Hello and welcome.
In this video, we are going to reverse engineer how that Project Drugeon segoline down this project
and zippi and put it in the mail, therefore, the first thing we do is open studio.
We want to analyze this now.
They call this source, Peter Yangzi.
So we resource people into peace to you.
Let's wait for it to finish the imports.
Click on inputs and you will see under the group column, the memory group days, which are along eex
and write process memory.
And if you scroll down further into the execution group, you will see open process.
Over here and also creating lecture.
So this for any case that it is processing Gesh intrusion.
So this and you can know then we need to put and break points on some of these four APIs.
So let's open 64 DBG.
We also know that from here.
It is a 64 bit c.p.u.
MENC says history forby program.
So now we open our Fajon.
Go to the Lucilla project, Fuda.
My option preferences, I suppose, on the entry point is checked.
Going on every point they come down and put breakpoint on open process.
He didn't.
And another big point on right.
Process memory.
He had to be confirmed and both already set and then go back to civility.
And right.
So he hits our first break point, which is open process.
And we step away.
And now it is ready to run.
And you look at the parameters for open.
So it take parameter is what we're interested in.
Open process, watch the tech barometer, which is the IED monitor is processing process A.
You can download these notes from resuscitation, so the tech barometer is finally seen, Hank, so
we converted into Kashima.
Fritzy convicted Asima.
We'll give you one three four zero.
So you open process hekker and look for one three four zero.
And you find the 80s explorer.
So now we know that he's targeting explorer process.
He is going to inject he Flora, who you can monitor explorer's memory.
By double clicking.
And we do know which part parrot memory is going to.
So we run again.
So he's right, process, memory.
And from the right precise memory, we can no.
That is going to inject race, he's going to inject by looking at a second parameter.
So the second parameter shows this address, two nine seven four zero.
So we come to two nine seven four zero, so we need to refresh here.
And it's close to nine seven four zero.
Two nine seven four zero.
Over here.
And they will click on it, you will see carrying these to has an irritant to this memory.
So we need to now continue to step over this car.
And then you can see what happens after we step of what is car.
Again, you can see.
Who are here?
We need to click on the button to refresh this regional memory.
Now we see it has been populated.
We have to sherkat.
And this shall appear to be in play next week, so you can see some strings here.
OK, so now you can dump this to a far click on Seph.
And then you can save it to.
You folding for project?
So you scroll down to a folder for reading, which is reversing.
Leveraging.
Saving a different name.
Now you can close this.
So we assess what he's done, the memory from the process after the Trojan has injected a shortcut into
it.
So this is how you can reverse engineer a Trojan.
It has got processing Deschene.
Thank you for watching.