Original subtitles

hello and welcome to malware analysis

for hedgehogs I'm finally back from

vacation and mahindra team has pointed

me to an interesting sample that I

indeed think is worth making a video

although it's another dotnet unpacking

tutorial it's there are some new

techniques involve which I didn't show

my other videos yet alright let's take a

look at the sample first there's a debug

path in the sample and it's it's indeed

it on that file you can see this here

and debug path is interesting because

Visual Studio will put this path there

by default so if a developer doesn't

change it it will expose the user name

for instance that's been used on the

development computer and this although

also the name of the project that has

been used in this case it's a standard

name that's Vanessa application and the

number so that's if you click on visual

studio on the new project button this

will be created with the number behind

it so it's the fourth standard project

that this developer did to me it's an

indication that the project wasn't very

important to the developer because

otherwise they would have given me the

proper name and not that all right

checking the strings will also show the

path again and their sis a method X in

which i think is worth

to look at later and lots of lots of

base64 strings now I assumed that piece

2d has an upper limit for the size of

the strings because that's actually just

one string as you will see later okay

let's check the code in a decompiler and

now as soon as busily I clicked up the

main because that's my code execution

starts but as soon as you see a set of

this as my computer my project my

settings and so on you may want to check

the form one first

that's a fun application that means a

lot of the code that's here has been

generated by Visual Studio and that's

nothing you're interested in so you look

at the form first that's the user code

the code of the developer and here's a

lot of junk right there so the more

interesting methods to look at are the

form load and initialized component

method so I was the school but through

you see that's nothing nothing

interesting here and here's the form

node and that's interesting code there

is our emitted eggs a it's a fall and

temp directory and what's written to is

it is base64 string so there we have the

base64 string now we just need to find

the string so we can decode it ourselves

in this case that's the easiest way

okay of course you can also execute the

file and then get the are murdered eggsy

and then you also have the dropped file

and obviously it's a dropper it rides a

two-disc and so it's a dropper what did

I want to do I wanted to check the

resources these buttons are t-money

all right here's the text for one

resource and now we can save this with

the button here safe and here we have it

open it with notepad and then you might

want to remove the header of the

resource we don't need it anymore and

just decode the base64 string save it to

the file and then you might want to

recheck what you've got here okay again

it does not fall nice and it has

internal name and origin I'm server dot

exe that's a huge sign to me that this

is a remote access trojan because they

call the pad that's on the victims

computer server and the client is the

pad that's on the attackers computer so

it

all right users reflection and load load

module so it's it seems it's loading

something then Emily and we need to

check that

all right at this point you can see that

this is obfuscated by confuse err and

confuses one of the more difficult

obfuscators but we will be able to

tackle that nevertheless and here you

can see the load module call which is

interesting for us and also an invoke

but I at this point you should be able

to dump this array here and that's what

we want to do it gets something from the

resources and then reads it and into

this array and then loads it here here's

the every so the best way to get this as

using the inspire and

we will just do that

all right

you need to take the right version for

debugging if it's 64-bit application you

need the inspired exe otherwise you need

the 86th or DC run it as administrator

all right

and we okay we open up the debugging

that is

now you might ask why I do not do pro

skate the confuse awright here because

it's not necessary the important parts

are readable right here so that's what I

will do

okay I quit and here that was the

interesting part we want to dump this

array I would set a breakpoint here and

press Continue and there we have our

array let's see what's in there yeah

nothing useful yet and we will step once

and then yes please

and here it's been decoded or decrypted

or whatever I guess this function is

decrypting the array and that's here the

MM zet so we have probably a executable

or well a part of a executable at least

so take a look in the memory when

they're all right now you can

right-click and say save selection to

the desktop

that's all first dump and say that okay

no need to check this here this

okay the first up

now that's interesting right here that's

a net module and it's interesting

insofar as if you want to debug this

dump you need to make it run away first

and that module is not run away on its

own the smallest runnable thing and

and.net executables is the assembly and

the assembly has a manifest that it's

necessary to make it run the net module

does not have this manifest and it's

only meant to be used in context of an

assembly so but the inspire is able to

