Hello and welcome to a new session in this session, we are going to reverse engineer process injection.
So go and download this project called Reversing Process Injection on the Zippi and put it in the mail
order.
The first thing we need to know whether or not the malware has got process injection capability to do
that, we will need to use the studio so open peace to do and then your malware to be used to you.
And then he used to do do the scanning.
If you are interested in it, but after he has finished Kennie, click on the imports and then look
at the group column and study the type of imports he is using.
We are looking for the imports because the imports will tell us what the malware is capable of.
So for a process injection capable malware, you will see which aola eex right.
Process memory.
Create a remote and open process.
So if you look in the memory section, you will see virtual yex here and right process memory here.
And then if you scroll down to the execution section, the groups, you will see remote and open process
here.
So these are clear signs that this malware is capable of process injection.
So this is how we can detect what the malware is capable of doing.
And this also gives us a hint on how to reverse engineer this particular malware.
So since we know that this is processing Jahshan malware, guess by looking at the inputs, we can put
breakpoints on some or all of these APIs.
Especially open process.
Right, process, memory.
And creating more charm and optionally virtual along ice.
So let us do that now.
We can close our piece to do now, even though we do not know what target this process is looking for.
We can still find out.
So let's run the FCC for native.
Command from.
And that is fire, Miss Spin.
Because this particular malware will be looking for Microsoft Paint.
So we need to start Macassar Beinfest.
Although in an unknown malware, we do not know this.
But for a Singhalese demonstration, they want to will fire Microsoft Paint and leave it running and
assume that we do not know that it is actually looking for Microsoft Bing.
So we can minimize this.
Now we can fire our Xti Biji 64 Hussien.
Click on the options preferences and make sure that only entry point is checked.
Click on Safe.
Now open the Nullarbor.
So now we can put our break points.
So these are the break points we can put.
Which analogy, which is optional?
Open process, which you should put.
And represents memory, which you also should put.
Great remorse transfer if you wanted to.
So the first one is open process.
So we come down to the bottom and put a breakpoint on open process, hit enter, click on your breakpoint
stack to ensure it is day.
And the second point is on right process memory.
So BP.
Right.
Process, memory.
This, too, should be sufficient.
If you wanted to, you can go further and put a breakpoint on create remote trek.
Now we can run, so he hits our open process break breakpoint.
Now he's going to jump.
So he step movie.
And now he's going to jump jumped open process rechannel Sabawi.
And now it is really to run and you come to the barometers window here to see what are the parameters
for open process.
So from here you can see the open process has got three parameters.
And the one we are interested in is the third parameter, which is a process, Aidy.
It is looking for.
So let's look at it, that parameter.
This is the process, Heidi.
It is trying to open.
So we can convert these hacks into decimal 94.
Use the calculator and key nine E for.
And you get the process in two, five, three, two.
So now we can open our process hekker and look for process ID two, five, three, two.
So this is a process heko now.
And scroll down in this column and look for process two, five, three, two.
And we see it is Microsoft pin.
So this is how you can know what process a particular malware is trying to inject to.
So now that we know it is Microsoft pain.
We can keep a lookout on the memory of Microsoft binge.
So if you opened Microsoft Bing now and look into memory, we do not know which part, which regional
memory the malware is going to inject his coat to.
So to find out which region of memory, we have to rely on the other breakpoint.
Right.
Process memory.
So we continue to execute.
Now he hits our breakpoint, right process memory.
We step away until we come to this call and then now we look at the parameters of window here, right
process memory, right process memory.
He's got these five parameters.
And the one we're interested in is the second parameter.
This is the address where the Melva is going to inject it shellcode into.
So we look at a second parameter here, which is this address.
Two three, followed by five zeros.
Not that we know we can go back to process Hekker and Noufal to three, followed by five zeros.
Just scroll down until you find it.
If you do sit here, remember to click refresh.
After taking refresh and scrolling through, you should easily find it to three, followed by five zeros.
Now, if you double click on this, you will see that it is still empty because it has not yet written.
He has not yet copied the chocolate.
So if you step in with this, you can see that he will copy.
So we start with this.
And now if you come back, you see this.
We need to refresh this very clearly.
And now we see the shellcode has been copied over.
So now we are ready to dump this sherkat from the memory of Microsoft Paint.
And you can click on Safe.
And then we are going to dump me here.
He accepted the default name.
Clean and safe.
Did you find them has got the memory from where it was dumped from.
So just clean and safe.
So if we want to confirm that you've gotten the correct one, we can go and open the -- file.
You can open this -- file if Hicks fxd hex editor.
Just drag it into Hayasaki has Ed.
So this is a down far as you can see is to see.
Now, if you wanted to be 100 percent sure, you can always compare with our original if our original
show, Cahier.
But from this, you can see already a string and in Boston for the messagebox by, if you compare it
with Jaggi in, you can see we are correct.
So this is a show called F.S. for it one.
FC four eight one Ending the shellcode and not Terminator and shellcode and now Terminator.
So this is how we can reverse engineer malware.
We has got processing injection capability.
Thank you for watching.
I'll see you in the next one.