Hello and welcome back.
In the previous video we have done this from memory, so now we can go and view it from here.
Now note that your address where you dummy from might be different from mine, so just follow yours.
So now we can go and analyze with bank and see whether we need to map it.
So just open flair utilities and fly up bear.
And then just drag the ram cost dump into there.
So now if we take a look at the plots, we can see that everything is in order.
So there is nothing to fix the not necessary to do unmapping So now we can go and analyze this.
We studio go to fly, look for B studio and Fire B studio.
All right.
Taking a look at this, you can see that the entropy is low, 3.922.
So that lends support that we have already successfully unpacked this.
And look at the indicators now so we can see some of the indicators here.
The file contains another file in the overlay section over here.
So that seems to be another embedded file here.
Take a look at the directories.
Sections and you see they're all quite low entropy, less than seven, meaning that it is not it is
no longer packed.
And see this is some of the suspicious libraries like connecting to the Internet.
Looking imports many imports used by Trojans.
Enumerate service opens username, redis creating registry, and so on.
Connecting to the Internet, writing process, memory and allocating.
All this are very highly suspicious.
C Windows Hook for keylogging.
Here's for enumerating the processes which are running in the in the computer.
Dominant process to stop processes shall execute against.
Suspicious load library to get external functions Copying the keyboard data.
Stealing information.
Recording sounds.
And so on.
Look at strings and you can see some registry keys here as well.
And these two event viewer and these typically used for privilege escalation.
And you can see here some scripting languages as well.
Shell scripts.
This one as well.
All the highly suspicious.
Look at that running VBS VBScript.
We have managed to unpack successfully and got a lot of information about ram costs.
So this gamut of objectives, which is to learn how to unpack the Ram costs using xpg.
Thank you for watching.
I'll see you in the next one.