create on assembly out of the net module

so in case you want to use debugging to

unpack this open up the inspire and

that's our new thing that we do right we

learn how to write here

so we open the dumb where is it there

now you can also see its names net

module and you can right click on it

then you can say convert to assembly did

that and then say save all and I would

save it to you like modified that's the

modified dump right and if you do not do

that well let me just open up process

Explorer to check if that's all right

just that half

okay that's the unmodified file

and this shouldn't work it's not a well

in 32 application and I will show you

soon the reason

I think the same should happen here the

this one still should not run and I'm

just verifying this by looking at

persons Explorer and again it does not

run although we added or we made an

assembly out of it

so what's the problem now you need to

open this with cff explorer that's also

a viewer for PE relevant related

metadata but you can also edit the

metadata and there's one thing here

that's wrong that's this the file is a

deal just uncheck this it's not a deal

you want an executable and another

dynamic link library and the other thing

is if it's a forms application like like

our first far we had you might want to

change this to two windows graphical

user interface instead of this so but we

don't need that here for alpha yes save

the changes yes that's okay and now we

need to be a bit careful it's now able

to run and infect our machine alright

so but let's take a look at it again

with the inspire now in this case that

was the fire yeah it's the old one but

doesn't matter you can already see if I

click on the entry point that this is

really a mess you don't want to analyze

this code right well if you if there's

no possibility 2d obfuscated that's one

you can can use this to make it run

above run it and then use mega number to

dump what's inside but in this case it's

not necessary we can do fiscale it with

no fuser but it doesn't work every time

so you might you might want you always

have to keep in mind several ways of

achieving what you want to achieve and

in this case I think it's

it's quite good to check this and then I

would just mean I'm attic clean clean

clean dump one yes please change it we

have it all here and we will open the

Queen's dump

the diablo skated one and that looks

much better already and now if you

analyze the code now you can see that

this is opening a zip file an archive

and this archive is loaded into memory

so we want what's inside this archive

and let's check the method that's using

it think it's this one so it's

well oh it's doing some stuff here

here okay this method gets the archive

from the resource stream so again it's

in the resources and that's where you

will find the archive you can just save

it from here

there are needs to debug this code now

just extract this

okay that's not important here can check

this nevertheless but no not important

but this one is its again cold servidor

Dixie I would say it's dump to dump -

yes and

all right

take a look at it

so the entry point is Jay a main

interesting and now it has some ugly

method name so that's that's really not

so nice if you do not want to hurt your

eyes with ugly method names use default

default has a list of several operators

it can DFS Cade successfully but even if

it doesn't know the upper scaler it will

at least rename the method name so just

try it if it looks ugly here's our clean

dump and now we may analyze this instead

so

okay yeah that's better

we

Wow and we are at the end that's the

actual megaphone and I just clicked you

know

I got into the method that was called

from the main and I usually then click

on the class to see the other method and

methods in the in that class mostly to

get an overview like and here we have

what's the most interest in pal usually

if you have a remote access trojan

that's the configuration file and

because there you can see what where

where it's connecting to which port and

and so on and read also saves the copies

the executable to you and into which

locations and here's a version number

that's the version number of NJ read and

reread is our mobile file if you upload

this to virustotal

you will probably get the mother names

blood I believe that's the name for NJ

read it's bad practice to use the name

that it that the author intended to have

so if they named it blood windy and also

other files that copied source code from

and I read might be detected by a blood

a bunny because detection might be based

on that source piece that they have

copied so nowadays we are bled a vinius

basically a detection name for lots of

Wow

remote access tools and

yeah again you might now want to check

the sauce what it can do there's some

keyboard logging right here you see

they'll get keep it stayed and so on

KL probably also stands for keyboard

logging there that's how it indicates

the certain keys in the lock file and

here are the keys oh yeah that's quite

interesting I will leave it to you to

analyze this and unpack it yourself

yeah many things to never hand a team

because they explain to me how to tackle

this with the net module basically how

to make the net module executable and I

yeah I'll and I learned something new

today and I love to share this with you

so thank you Mary hunter if you want

something here I will link my 100 teams

Twitter profile also in the description

below and thanks for watching see you

next time