Hello and welcome to a new section.
This time we are going to unpack Trickbot Trojan.
So go and download Trickbot Trojan, unzip it and put it in the folder on your desktop called Trickbot
Trojan.
After that.
Open up the fly folder.
Go to utilities.
We are going to use the detected.
Easy to check to see if it is packed.
So launch detected.
Easy.
And then click on the three dots here to navigate to the folder for the Trojan, which is on the desktop.
Open the trickbot binary.
Over here.
It doesn't show whether there is any packer or any protection.
Click on Entropy.
And you will see here the status says it is packed 85%.
So we know it is packed.
But let us now go and let us now try to unpack it using Xdebug 32 via Xdebug.
In the Options menu, click on preferences.
Uncheck System Breakpoint and uncheck Uncheck the callback.
And then under exceptions, click on ignore range and for the start range key eight zeros and end range
key ETFs.
Hit the okay button and click save.
Now open the Trojan.
Click on the drop down list, select all files, and click on the Trickbot.
Now you will see he has hit our entry point.
Next we are going to put some breakpoints.
So the first breakpoint we put is virtualalloc.
He enter?
Second breakpoint is.
Create process internal w.
Createprocess internal W is where the malware tries to attach to a to a newly created process.
Or it can also create a new process by itself to run certain functions.
Hit enter.
Third one is breakpoint on write process memory.
Write process Memory.
Right process memory is the API whereby the malware tries to hijack an existing process by copying parts
of its code into that process memory in order to be stealthy.
Hit Enter.
After that, click on breakpoints to confirm that you have the three breakpoints as stated.
Virtualalloc create process internal W and write process memory.
After that just hit on F9, it hits a virtual lock press f8 or this button here to step over jump to
virtual lock.
Okay.
After this call to the allocated address in memory would be returned in the register.
Kindly refer back to previous lessons documentations as well on on this.
If you have already forgotten.
So let's step over it now and see.
The return address is three two followed by four zeros so you can follow it by right clicking and follow
in dump.
So now in Dynamo, one click run again.
And now what?
You're allowed.
One more time.
Step over it and jump to virtual airlock and jump again to watch airlock.
And now it's going to call virtual lock for the second time.
Let's step over and see what address is being allocated.
This time it allocates this region of memory three, three, followed by four zeros.
Before we follow this in the memory, let's take a look at the first dump.
The first dump has been populated with some shellcode, as you can see.
So it has unpacked certain shell codes in order to help it with the further unpacking of the main IT
later on.
So let's follow this in down number two.
So let's click on dump number two in memory and then right click on this address and follow in dump.
So now we are following this in dump number two.
At the moment it is empty.
So let's run virtual lock again.
And he hits virtual airlock again.
And this time you see Damtew has been unpacked with further code for the shell code Again, this will
be used by the malware in order to help you unpack the final exe file.
So now let's step over this virtual lock.
Keep on stepping over, jump, and then come to the call here and then step over this call and look
at the X.
It is allocated some more memory in the region for eight followed by four zeros.
So let's follow this in game number three and then right click on this one following them.
So now if you look at dump two, it has populated dump two and dump three is now empty.
So let us now hit one more time.
Run.
It has stopped at our breakpoint for createprocess internal w, so it is using this API to run a cmd
command in order to stop Windows Defender.
So we now need to step through this.
At least now we know that it is trying to stop the antivirus.
So run again.
This time hits the same breakpoint.
Create process internal w and it is now trying to delete the Windows Defender service.
Click run again.
Same thing hits the create process internal W and this time it is trying to disable real time monitoring
using the PowerShell command.
Hit run again.
This time.
It is now trying to drop a file into this location.
So the name of the file is this one you JKL, Vtt dot FC in this location.
This location is the Appdata roaming folder.
We can go there now and try to see what file is this.
So click on the windows icon on the bottom left corner.
And then here type run and click on click the Run.
And then here in the environment variable percentage app data percentage.
So this environment variable shell variable is referring to this location.
Appdata roaming.
So when you click okay, it will open that folder.
And now once you're in this roaming folder, open the W network.
W network is this one.
And this is the file that the Trojan has dropped.
So let us find out if this file is the same file as the trickbot itself to to find out whether or not
it is the same file.
We will use hash files.
So you click on start here, look for hash my files.
This is the one.
And then click on this and we will now use the MD5 utilities to generate the MD5 for this file.
And now we have the MD5 for this file.
And we also do the same thing for the trickbot.
Drag this into here and it will generate the MD5 for Trickbot and you see the MD5 same same hash.
That means this file is the same as the trickbot.
So why does it do this?
It does this in order to be more stealthy.
This is part of the behavior of most Trojans.
When it first runs, it will copy itself from wherever it was first loaded.
For example, it was loaded from the downloads folder.
Then it will copy itself to a location which is hidden, a stealthy location, so that in future it
will run from this location instead of from the original place where it was first downloaded.
So now we know that this is the same file as the Trickbot program itself, the original file.
So before the Trojan will run, it will first probably check to see to make sure that it is in this
stealthy location before it will proceed or continue running.
We will pause here just for this video and continue the analysis in the next video.
Thank you for watching.