Welcome back.
In the previous video, we use Cdbg to put some breakpoints, these four breakpoints, and we keep stepping
over and following the virtual lock in, down one, two and three, and then we run and hit virtual
protect.
That's where we stopped.
So now we will continue from virtual protect and we will step over virtual protect.
Jump, jump and push all the parameters to the stack until we come to the call for Virtualprotect.
Now we examine the parameters.
The second parameter and we notice that it is changing the the permission for the Z loader for this
region of memory.
Six for eight followed by three zeros.
So we can follow this in down for.
Right click and follow.
Deerwood in Kaandam.
And now over here we can right click and follow a memory map.
And we see that this is the region of memory where the DNA is being loaded at this point in time.
It may have finished unpacking and that's why the virtual clock has completed.
We have hit watch three times.
So now we will go to user code.
We will step over until this return here.
So this return here, if we step over this, we will go back to user code.
So step over and we are back here.
And if you scroll up, this was the call where the unpacking was probably done.
So now we are here and it is now next going to it is going to jump to the unpack code.
Normally in malware there will be a jump to X or jump to some register.
In this case here, there will not be any jump to a register.
Instead, it will use an anomaly in the epilogue.
We will look for the some kind of address where it will jump to and that address would be the pointer
to the unpack code.
So now we will continue to step over.
So basically when you are exploring this, you have to follow this in dumb each one of these.
So and that might take some time.
So let me save you some time.
And I've already done this and I found that this is the one.
So if you are not sure you do, do it for every one of these.
So now we are going to right click on this one and follow in dumb number four.
So we follow in current dumb the value in plus 6617 and you can see there is a missing header there.
So now we can dump this.
We select the first of the hex here and then we want to scroll down and select the end of this regional
memory.
So click on this first and then scroll all the way to the bottom to find the end.
So the end is somewhere here.
If you scroll on the bottom, there is nothing there at the bottom.
So let's move up a little bit, click on here to move up a little bit
and drag this, make sure there's nothing at the bottom.
We try to make the file that we want to dump as small as possible.
Okay, so we are here.
Try to get the smallest possible region.
Then we want to dump.
Okay, So here, I think.
Go down a little bit more.
Give it some extra blank.
Okay.
This seems to be a nice number.
99999999.
So we can press and hold down shift.
Remember to press and hold down shift.
And then while holding down the shift key, click on this.
So now you've selected the entire region of memory from the header right to the bottom end of the file
and some added some extra padding.
Now we can right click on this and then we can click on binary and save to a file.
So we go to the desktop and save it in the Z loader folder.
We will call it Z loader underscore dump dot bin.
Click on Save.
Now we minimize Xbg and go and check out our Z loader.
It's approximately 185kB.
So we have now done this.
So we will continue with the analysis in the next video.
Thank you for watching.