Welcome back.
In this video, we are going to start unpacking radicals.
So fire up your x32 debug since we know it is a 32 bit program.
And then go to the options preferences and uncheck system breakpoints and uncheck callbacks.
Click on Save.
And then open the Trojan.
He will hit your entry point, as you can see.
So now we are going to put three breakpoints.
The first breakpoint is virtual.
The second breakpoint is Virtualprotect.
And the third breakpoint is optional.
It is actually create process internal.
Normally we will put that if we suspect it's going to be a self injecting Trojan.
Or if we suspect that it is going to call some other APIs and execute them by creating a new process.
So we just press enter now.
And then if we click on the breakpoint, we will see that confirm the three breakpoints being set,
which are lock, which are protect and create process internal w.
Now, if you didn't know what breakpoints you are supposed to set, set as many as you can, but if
you have already tried this a few rounds, you can start to narrow it down to only those which it actually
hits, or only those which are relevant to what you observe.
So macro analysis is a lot of trial and error.
Normally, the first analysis will not succeed, so it's a very time consuming process.
So a lot of trial and error and guesswork as well.
So now we are going to run now this Trojan.
Trojans can either create an external process or it can create an internal process by overwriting part
of its own memory and running from there.
Now it so happens that Dridex is the Trojan, which overwrites its own process.
His own process memory.
So that is called Self-injecting self injecting Trojan.
Okay, so now it has hit the virtual lock.
And if we step over virtual A.
Come.
And now if we step over this call, we look at the return allocated address in X, we can follow this
in the dump one.
So right click on this following dump.
Now it's empty.
So let's run now.
His virtual analog again f8 to step over or click on this one.
To step over
and step over this virtual lock.
And now it allocates three seven followed by four zeros.
So click on Done Tool.
We are going to follow this in down to.
Now we are falling down to that one is still blank.
Now we run F9 and this time we see it has unpacked some B header B file in dump to dump one is still
blank.
So you can dump this now and analyze it if you wanted to.
But we are going to proceed further because this is probably not the main exe, but you won't know that
until you have dumped it.
So that's why there's a lot of trial and error in malware analysis because you don't know which one
is the main B, so you may need to dump all of them.
But since I've done this already, I know that this is not the main path.
But if you are facing this for the first time, this Trojan, you wouldn't know that.
So you will dump this.
So now you will go ahead and.
Step over the water.
So let's see.
Get established again and now it is allocated this regional memory.
So now we go here, click on Done Tree.
We're going to follow this in Dump tree by right clicking it and clicking follow in dump.
Okay, so now we see dump tree is blank empty.
And then now we keep on running.
All right.
And now we hit Roger Protect.
So now it is already.
If you click on the breakpoint, you can see how many times which lock has been hit.
Three times.
All right.
So at this point in time, we do not know when is the proper time to dump and we do not know where is
the main memory which we are supposed to dump from.
So that's why the first round we are doing this or the first few rounds that we do this.
We don't dump anything yet.
We just count how many times which lock has been hit, how many times which protect has been hit.
Okay, so now we just go through the motions to get the the count, the enumeration.
So now it's hit virtualprotect.
And so we are going to step over, jump to Virtualprotect, jump to watch protect again and let it push
the parameters to the stack.
And now we look at the second parameter.
Second parameter is the location in memory where it would change the permission.
So in this case it is three five followed by three zeros.
So if we go to.
And we continue to run.
So now we can step over.
Since I've done this, I'll save you some time.
But initially you will know.
So you need to do everything but try to cut this short.
So now it's going to go with your product again.
And look at the second parameter this time is this region of memory.
Now this one has got one followed by seven zeros.
Look it up in the memory map because you cannot right click this and follow in memory map.
Right here.
He followed me.
You might be following this address rather than the D-word.
But we want to look at the D-word.
So we follow in memory map.
One followed by seven zeros is here.
Over here.
That means it is already written.
Is about to write something.
Okay, so let's see.
What does this do?
Let's step over this and take a look again.
And so it has removed the W flag.
That means previously it was writable.
Now it's no more writable.
Go.
That means that it has finished unpacking code.
Normally that would be the case.
That's why it removes the writable flag.
So at this point in time we may
conclude that it has finished unpacking.
But.
At this region of memory one followed by seven zeros.
So one followed by seven zero seems to be an important location.
So we can follow that.
One followed by seven zeros.
We can follow that in the right click.
Follow dealer in Kaandam.
Curing them, maybe.
Yeah, we can use them.
Number three if we want.
Follow the one in calendar.
As you can see, this region of memory has got an MC header and a string.
This program cannot be run in dark mode, so obviously it has unpacked something into this region of
memory over here.
So now it's already only readable.
No more writable, but we don't want to dump now because we're not sure whether or not it has finished
unpacking.
So we will continue to execute this until something happens, for example, until it stops executing
or it stops breaking in all the breakpoints or it has entered into an exception.
So if you take a look at the breakpoints we see now, the virtual lock has been hit three times and
virtualprotect two times.
So let's see how many times you hit continue to run.
It hits virtualprotect again.
So we step over, jump to Virtualprotect, jump to Virtualprotect.
Okay, now we see it is continuing to unpack something in this region of memory.
Same region.
We started from one followed by seven zeros and then now it's unpacking at one, followed by ending
with one three zeros.
Same region of memory, just a continuation.
That means it hasn't finished unpacking yet.
It's still continuing.
So we can follow this one in.
Probably we put this pull it to the left.
Now we follow in dump number three.
But.
If you want to, but I think it's not necessary.
We know that it hasn't finished unpacking, so let's continue to run.
So let's step over.
Which you protect again.
Again.
Will you protect?
Okay.
This time look at the second parameter.
Still haven't finished unpacking.
Same region of memory.
We started from one followed by seven zero.
So we need to do anything.
Just let it finish.
Unpacking.
Step over.
And then run still hit virtue protect.
Step over.
Jump to virtue.
Protect.
Jump to virtue.
Protect.
See that still same region of memory, but at a at a higher address range, 283330.
So it still hasn't finished unpacking.
So you let it unpack, continue running still virtualprotect.
So it seems like this region of memory is super important here.
One followed by seven zeros as it keeps unpacking itself into the original memory which commences from
here.
So we continue to step over.
Now take a look at this.
Still same one, starting with one.
And then this time, 29000.
That means it still hasn't finished unpacking.
So we continue to do this F9, F9, and keep on looking and see how many times it is going to hit Virtualprotect.
Okay, so now step over.
Run all the way.
And now you see there's a first chance exception.
See that?
That means it's probably finish unpacking.
So now we have a count.
Take a look at the breakpoint.
Waterboarding has been hit six times, which are allowed three times.
So take note of this.
Open a notepad and write that down.
Open notepad.
And write it down.
Virtual has been hit three times.
Virtual protect has been hit six times.
And the last API that was hit was virtual lock.
So this is a clue.
Once we see virtual lock has been hit six times, we know that unpacking has finished and we can dump
from this region of memory one followed by seven zero.
So this is a simple trick to know when to dump.
Okay, so now the next thing for us to do is to shut everything down.
And then for this one, you need to copy out to a external file outside the virtual machine or just
copy this down in the paper using pen and paper, because we are going to reset the virtual machine
because by now the malware must have made some infection, might have infected the virtual machine.
So let us go and reset the virtual machine.
So let's shut everything down and I will see you in the next video.