Hello and welcome back.
In the previous video, we stopped here where we found that the Trojan was making a copy of itself into
a stealthy location.
So in future, the project will run from here for sure, because this is a stealthy location, and before
it will unleash its full powers, it will make sure that he will check its path.
So we might as well analyze it from here instead of from the original one.
So now we will stop this original analysis in Xpg and open the other location instead.
That means we will use Xpg to analyze this.
So we select the path copy and then we go to Xpg and then open paste the path here and then hit enter
and then open this new file.
Now, we are also going to put the same breakpoints as we did as in the first session.
So let's put the breakpoint on virtual lock, hit enter and the breakpoint on create process internal
W
hit enter and then a breakpoint on write process memory
hit enter and one more additional breakpoint called and write virtual memory breakpoint on and write
virtual memory.
Now this empty write virtual memory is the same as write process memory, but is lower level.
And normally we use this as well in order to make sure we don't miss anything.
So hit enter and then click on the breakpoints tab to confirm that we have all the four breakpoints.
So now we can go back and continue with the analysis.
So press F9 or this button run button and let it hit the first breakpoint virtual alloc.
So now we press F8 or step over, we jump to virtual
and then step over this.
And look at the X and select the number one and then follow this in downward one.
Right click, follow and done.
Now it's empty.
Click F9 or run button his virtual lock again.
Step over again.
So it's behaving the same like the the first session.
Okay.
Step over this virtual lock and then look at this X.
So now click on number two and notice that number one has been populated with Shellcode.
Click on dam number two and then right click on this following dam.
So we are following Number two at the moment is empty.
So click run.
And now the number two has been populated with Shellcode.
So this shellcode in here, this location in memory, as well as this location.
Memory is the same C 32 and then 33.
So they are like continuous, like one big shellcode that is going to be used by the Trojan in order
to help you unpack the final executable.
So now we hit Virtualalloc again.
So we step over it.
Jump to virtual and then step over this virtual lock and look at the allocation, this time at this
address.
So now select this third jump and then right click on this address following Dum number three.
So at the moment Dum three is empty.
So run.
It is now freely running and now it is virtual again.
Away.
Summary.
And now step over this call to Virtualalloc and look at this is a new address for air followed by four
zero.
Click done number four, and then right click on this follow in dump.
So now it's dump number four is empty.
Click Run.
Step over.
So part of malware analysis unpacking is just to keep on following the VirtualBox.
And see what is being unpacked, if any, in any of those locations.
So we hit virtual a lot again, but this time we saw that downfall has been populated with some executables.
We see that this is a 64 bit executable.
And Gumtree is still blank.
So now we hit virtual lock again.
Let's step over.
We are looking for the final executable.
So let's start over.
All right.
And then this time it has allocated this region of memory six D, followed by four zeros.
So we go to down number five and then right click on this and then follow in, down, down number five.
Now we hit run.
It hits virtualalloc.
This time down number five has got some executable.
You can see the magic header, magic bytes and the string.
This program cannot be run in Dos mode.
So if you wanted to, you can dump this now by right clicking this and then follow in memory map and
then go here and then right click and then click on dump memory to file.
And then once you dump memory to file, you can fix the Unmapping using pbair and then analyze it with
your Ida.
All right, so this is one.
One is that you can dump.
All right.
I believe that to you if you wanted to do that.
But for this video, I will proceed to see what other executables are being done.
So now we click.
Now we have a virtual hello again.
So we step over.
And now we are going to go virtual again.
So now we start over and this time it allocates this region of memory.
So right click, right this region of memory is not allocated yet, so that's why you can't follow it.
So we run again.
Again, we step over.
Right?
We are going to call again virtual lock.
All right.
This time it allocates the this region of memory.
Right click.
This time you can follow in dump.
So since we have used all the five dumps, we go back to dump number one.
And then over here we are going to follow in number one, right click following dump.
So this dump, number one now at this address, one followed by seven zeros.
It is empty at the moment.
So let us run and see what happens.
And this time it has populated it.
With all this code.
This is an exe.
You can see the magic bytes MSG followed by this string.
This program cannot be run in Dos mode.
I'll be going to dump this now.
We are not sure if it has fully unpacked it.
