Hello and welcome to a new section.
In this new section, we are going to unpack the Ramnit Trojan.
So in this website here, you can read about the Ramnit Trojan Ramnit.
It is not a new Trojan and it has been around for some time now.
First detected in 2010.
He was originally designed to attack bank accounts by infecting PCs and using them as proxy servers
for malicious activity.
And since then it has evolved.
So previously remnant operated as a botnet, infecting computers, turning them into bots.
And recently the current objective is to steal credentials via web injects that trick people to providing
confidential information.
And Remnick is best known for focusing on the banking industry.
How it spreads.
Remit was originally distributed using worm capabilities, but is now distributed via executable files
that are downloaded and executed by an unwitting user.
And also there's been cases of remnants being distributed via email spam, that is malware spamming
via email.
When victims download it by clicking on an ad or on an insecure website.
So go and download this Ramnit file, unzip it and put it on the desktop folder called Ramnit.
So the first thing we do is to do a preliminary scan to see whether it is packed.
So we can fire up our detector by going to flair utilities.
In open the detected easy.
Click on the three dots here.
Navigate to the desktop.
Open remit.
And you see here it is actually packed with it.
But later on, we'll see.
There is also speckle inside.
And then now we take a look at the entropy.
Very high.
95% of the file is packed.
As you can see, fact.
The other tool we can use to do a preliminary analysis is to use B studio.
So let's go to utilities folder and Fire B studio and then drag it into B studio.
And from here you can see it is a 32 bit executable.
And entropy is also high.
Bone is seven.
More than seven normally indicates it is packed.
And if you look at the session.
You can see there, there's an additional text section which is irregular, and this text section is
quite high entropy, which means it is packed.
Same with the resource here.
7.8.
7.9.
And now we are going to unpack it with Xdebug.
So fire up the 32 bit version of Xdebug.
And then in the options preferences, uncheck system, breakpoints and callbacks.
Click on Save and then open the remnant Trojan.
Click on the dropdown, select all files select on.
And now we are going to put certain break points.
First one is virtual lock.
Next one is virtual product.
And then create process internal w.
Followed by write process Memory.
And then breakpoint or is debugger present?
And one more on breakpoint on empty resume track.
Now we go to the breakpoints tab and confirm that we have those breakpoints, which we have set.
And as I mentioned before, if it's is the first time you are encountering this malware, you do not
know which breakpoint is set.
So you should set on all of them.
Those that I mentioned earlier in the start of this course, as many as you can.
But after a few rounds you will narrow down to just a few to those which are more likely to get hit.
So now you can run it.
F9, Click on this to run.
And straight away it hits this createprocess internal W and this process is going to run this file.
And it appears that this file has just been dropped into this location.
So let's go there and see.
That location is actually the same folder where we started the original Trojan.
So you can see from here.
So this is a new file which has been dropped and it is about to execute this.
So now, before we can attach to this, we must let it execute this.
That means we have to let it run this API.
So to let it run this API, we can click this one run to user code.
Right?
So the API has been run and probably this process has already been started.
So you can confirm that by going to the process Hacker And take a look.
Click on Flash Utilities.
Go to process Hacker and fire up process Hacker.
And then scroll down and look for it.
There you go.
Remnick is the parent process, and it has spawned this new process called Remnick Manager through this
API create process internal, which we saw just now, just before we stepped over it.
So now, since we know that it is running, we can attach to it by opening a new instance of X32 debug
without closing the old instance of xdebug.
So to open a new instance of X32 debug, we will come down here, right click on this and then select
x32 debug.
Click.
Yes.
And now, since this second process, remnant manager is already running in memory, we can attach by
clicking file and then here click on attach and then you can see here it is already in memory Remnant
Manager.
So we can click on this and click Attach.
We will continue with the analysis from where we left off in the next video.
Thank you for watching.