Okay, so now we are going to dump this in in the memory from memory.
And your, your address might be different from mine, so you just follow yours accordingly.
So in order to dump this file from memory, we use process hacker.
So we go to process Hacker inside the Flash utilities folder and Open Process Hacker.
Click on Yes and then look for Hanseter in memory.
Here it is.
So double click on it and then go to the memory tab and look for this address.
One C followed by four zeros.
So over here, look for one C followed by four zeros and you can see the permission bits is read write
executable.
So this must be the one.
So if you expand on this and double click, you will see the executable file has been unpacked in memory
and this is the one we are seeing down here in the same one.
So we can dump this.
Now we click on this one right click and then save and then go to the desktop malware core sample folder
and we are going to dump it followed by the extension, followed by suffix 0X1, C followed by four
zeros, one, two, three, four.
So that we can remember that it has been done from this address.
And we also need this address to set the image base inside process hacker.
So click on Save.
Now click on Close.
And now we can stop the handset itself.
Click on X to close.
And now we are going to unmap measure in process cycle.
Everything has been killed.
Click close and now we can unmap this file using.
So we open P bear.
And then we drop our dump file.
Before you do anything, make a copy, make a copy.
And then now you dump this one.
You open this one in PDB.
And now we are going to fix the section headers.
If you look at the imports, the import address table is all screwed up.
So we need to fix this by fixing the section header.
So the first thing we do is the raw address must be set to the same values as the virtual address.
So we change this to 1000.
This 1 to 4000.
This 1 to 5000.
This 1 to 8000.
So let's do it now.
1000.
5000.
So this process is called Unmapping.
So make sure it's correct.
14581458.
Next, we need to fix the raw size by calculating based on the raw address.
So the first raw size here is calculated by taking 4000 -1000.
So we should get 3000.
The second raw size is calculated by taking 5000 -4000.
So this should be 1000.
This raw size is now calculated, taking 8000 -5000.
So this should be 3000.
And the last one, we can leave it.
The section.
We can just ignore it.
So confirm this is correct.
Next.
Now that we have fixed the raw size with unmap, the the raw address.
Next, we have to fix the virtual size.
So the virtual size here column must be the same as the raw size.
So we're going to change this 1 to 3000, this 1 to 1000, this 1 to 3000 and this 1 to 200.
3000.
1000.
3002 hundred.
So make sure it's correct.
Three one, three, two.
So now let's check our imports, whether it has been fixed.
Yes.
So we have fixed the import address table.
You can see all the API that this malware is using.
Next thing you want to do is fix the image base that is.
So let's go to optional headers.
So this process is called rebasing.
So let's check the image base here and we find that image base is already correct.
One C followed by four zeros, which is what we saw here.
One C, 440.
This is the very dumb it forms.
So since it's already correct, there is no need to change it.
So we can now dump the file.
So right click on here and click Save the Executable as and then give it a name.
Maybe we can call it.
On this score, you can see unmap and click save.
Now click okay and we can now close this and we have this unwrapped file here.
We can now go and open an Ida to see whether Ida can read it.
So let's open Ida.
Click new and open our unmatched file over here.
Okay.
Just ignore this click.
Okay.
Let he analyzed.
And look at the function here.
Now, you have so many functions compared to our first analysis where there's only one start function.
So that means we have successfully unpacked hanseter and you can see the function name as well.
And then here you can look at the imports that are there as well, the imports, and then you can also
look at the strings view, opens up views and then click on strings and you can see the strings here
and you can look in this.
We also have a URL here.
The SBC host and so on.
So that's it.
So we have successfully unpacked this malware.
Some consider using the API hooking method and unmapping it using PEB.
So that's all for this session.
Thank you for watching.