Hello and welcome back.
In the previous video, we used Xdebug.
To run this demonstration.
And we didn't until we hit her first chance.
Exception on the bottom left corner.
So now when we see this, we can continue to run again.
No problem.
Just click on this run.
Again, first chance exception.
Never mind continuing to click Run.
And now it is really running.
And this time it hits the API.
Create process internal W and you can see here the parameter for it is this one ram cost dot x.
So this means that it is going to spawn a child process.
From his own cell, Graham Cox.
And we can confirm that by going to process hacker and keep an eye on it.
So let's open process Hacker.
And keep an eye on this course as it is going to spawn another child process out of itself.
It.
Hey, over here.
So after a child processes his phone, it might call anti resume thread.
For most of the time when malware spawns a child process, it will be in a suspended state and we can
confirm that by looking at the parameters for this create process internal, we can see the parameters
to it either here or here.
Now create process internal over here, create process.
Internal has got 12 parameters and the important one would be the seventh parameter W creation flag.
The creation flag would be to indicate whether you want to create in a suspended state or otherwise.
So if we look at the seventh parameter here, this is the first parameter second, third, fourth,
five, six, seven, four four means that it is going to create this process in the suspended state.
So if we know that we can put another breakpoint on anti resume thread because anti resume thread would
then bring it out of the suspended state eventually.
So now we can set a breakpoint be on anti resume thread
hit enter make sure it's set to resume thread is there and one more will be write process memory.
So breakpoint on write process memory so anti resume read and write process memory goes hand in hand.
We create process internal so these three create process internal write process memory anti resume thread
are used to spawn a child process create process internal is to create separate process child process
write process memory is to overwrite a section of the child process with some other code and anti racism
thread is to resume a suspended thread.
So createprocess internal creates and suspends a thread so that it can write to it and then it will
resume it in order to bring it out of the suspended state.
So that's why these three works together hand in hand, and that's why we are putting API breakpoints
on these three.
So now after having done that, we can run.
So let us run now, F9.
And there you go.
Write process memory.
So write process, memory is going to write to the child process, which has spawned if you go back
to here now.
Process.
Hacker You will see that the parent has spawned a child.
Just as we expected.
So now if we go back here, it's going to write something into the child memory.
If you look at the API for this.
I possess.
Memory has five parameters.
The first is the handle for the process for the child.
And then the second is the base address.
So we can compare that with the parameter here or here.
First is the handle to the child process.
Second is the base address of the child.
And third is your buffer.
That means what it is going to use to write into the child process.
That means it's going to write buffer number three, this one.
So we can follow this in dump number three if we want.
So let's go follow this select dump number three and right click on this one and follow the word in
dump.
Follow the word in current dump, which is done number three.
And as you can see, there is a header and the complete exe is now found in here.
As you scroll down, you can see.
Okay.
Let's go back to the start of this.
Follow river in Canada.
Okay, so now this is a good place to dump.
So if you want to dump this, you will need to select all this region of memory.
That means you click on the first byte here for the and then you scroll all the way down, press shift
on your keyboard, hold down shift, and then click on the last byte.
That means you select and the entire thing, and now you can dump it.
Right click.
And then you can click on binary Go to save to a file.
So we can now dump this to a file.
So I'm going to dump it in my folder.
Ram course folder.
And I'm going to call it Ram course.
Dump dot bin and click on Save.
Now, please be aware that the address that you get might be different from mine.
So just follow what what you see and what you get for your case.
So now, since we have already done this, if we go to the desktop, the folder and then have done the
size is about 256kB.
So in the next video, we will continue with this analysis.
Thank you for watching.