WEBVTT

00:00:00.640 --> 00:00:03.850
Here is an overview of the initialization process.

00:00:04.340 --> 00:00:05.010
First,

00:00:05.020 --> 00:00:09.760
the stager is executed, which will trigger an HTTP connection to the handler.

00:00:11.240 --> 00:00:13.830
The handler then reads a fresh copy of the payload,

00:00:13.840 --> 00:00:17.640
also known as metsrv.dll, and patches a small stub of

00:00:17.640 --> 00:00:19.960
shell code into its DOS header.

00:00:21.440 --> 00:00:26.560
It then sends the payload back to the stager in response to the HTTP request.

00:00:27.840 --> 00:00:28.560
Finally,

00:00:28.610 --> 00:00:34.370
the stager reads the response into memory and executes it. Since

00:00:34.370 --> 00:00:37.640
the DOS header now contains the shell code stub,

00:00:37.650 --> 00:00:41.130
which calls the Reflective DLL injection library, the

00:00:41.130 --> 00:00:44.280
payload is loaded reflectively. And finally,

00:00:44.330 --> 00:00:46.680
the DLL main function is called,

00:00:46.770 --> 00:00:52.160
which completes the initialization. At this point, a couple of extensions,

00:00:52.540 --> 00:00:58.890
such as stdapi, are also sent over by the handler and reflectively loaded

00:00:58.900 --> 00:01:00.960
to provide many of the standard commands.