Welcome back.
So in the previous video, we have already unpacked this and dump it from the memory.
So you might have more than one file if you had already dumped at the earlier address.
So you can analyze, you can unmap both files if you have both or if you only one file like me, you
just have to unmap this one.
So in the moment you can check and see, make sure it is not running.
Or we can see it is running here.
See this?
So this is the new SBC host, which the Trojan has already started.
It is hidden in in this process with this code.
So if you want to stop the Trojan now, you can just stop this here or you can just right click and
then you can suspend it.
You can suspend this region, this one.
And if you double click this host, you go to memory.
You look at the region of memory, which is here.
So this actually is running this unpack code which was injected into this process when the process created
it.
So this code here and this code here should be the same.
So we can just safely kill this.
Now, right click terminate three, click terminate to stop the hidden Trojan process and then we can
close this.
So now if we want to continue to analyze this, you can first need to unmap it with bare, which you
already know how to do.
I've already taught you how to do that in the previous few videos.
So to do that you just go to file open the bag under utilities.
PB.
And then you drag this file into bear and now we have to unmap it.
So we go to session header.
Notice there are no imports because we saw in the last part of the unpacking it is going to dynamically
import the addresses on the fly.
So click on session headers here.
The first thing to do is to fix the raw size.
So each one of these values here, we have to change it to become this.
This one is 5000.
This one is 6000.
Then we have to calculate the raw size so each of these raw size is calculated from these values.
So for this one, it is 4000 -1000.
So it is 3000.
This value is calculated from 5000 -4000, which is 1000.
And then this value is 6000 -5000, which is.
1000.
So make sure it's correct.
Four minus one is three.
Five minus four is one, six minus five is one.
And P data.
If you want, you can just fill it up until it's all red or you can just leave it as it is.
So next, we want to change the values here in virtual size to make sure it's the same as the raw size.
So the first one is 3000.
Second one is 1000 and then 1000.
And last one is 1F8, which is already correct.
So that's it.
And then the next is the base address.
So click on optional header and base address is already correct one followed by seven zeros, which
was badly damaged.
All right.
So now we can dump this unmapped file, right click on this save the executable as.
And then you can give it a name.
With a new suffix.
Here you can see unmatched
click.
Okay, so we have a new file and map file.
Now we can close this and then we can fire either if we wanted to.
We can just continue analysis using either.
So click.
Okay.
You and then go to the desktop.
Select your unmap file.
Open it.
Click.
Okay.
And there you go.
So I'll read this to you to continue your analysis.
Our objective has been met.
We have already unmapped unpacked this file.
So notice there are no imports because this Trojan will dynamically load the libraries as it runs.
Okay, so that's all for this video.
Thank you for watching.