Hello and welcome to a new section.
In this new section, we are going to see how to unpack a Trojan, which is protected with a commercial
packer called Vmprotect.
So go and download this Trojan VM bin and unzip it and put it in the folder on your desktop called Vmprotect
Trojan.
So we are going to first scan it with D, So open flair, go to the utilities folder and fire up detected.
Easy d i.
And then use detected easy.
Click on the three dots here to open the Trojan.
Call the bin.
Click on Open.
According to the report, you will see the protector is protected.
And this is written in Delphi so that now we know this Trojan is a Delphi Trojan and protected by a
commercial packer called Vmprotect.
So we can now close, detect it easy and we shall try to unpack it.
So fire up your Xdebug X32 DBG since it's a 32 bit Trojan under options preferences, uncheck system,
breakpoint and callbacks, and you can also go to the tab section, click on ignore range and clean
all zeros, eight zeros and and on eight F's.
That means you don't want the thing to break when you have an exception.
So now we open the Trojan, go to the folder and here you click on the dropdown, select all files,
and then select the Trojan to open it.
So now you are the entry point and we are going to put three breakpoints.
The first breakpoint is virtualalloc.
He enter the second breakpoint is Virtualprotect.
Hit enter and the third breakpoint is getprocaddress.
Get proc address which stands for get process address.
Get process.
Address is where the Trojan tries to identify the address where certain libraries are found.
And this is quite common commonly used by Trojans when they are trying to call external functions.
So hit enter.
Now go to the breakpoints tab and confirm that all three breakpoints have been set.
Okay, now we can run to the first breakpoint.
And it has hit our virtual.
So let's press F8 or you can click on this one to step over, jump to Virtualprotect.
Jump to virtual product.
Now he's pushing the five parameters to the stack and about to call Virtualprotect.
So we go to the stack and examine the second parameter.
So this is the location in memory which it is trying to change the permission for zero one followed
by 4000.
So we can go to memory map and see where it is.
401 followed by four zeros is the executable session dot next section.
So at the moment it is only executable and readable.
It is not writable.
There is no W.
So come back here and here.
We can now step over.
But if you want to follow this in, you can.
But I don't think it's necessary.
So let's start over because it is not likely that it is going to unpack it inside and overwrite its
own code.
So let's step over and now we go back to memory map and see there is a W there.
It means is now changed to writable.
So now we run all the way F9 or click on this button and it hits Virtualprotect for the second time
and we continue to step over it.
Jump to virtual protect, jump again and push the five parameters to the stack.
And now it is about to call virtual protect.
This time at this address.
So it is going to change the permission for this memory region so we can follow this in down number
two.
So we select dam number two.
And then right click on this address, follow the word.
Follow the word in current dam, which is dam number two.
So now it is empty.
It hasn't unpacked anything here yet.
So notice the address region is different from the normal region.
The normal region address starts at 004, followed by five zeros.
But this region is 012.
So most likely it is going to unpack in this region.
So we continue to run and see what happens.
Currently, this region 01287 followed by three zeros.
If we look in the memory map, it is over here.
It is currently executable and readable only.
It is not writable.
So when we now step over this and come back and examine the memory map.
It is now writable, as you can see.
W That means it's going to write something here.
It's going to unpack some code here.
So let's continue to run.
And it hits virtualprotect again.
The third time now we step over, jump to virtual project, Jump again, Step Over is pushing the five
parameters to the stack.
Now it's going to call Virtualprotect at this memory address 012F, followed by three zeros.
So 012F is also the same.
Region of memory at 012 range 012F is over here.
This part here currently is readable only.
It is not writable yet.
So if we step over now and come back.
And now you can see it becomes writable as well.
So we can.
You don't have to follow that one because I've done this before and I know that this previous value
here for Virtualprotect is not the one where it is going to dump.
But anyway, if you want, you can we put dump three and then here, right click and follow the word
in calling dump.
What we are interested in is this one.
Because I've done it before and I know that it's going to unpack the code here.
Here is also going to unpack something, but not not the main code.
This is the one.
So anyway, let's run to the next breakpoint.
And hit that again.
Step over.
Jump to Virtualprotect.
Jump again and let it push the five parameters to the stack.
Now it is going to change the permission bit for 1 to 6000.
1 to 6000.
So we can follow in here.
Right click, follow the word random.
Once you have 6000 and we look at memory map 1 to 5, 6000 is here.
Currently it's readable, but let us step over and see what happens.
So now if you look here, it becomes readable as well.
So let's continue to run.
So even the running state now and finally it has populated something in the in the dump.
So this part is also being populated now, as you can see here as well.
At this memory address and here as well.
And here you can see Embarcadero string.
That means it's a Delphi Delphi session that is going to execute 1 to 6000 is also in the same region
as 1 to 8 just further down the the address.
Okay.
So now we can continue to run.
Okay, Now it's going to call Getprocaddress.
It's hit this, hit this breakpoint.
And instead of looking down here, the other alternative is to look for the parameters is on the right
hand side here.
So if you want to know more about Getprocaddress, you can go and look it up at the mSDN.
The second parameter is the name of the API that you are looking for and it returns the address where
this API is found.
You can read about it here if you want.
So in this case here, the address, the address that is returned will be in X.
But we are not interested to follow the whatever APIs this malware is trying to find because we are
just interested in finding where is dumping.
But the reason why we put a breakpoint and get address is we want to know when is the correct time to
dump.
So the correct time to dump is when the gate address is looking for some string which shows that it
has finished dumping.
So that's why we put a breakpoint and get probe address.
So currently if we look at the second parameter port address, it is this API that is trying to get
address for we continue to run and we hit getprocaddress.
This time it's looking for a different API called set value run again.
He will get again this time is looking for phase three.
We run again and now it hits Getprocaddress.
This time is encode pointer.
Run again.
Getprocaddress and good pointer.
Run again.
Getprocaddress and good pointer.
Run again.
Address and code pointer.
So keep on clicking F9 or this button and you can see it keeps calling the getprocaddress to get the
API address for this functions.
So probably this is how Vmprotect works.
It's trying to do something with the pointer to get the address.
Keep on F9.
F9 again.
This time it's decode pointer Getprocaddress for decode pointer click F9 again still same get address
decode pointer.
So it is trying to decode all the APIs, the function names function addresses for for running the malware
and to unpack it into memory.
So click on pressing F9 or this button now encode pointer again.
So this is how Vmprotect seems to be working again.
All right, so now we are moisture protect back on protect.
And now we will continue with the analysis in the next video.
Thank you for watching.