From the previous video, we have already identified the number four.
This regional memory is a correct place to dump, so let's open our process hacker to do that.
Go to flair and go to utilities.
Open process Hacker.
And then look for the night manager.
Double click on it and go to memory.
And then we go down to the disk memory region, which is two D followed by four zeros.
So go to two D followed by four zeros.
There you are.
So now if we expand on this double click on this and we inspect the region of memory, we can see there's
up zero up one.
And then if you compare with this time here, this memory down here, scroll down.
You will also see zero up one.
So this is the same memory.
That means this is a correct place to dump.
So to dump this, we can right click on this one and click on Save.
And go to the desktop.
We are going to save in the remnant folder and we can give it a name with the correct suffix.
Strikes followed by the address where we are jumping from.
So the address to jumping from is 2D, followed by four zero inches hex.
So we put zero x 2d followed by four zeros.
Click on Save.
Now, in your case, the address might be different from mine.
So just follow yours.
Every time we run this analysis, the address that comes up in the dump will be different.
Virtualalloc will always allocate different regions of memory each time you run it.
And this is for Ramnit.
So just follow yours.
So now we have done that and.
Next thing you want to do is we are going to use a since we know it is up spec, we can see it in the
regional memory here.
We need to use the up unpacker so we can close this now and open up cf explorer.
CF Explorer is in flair in utilities and here.
Double click on it.
Now, the reason we use this because this CFF Explorer comes with the up Unpacker, which is highly
convenient for us.
So now we are going to open the dump file.
Okay.
Just drag the dump file into the CSS folder.
So from here you can see the UWP version three is detected.
That is the packer.
And then if you go down to the bottom here, you can see there's up utility and there's a unpack button
there and click on unpack.
And is successfully unpacked.
So now it's unpacked.
We can save it.
Overwrite?
No.
So we give it a new name with the new suffix at the back.
We put the unpack or we can say, um.
Up.
Unpack.
Like that so that we are clear and click on Save.
And now there should be a new file here.
So this one has been unpacked.
So now for the final thing, we can go and analyze this in P studio.
So just open flair and head over to utilities.
Open P studio.
And then we drag the unpack file into studio and just let it analyze.
All right.
From here, we can see some information.
And the strings.
You can see my techniques.
We can group it according to this by clicking this.
And these are some of the suspicious APIs that is using quite a long list, as you can see, which is
very common among malware.
All right.
You see that?
So this you can go ahead and analyze this now.
So that we come to the end of our session, we have successfully met our objectives.
We have unpacked Ramnit Trojan and also unpacked the UPS special Inside Rane Intrusion.
So thank you for watching.
I'll see you in the next one.