Hello.
Welcome back.
In the last video we did an API enumeration to count how many times the API has been hit and we found
that he was hit three times for Virtualalloc and six times for Virtualprotect.
And the Watcher Protect was the last one to be hit just before it went into first chance exception.
So we know that when we see Virtualalloc hit for the sixth time, we can dump just before it hits the
first chance exception.
So that is a trick.
So now we are going to put the.
Send the options for x32 DBS before check system breakpoints callbacks and then open the dridex trojan.
And we put our two breakpoints.
Breakpoint on virtual lock and breakpoint on virtual protect.
We don't need to put create process internal because it was never hit.
So we go and see now in the breakpoint tab confirm that both has been set and now the count is zero
and zero.
So we can continue to F9 until it becomes six for virtual protect six over here.
That's when we know that we are ready to dump.
So let's run, hit, watch.
You can ignore that.
Run which Ignore that.
Run.
Ignore that run.
Watch.
Protect.
Okay, look at the second parameter.
Let's step over first.
Step over.
Stem over until we come to the call.
Now, you look at the second parameter.
This region of memory.
Okay.
If you want, you can follow this region of memory following number one.
If we want to do.
But it's optional.
So now we continue to step over.
And run and then still watch, protect and if we keep on stepping jump.
After the call here.
Second parameter, it is continuing to unpack that run.
Again.
We should rotate.
Step over.
Jump.
Step until the conservation project.
Second parameter.
See that?
It continues on back there.
And look at the breakpoint count.
Three, three.
Not yet.
So we need to wait until it is three six.
Remember from our previous enumeration.
Three six.
Okay, let's run now.
Step all this and.
And step over this and run.
What's important again.
Step over
until we come here.
See that?
Continue to unpack in the same memory region, starting from one followed by seven zeros.
Run again.
Look at the count.
Three, four.
Again we can protect.
Step over.
Step over until we come to the call.
Second parameter.
Same same regional memory and a higher address.
2830.
Hit on break .35.
That means one more hit to go.
Okay, so run again.
Step over.
Jump to protect.
And now step over.
And I think it has finished.
So now we go to break point six.
That means we are ready to dump memory.
So because this is self-injecting, we do not dump from here.
Previously we used to do this right click follow in memory map and then we dump from here, right click.
That may be the file, but because this is self injection, that means it's overwriting its own process.
So what we do is we go to process hacker, so we open flag, go to utilities.
And then open up process Hacker.
And then search for the dialexia and then double click on the annex and then go to the memory folder.
Now we are going to dump from here at the address of one followed by seven zeros.
This one you can expand and see.
So all this is the unpack code.
It has self-injected the unpack code to its own process over here.
And you can see protection bits are writable and executable.
So we can right click on this now and then.
Save.
And then go to the desktop, save in the Dridex folder so we can call this Dridex dump.
Write X underscore dump.
Save.
Okay, so now that you can close everything.
Close this, and then you can close your xdb as well.
We have already done this here.
So in the next video, I'm going to show you the process of unmapping it using PEB.
Thank you for watching.