Hello and welcome.
In this new video, I'm going to show you how to unpack Ram costs using SPI.
And we need the 32 bit version of the SPI.
Normally you can find it in flair and flair.
You go to dot net.
There should be two versions of DMC.
This one is the 64 bit.
This one is the 32 bit.
If you can't get any of this to work.
For example, in my case.
My 32 bit is not working.
So you can download and the download link is provided in the resource section which is here.
You can download this file and go to this website to download the 32 bit version.
I have already downloaded my 32 bit version, put it on my desktop and I just need to click on this
to to start it.
And to check whether you are running the 32 bit or 64 bit version, you can look up on the top left
corner.
If you see the little bit here, then it is 32 bit version.
So now we track the Ram cost FC into the SPI and then SPI will decompile it.
And the first thing you need to look is the main entry point.
It is normally written up here, so just click on Main to go there.
Now this is an unpacking code.
So since it is unpacking code, after unpacking, it will invoke the unpack executable.
So we are interested to trace the invoke method.
So now let's see.
This is the entry point, the main function, and then here.
Line 78 is the one we are interested in.
This is the only function call.
These two are just setting up the environment.
So just follow this one.
My object.
So after you click on my object, you will notice that this is the My Object class.
And inside here there is a loop.
And the loop goes through all the types of the objects in this program.
And then it checks that, it matches a certain type.
Then it will set the flag to true.
So one way to just jump straight to the flag to be true is to set a breakpoint here.
So if you set a breakpoint here and you click on run, it will come to this whenever the flag is true.
That will save us the trouble of going through each loop one by one.
So now we click on Run and if you hit our at this point here, click okay.
Now it is hit this breakpoint.
So we step into it by clicking this button here.
Step into.
Remember, we are looking for the invoke method.
So now we are inside the array.
If you analyze it, the important block is the if.
So we want this flag here to be true.
This also we want it to be true and we want this to be true.
That means all three flags must be true.
So the innermost function call is the most important one.
That's why it is nested innermost.
So we just put a breakpoint here and that will save us the trouble of having to iterate until we get
all three flags to be true.
So we set a breakpoint here and just run to it.
Okay, now we are here.
We click on the X function to enter it, and here we found our invoke.
So this is what we want.
Now we found the invoke function so we can just click on it to enter it.
This is not using the step in, but just clicking to examine it.
Now we are inside here.
We can put a breakpoint on this one and then run to it.
Now we have hit this so we can step into this breakpoint by clicking here.
And then here we arrive at this method.
And if we analyze this method to the bottom, we can see there is a return here.
So we put the breakpoint and follow this return.
We want to locate the location where it will be ready to execute unpack code.
So we run to this now.
And then we hit this breakpoint here.
So we step into this as well.
Okay.
And then here we find that it is invoking this method for two conditions either arguments null or arguments
like zero.
Otherwise, it will invoke for this condition.
So we can put a breakpoint here and here for these two eventualities, two possible outcomes.
So we run now and it hits this one.
So let's enter this one now and see what is inside it.
So remember, we are tracing invoke up to the innermost core.
So let's click on this to step into it.
Okay.
Now we have I think we are in the innermost core for the invoke function and we look at the parameters
for it and we see there are these parameters here.
Expand on this and you will see there are two parameters inside it the element zero and array element
one.
And interestingly, the second parameter here is the path to the Ram cost X, So and then this could
be the.
Execution parameter.
And then if you expand on the first parameter.
Okay?
Yes.
Drag this up.
You will see there is a mic header there.
This is the hex code for M and Z.
That means this is an executable code.
So could this be the unpack code?
Most probably is because we have traced it up to the innermost invoke function.
So now we can dump this.
Just right click on this first parameter.
Then save.
And we are going to call it Remco's dam number two to differentiate it from the earlier one.
Here we use Cdbg.
So click on Save now to.
We can stop this and we can now go and check.
And if you look at this, sometimes the remcos would spawn a child process called VLC.
If you see VLC in here, you can right click and kill it.
Also, if you have made a mistake during your unpacking with Spy, you want to redo it again.
You have to kill the child process.
Otherwise your debugging in the second session might fail.
So now we're going to check this with studio to see if we have successfully unpacked it.
So go to studio and fire it up.
PS Studio is utilities folder.
And then drag your newly dumped file, which is done number two into P studio and let it analyze.
And straight away we notice the entropy six, which means it is unpacked and the signature is C plus
plus.
This indicates that we have successfully unpacked it.
And then here, 32 bit.
So let it continue to analyze.
We are going to take a look at the strings.
Now you click on the strings and you will see the event viewer X and the registry key privilege, escalation.
And then you can scroll down and look for all the rest of the strings.
You can see all the characteristic strings indicating malware.
And then you will also see the ram costs string here.
So this is positive confirmation that we have indeed unpacked the Ram cost agent.
So that's all for this video.
Thank you for watching.