Now come back.
We are now going to do reverse engineering of a DHL injection Trojan.
So go in, download this project, Congreve using DNA injection and zip it and put it in the mail for
the inside.
You will find few files.
The most important two files is the DNA injector and the DEA.
Alyssa.
So we have created this in the previous lessons where the deer injector is going to inject into a process
which is called Explorer, Explorer is always running on the Windows machine, and it is going to inject
Microsoft into the air.
Yeah.
And once this Microsoft pin is injected, it will launch Microsoft Bean.
Assuming we didn't know all of that and that we are now starting from scratch, assuming this is a that
we don't know what he's going to do.
So the first thing we do is to inspect the studio.
So we open the studio.
Then we drank.
Yeah, injected into it and let it analyze.
We take a look at it in pots.
And then looking a good column.
Under memory, you'll find you have virtual eggs, which allows you to allocate memory remotely in another
process, right, to process memory.
And then if you scroll down, you will see.
Create a remote track and open process.
So all of these for Epis hints that it is injection idea, process injection or injection malware.
So we need to put breakpoints in our debugger on those APIs.
So now we're opening our xixi for the DBG.
And then here and there, the options, preferences, only the entry point is checked.
Now we open our Trojan.
He will put a breakpoint on.
Open process.
Let's click on this.
He also put a great point on the right process memory.
And optionally create remote tray.
To really put my point is to tie BP, followed by open process and he to Yanyi, we see here I've done
this before.
So I'd say.
And do the same thing for the other two.
BP represents memory hit enter, BP created Moutray.
Now we can run it.
So he hits our first break point open process
and this movie.
Several rethinking.
And now open process is about execute and you do in the parameters window.
And compare it with the median documentation.
The one we're interested in is the tech barometer, which is a process.
It is trying to open.
In this case.
Nine nine zero.
So we use our calculator and convert hex nine nine zero into decimal.
And we get two for free.
We open process hacker and look for process to for free, and you find an 80s explorer.
So it is trying to inject itself into Explorer.
So an explorer is a target.
So now you open Explorer.
And go to the memory, that voice.
But we don't know which part of memory is going to inject.
So we will need to rely on the next break point, which is that process memory.
So click on run any hits, right?
Process memory.
Step over until he comes to this call here.
Now we are here.
We look at the documentation again.
Reprocessed memory has these parameters you're interested in a second parameter, which is the address
here is going to write to.
So this is the address of the target process.
In this case, it is an explorer.
So we go to this address, two nine one four zero.
And look for the location of that.
It should be writable so we can scroll down until you see RW.
Look, four two nine one, followed by four years.
Click on refresh.
And here you see two nine one, followed by four zeros.
If we double click on it, he received this current U.S.A..
So let's talk about this and see what happens.
Now we come back and click on re and we see now it has injected this string into this memory for the
Explorer process at this address to name one, followed by four zeros.
And this is seems to be a path to a deal.
So now we know he's trying to run this, Nihaal.
He's trying to look.
Yeah.
So we can confirm that if is trying to load these year by continuing to run until he hits the next API,
which is creating more traffic.
So let's do that now.
So now he created Moutray, and these are the parameters for creating more trade.
Over here, you can see.
Yeah, Foft, burM, you see the address you're interested in, and if turm is a parameter to that address.
So let's go there and see if far, Damita, you can increase the no visible timing, Tayseer.
So the fourth parameter is not library, which is used to the house.
And it's an easy barometer for tone library.
So from here you can see these two nine one followed by four zeros, which is exactly this.
Two nine one four four zero.
So this confirms that he was using a remote tree to look at the alpha using the library API.
So now that we know for sure is going to look this library.
You can go directly to the location of this library.
So you can see from here locations C, users, B.C. They're starting on that every single injection.
Hmm.
And so on.
That location, is this for.
So that's how we find out the location of the assuming.
We didn't know it was here.
So we go directly to this location.
We can now do this directly.
So we can stop this now.
And then now we can open and down the NBA farm.
So now we know that the Yale using the Luder.
Before we can decide what the point is set, we can personalize it the to you.
So you open the studio and we how would you have into the studio?
And then we click on the inputs and we see what he's trying to do.
And then the memory group he we see which are locked and which are pretty.
And then and the execution, you see.
Great trick.
So this suggests he is probably trying to execute a shackle so we can put breakpoints on which are low,
which is pointing and optionally create.
So now we have our hint on how to debug this.
You go back to our open yaml and start putting our big points refine, which will help hit, enter,
refine on which overprotect, hit, enter.
And now you can run.
And yes, hit with yellow.
If you want to see what they say, a dress alligator, we can.
Ran two years ago.
And you can look any written address here.
So you can follow this in dumb.
ABC now is you run again.
And now is populated the allocated regional memory shellcode.
So now is which a birthday?
And if you look at the barometer for which the first barometer is the address of where it is going to
alter the commission.
And you compared this week is the same location.
So currently this location, if likely, and following memory map, it is set in readable, writable.
But if the execution point by running, these are good and the men we met again.
It is now set to Executable and Gigaba.
So that means that he has finished and backing and he is going to SRK.
So at this point, we can dump this memory.
So we set all this up to hear.
He it up to here and then directly, and you can binary safe to a far.
And you can see it through the location of our project, which is replacing the injection.
And you can call it the dump.
The B and C.
Now we can close everything.
In the next video, I'm going to show you how to debunk these dumb you have been see in the next video.
Thank you for writing.