Hello and welcome.
In this new section we are going to unpack the Ram cost region description is can be seen in this website.
So Remcos remote control and surveillance is marketed as a legitimate software by German based firm
breaking security for remotely managing Windows Systems and is now widely used in multiple malicious
campaigns by threat actors.
Remcos is a sophisticated remote access Trojan that can be used to fully control and monitor any Windows
computer from Windows XP and onwards.
So this is a Remcos description and this is the website where you can download or you can buy the course
itself.
So now let's get started.
Go and download this Remcos agent.
The agent is used to install on your target computer and how you send this agent will depend on the
delivery strategy.
It could either be sent as an email or put on a website or and use social engineering to get somebody
to install it.
So the agent is the is the malware itself.
So let's now first open the eye
to see what is written with.
So click on the three dots here and go to the folder Forum costs.
And it is the pecker is written in dot net.
And if you click on entropy, you will see it is packed very high.
7.3, 92% packed.
And it's a 32 bit application.
Now let's now use studio to open it.
This drag ram goes into studio.
And he also says 32 bit application entropy is high.
Seven.
Therefore, it's packed.
And he has got the very strange name.
Internal name.
File description as well.
So this packer is written in Dotnet framework.
However, the agent itself, which is inside, will be written in C plus plus.
So let's now try to unpack it.
So we'll open it with x 32 debug since it's a 32 bit program.
Fire your x32 dbg and in the options here preferences uncheck system, breakpoints and callbacks.
Click on Save and Open Your Trojan.
If you have noticed, the Trojan takes on a fake PDF icon.
So now we are going to put some breakpoints, go to the breakpoints tab, and then down here we set
the breakpoint on virtual ALLOC.
And the breakpoint on virtual protect.
A breakpoint on its debugger present.
A breakpoint on createprocess internal w, so just confirm that all the breakpoints are there and in
the options.
We are also going to set a preference here to break on DLL entry.
This is to capture any other libraries which the remcos might call during its execution and then click
on Save.
Then now we will click on Run.
And it hits the API is debugger present.
So we just execute to return and it returns one meaning that the debugger is detected.
So we have to reverse this to zero so that it doesn't detect the debugger.
And then we run again.
This time we hit Virtualalloc and then over here we can follow the virtual alloc by stepping over it
and then step over, which a lot and see what we get in the allocated address which will be returned
in X register.
We get one A followed by three and three zeros.
So if you like, you can follow this in the number one over here.
And then we run again.
We hit virtualalloc again.
And we step over now.
And over here we step over the lock call.
This time it allocates this region of memory 0028.
And we notice now in the one has already unpacked something there.
So we select dumb two now and follow this in dumb two.
Right click.
And we can't follow it properly because it's not allocated.
Right?
So we just continue running F9, which will lock again.
Step over.
Come to this call and step over.
So this time it allocates in this region.
So we're going to jump following down to right click.
I also cannot.
So that means these are not real useful virtual.
So we just continue to run.
Which are along again continue to step over.
This time Region five be followed by three zeros.
Select dump tool and try to follow it.
I also cannot follow again.
That means this is not a useful virtual lock for us to follow.
Continue to run.
Step over.
Okay.
Seems like we can disable virtual lock since it is not getting anywhere.
Let's try one more time.
Same five zero.
Same like the previous one.
So we can disable virtual by going to breakpoints.
So again, this shows the trial and error and exploratory nature of malware analysis.
So if something is not working, we just right click for example, we can disable this API.
We are not going to follow it any longer since it's not useful.
So now we are going to run and this time it hits virtual protect and we are going to now step over virtual
protect.
Go to protect until we reach the call.
And then we look at the second parameter of virtualprotect.
And this time it is going to refer to the Mscorlib library, which is a library for this.
Net framework.
Nothing unusual here, so we don't have to follow this in memory.
It is not necessary.
So we just run again.
Again?
Which will protect.
Step over.
Jump.
Jump to virtual protect until we reach the virtue protect core.
Look at the second parameter again.
Ms..
Call it again.
It is not useful.
So we continue to ignore this.
Run.
Which I protect again, stepped over and jumped to protect.
Until we come to the core.
Look at the second parameter.
CLR is also part of the Common Language runtime, which is part of the dot net framework.
So nothing unusual or suspicious here.
So we can just ignore this, continue to run.
Okay.
And then continue to step over virtualprotect
until step over until we come to the call.
Again, we inspect parameter number two and again, we see nothing suspicious.
Run again.
And finally we hit something that is meaningful.
The API is debugger present, so let's execute to return and see what it returns in X.
And we see it's one.
So we have to reverse this.
So we modify this value and change it to zero to reverse it.
He can run again.
So now it is freely running.
As you can see from the bottom here and breaks at Virtualprotect again and step over, jump to version
protect and come to the core.
And again, we see it is still calling the CLR, nothing unusual.
So now we are going to disable Virtualprotect since we know that this is not the right API to hook.
So we right click this and disable.
So now we have to disabled API which are lock and which will protect continue to run.
So now it is running freely.
Just watch the bottom left corner, see what happens.
And we hit first chance exception.
We can still continue to run and we will do that in the next video.
Thank you for watching.