This particular virtual product has got five parameters.
So these are the five parameters here for virtual product with the extension, the five parameters.
The second parameter is the one we are interested in.
It is trying to change the protection for permission bits for this address.
So if you scroll down and read, you can see here the description for the second parameter IP address,
a pointer to the base address of the region of pages whose access protection attributes are to be changed.
So it's the second parameter.
So the second parameter is this one.
Over here, you can see this is the first parameter.
This is the second parameter.
So if we want to see this memory, you can follow it in the memory here, right click.
And then.
Select, follow the word and then follow the word in random.
So this is the memory area it wants to change its protection to.
So you can give this to see whether or not this will be the final place for its packing.
So we keep tab on that list for four followed by four zeros.
So now we keep on running press F9 or click on this run button to go to the next breakpoint Virtual
Lock.
So now we are here.
We step over by clicking on this or pressing F8
and now we are going to jump to Virtual Lock.
And now he's going to push all the parameters for virtual alloc.
Now, up to here, all these parameters has been pushed to the stack for this call to virtual ALLOC.
And this particular virtual ALLOC has also got an extension.
So this particular virtual also has got five parameters and this is the reference in mSDN.
Five parameters.
One, two, three, four, five.
But we are interested in the return value.
So the return value, you can scroll down and read.
What does it return?
Return value.
If the function succeeds, the return value is the base address of the allocated region of pages.
So we are interested in the return value.
Now, when a function returns, it will return the result in x.
So after this call, x should contain the address of the allocated region in memory.
So now we step over this and watch X this step over.
And then you see x now shows two followed by four zeros.
So we can right click on this and follow in number two.
And now we see this is the region of memory where he has allocated.
So now we can continue to run and see if anything happens here.
At this point in time, if we look at the breakpoint, both of the API has been hit one time each because
we remember from the notes that we created during the first session under here, count.
Breakpoint count.
We know that it has to hit seven times virtualprotect one time before the we are ready to dump.
So we can continue to run.
As we run, we notice whether anything happens here.
So now we click on F9 or this button.
It will run to the next page.
And you notice it has already unpacked some code here.
You can see the next great process Getprocaddress.
And then if you scroll down, you can see some other APIs get module handle.
And then if you scroll further, you can see further.
APIs, load library A and so on.
So this is probably and that's what I lock here as well.
So this is this is probably some intermediate code that will be used to unpack the ultimate exe file.
So we are not at the end yet.
So now we are the second which allow we continue to step over.
Jump to buckle up now is pushing the next five parameters to the stack.
Now the parameter has been pushed to the stack.
We step away to look at the return allocation of the index.
So now we step over.
And so he has allocated this region of memory.
So we right click on this follow in number two.
Number three.
So this is another memory is allocated.
So now you look at Breakpoint tab.
The lock has been hit twice.
Still not at the end yet.
So we run and notice what happens here.
All right.
So now we see here it has unpacked some code and this might be RC for decryption.
Probably.
Look at this.
It is nicely aligned in rows and columns.
Not sure whether C4, but it could be LC for decryption.
So now we continue to.
Step over.
So decryption means that we are still not at the end yet.
So this is also an intermediary code which has has been unpacked to help to to unpack the final.
So continue.
To step over.
Mucho, mucho.
A lot now is pushing the next five parameters to bachelor.
And now we're going to step over and see the return address.
All right.
So now it has allocated this memory so we can follow this right click.
Follow in dumb number number four.
So this is the new memory allocation that is F9 and run and see what it unpacks here.
Run And again, further decryption maybe not sure.
So this is still not our final unpack code.
So we continue to step over.
So at this point in time, if you look at Breakpoint, virtual has been hit four times.
So continue to step over the this virtual lock jump to virtual lock and now it's going to push the next
five parameters to the stack.
All right.
At this point, it has pushed five parameters to the stack to call this next virtual lock.
So we're now going to step over this and watch the return address.
So step over and see.
The return address now is three followed by four zeros.
So this is right click, this follow in dum dum number five.
All right.
So this is a new memory address where it's going to unpack additional code.
So let's run and see what happens to this region of memory.
All right.
Nothing happens.
All right.
No problem.
And at this point in time, we have already hit our virtual five times.
So let's step over this new virtual.
Jump The Bachelor and now it's going to push the five parameters to the stack in readiness to call the
virtual dialogue over here.
At this point in time, the five parameters has been pushed to the stack.
And if we step over this, we are going to see the return address which has been allocated.
Step over and this is the return address.
Same thing.
So no change.
So still nothing.
We now need to follow because we are already following it in number five here.
Three followed by four zeros.
So let's just run and see what happens here.
Okay, now it is running.
You can see.
Let it run until it hits the breakpoint.
Give it a few seconds.
So after a few seconds, it has hit our breakpoint again.
Still, nothing has been unpacked to this region of memory and we are now at the next virtual along
and click on Breakpoint.
We see that now the virtual has been hit six times.
Now, remember, we earlier on in the first run, we found that virtual was hit seven times.
That means we have one more hit to go before we can dump memory.
So let's go and follow step over this next virtual alloc and jump to virtual ALLOC.
And now it's going to push the next five parameters to the stack.
So it has pushed five parameters.
Now it's going to call virtual Alloc again and we are going to watch the return address in X.
So let's step over and now the return address is 0000.
So we don't have to follow it because it's not possible to unpack something in this memory address.
So we just continue to run to the next virtual lock.
So we have the breakpoint run again.
Now we hit the virtual lock again one more time.
So let's step over.
This which.
Right.
He's going to push the next five parameters to the stack to get ready for the virtual call.
So we are now here, let's move it.
And now we get the return address of one C followed by four zeros.
So we can just right click this one and then.
Follow in drum number one because we have run out of drums.
So we go to number one now.
And so number one now is here.
So let's run and see what happens to this drum.
Looks like it has unpacked an X file in this memory address.
Look at that.
One C followed by four zeros.
See that?
We have an NS header, and we have this string.
This is.
This program cannot be run in Dos mode.
We have the p header.
If you then if you scroll down, you can see the text section, the data section, the data section,
the dialogue section.
All right.
So it looks like this is the.
We are ready to done.
So if we click on the breakpoints now, we see that we have hit Virtualalloc seven times.
And then if we go to here, we can see that it is running, it is freely running and it is not hitting
any more breakpoints.
So now we know, we confirm that we are at our last rochela.
So now we are ready to jump.
So you see, this time the address is one C followed by four zeros.
Each time you run the code, you may get a different address here, the different return address.
So it could be different for you and so on.
So one C followed by four zeros.
Remember one C followed by four zeros.
And in the next video we will continue dumping this and also unmap it.
See you in the next video.