We only can see the header, so to be sure that it is fully unpacked, we will continue to run until
it is about to execute this code.
So now we will open process hacker to see whether it will execute this code in other processes.
So we open process Hacker over here, go to utilities, click on Process Hacker.
And then we see if it has spawned any additional processes.
So at the moment our Trojan has not spawned any additional processes and Trickbot is known for spawning
a process called SVC host and then injecting part of a code.
It's code inside SVC.
Host.
So that's why we will continue to run.
It's probably going to inject this code here inside the SVC host, which we'll see later.
So that's why we are not dumping now.
We wait for it to to finish unpacking first.
And how will we know when it has finished unpacking, when it is about to write to a virtual memory
inside SVC?
Host That's how we know.
So at the moment we still continue to run.
So this will allow we can step over.
Okay, now we come to this step again, and this time it is continuing to unpack itself to the same
region of memory.
One followed by seven zeros, but at a lower address.
Okay, So let's continue to unpack itself here so we don't have to follow this in dump because we know
what it's doing.
But if you want, you can follow, you can select down to right click and then follow in dump number
two.
Which one?
Now we run.
And true enough, it has unpacked additional code in this region of memory, starting from here, going
down and continuing here.
Same region of memory.
And if we hit voucher a lot again.
So let's jump.
Continue.
Okay, let's step over this call.
And it's still unpacking itself to the same region of memory, this time at this address.
So follow this in.
Down number three, select down number three, right click, and then follow in dump number three.
So we are now following here.
Let's run.
And this time it is unpacked.
Continue to unpack additional code to the same region of memory starting from here.
Continuing here.
And you can see this is the library which is trying to load, load, load, kernel32 and so on.
So this seems like almost the end of the unpacking already.
Once you see this.
But anyway, let's continue to.
Step over the virtual.
Okay, let's call this and see what it does now.
Okay, so now it still continues to unpack, so we follow it in the dump four and then right click.
Now this same region of memory, starting with one following down number four.
And then let's run and see what happens.
All right.
Still watching.
Step over.
Jump.
Turn over the switala.
Still unpacking this time to this region of memory.
So click on this dump file.
Right click.
Following dump.
Still nothing here, so just run.
Ah.
This time it is.
Dump something.
Five four is still empty, right?
So it is still continuing to unpack.
The unpacking process has started from dump one at this address continues here.
Same address, same range.
But lower down.
Continue here.
Even lower down.
Same range.
Continue here.
Same region of memory, starting with one followed by seven zeros here.
All right.
So this is interesting.
Let's follow this.
See what else it is going to unpack in that region of memory.
So let's step over, go to the call here.
Step over this Virtala.
This time I think it has finished unpacking because now it is a totally different area of memory.
Six E So we can ignore that.
We are now continuing to run.
Just click on F9 until we see this.
So this is what we are looking for.
Once you see this, that means it has finished unpacking.
So the unpack code is in this region of memory one followed by seven zeros and all the way to this,
this, this, and finally this.
So this is the last region of memory we started from here.
Same region.
So it has finished unpacked.
That's why it is calling this.
It is using this API to create this SPC host and then it is going to write this, this unpack code into
this SPC host that it is the intention of this malware.
Now we are ready to jump because we know it has fully unpacked.
We can now safely right click on this and then follow in memory map and then go down to this location
here, right click.
And then.
The memory to file.
So now we can dump it to the desktop desktop, go to the Trickbot Trojan folder and then just save it
here.
Okay, so now we have successfully unpacked one of the main trickbot's executable file which has unpacked
itself and about to inject into SDC.
Host.
So if you go to this process hacker, you see it is going to start SDC.
Host And then move this, copy this file into that process memory.
So let's run and see that happen.
Okay.
You can see here empty, right?
Virtual memory.
It is going to write this into virtual memory.
Come back here and see.
SVC host has been started by district board.
See that?
So it's now going to write this into SVC.
Host Let's run.
Same thing.
It is continuing to write.
Go back here and see.
Run again.
All right.
This additional and now terminated so if you come and see process hacker.
It has terminated, Right?
So now we can just close everything and then continue with the next video where we will take a look
at the dump file which we saved in our folder here.
This one.
So thank you.
I will see you in the next one.