Hello and welcome back.
In your previous lesson, we have put a heart break point at the location where the malware is about
to unpack his secondary payload.
And we we know that after unpacking is going to execute because you had set is permission to be executable.
So now we are going to run out of every point.
And he has hit out of every point and he has populated this region of memory, we the back from authority,
so now he's going to execute, but we're not going to execute are going to use another tool to browse
this region in memory and dump the content so we can use to process hacker to do that.
So let's go back to our fler here, open the utilities folder and look for process hacker.
So think I here hear this fighter.
And then here we are going to look for how a Malvasia memory and scroll down and you see somebody is
the one, right, who just have a click on somebody and then go to the Ameritech and expand the window.
And now we are going to look for the address that set the halfway point zero zero C. So just scroll
down and look for zero zero C.
And then here we see to see four to five zeros, this is the address to send you entry point and the
commission is free to execute.
And if you double click on this, we can see that there has been a code that has been unpacked to memory
and you can compare these same.
See, this here and here is the same.
All right, all right, so now we can do this by clicking the safe button here, so the inside process
hacker and we are now going to dump this memory in a separate file to decrease safe.
And then we can save the desktop in the same fold, similar way and give it a different name.
So we are going to call these unpack some pull and then when you say safe.
So that's how we and by the code and this session here is actually
this all these things.
So the way we finish unpacking by letting it run and dumping it from process.
So that's how we do it.
And once again, fact is, you can go ahead and analyze the new one and then you can file and take a
sample with Ghidorah and go ahead and do whatever analysis you need.
So he's got an advanced copy, but I won't go into that because this thing is quite complicated.
So it just enough for me to show you how we can use the disassembly Ghidorah to look for the correct
place to analyze and how we can then use what we find in Keija in site debugger to put the correct break
points in there from the break point to the set.
And we can use process hacker to dump the accession of the code from memory into a file for further
analysis.
So you don't have end this section here.
And thank you for watching.