I come back in this year, we are going to analyze the dumb file with the studio and Ghidorah, so let's
start off with a piece to you.
Opening up peace to you.
And he into it to like peace to you, analyzed and dumped file a piece to you is now analyzing.
And next, like.
It looks like we got the wrong wrong dump file, so we need to repeat a process of dumping.
This is not the right people since there is no libraries handling ports.
And when you look at St..
There is nothing much there.
OK, so we have to repeat it, so I'm going to try again, hopefully, if I can dig sometimes as a matter
of trial and error.
So he's quite OK.
So you open the program again.
And then we put a break point
on which I love.
Granted to the first three point.
Over.
OK, so now this is the first one we can follow in.
All right, now are getting a different address to two, followed by four zeros so we can put a note.
Zero zero two two, followed by four zeros, one, two, three, four, right, click, follow him and
remit.
He's Viterbo and right now we run again.
And he has populated his memory with some and back a cigar, which I don't think in time.
So let's step over.
OK, let's run the ritual now, and yes, they located some of them, we're likely following them.
Number two is the one right now.
We're going to examine a memory for I click and fallowing memory.
And you see this one is executable.
We are going to be OK.
So we are going to copy this address.
Right.
Click copy value and put it here.
We have two addresses here.
Now you run and you see it's populated.
The second one with this images and back.
So now you opening the process hacker, the open process hacker entirely done.
By this time you're in a different location process hacker.
Go to our and some may go to memory and according to our notes, maybe reading that you started dumping
a two two two two two four four zero, which is here along with something else.
So now we're going to dump everything starting from here correctly.
And we are going to see and we are going to write a play on it.
So now we are going to open it with these to you.
So you go to utilities holder and fire these to you and now you analyze the -- file he has to do.
And see if you get any libraries.
All right.
Probably not, because he doesn't have a behavior ID, so of course he's now and then analyze it if
her house to house.
Ed, are we using zero one zero zero zero one zero, Ed?
OK, there is no behavior location so we can search for beheader, the magic by the magic base for the
fire services or for the fire?
For the fire, for if I hex for the.
And you found the heat here.
There is only here.
So this is the location we have.
Apiata is another one here and there.
Hado here.
So you see there are quite a few.
So we take a long time to go through all of them to see which is occurring one.
So to save some time, I cut short this tell you that the second one is a correct one.
But if you are going to try to go through every one Chehade and then opening piece to you.
So in order to open bearding to you, we had to leave it all there.
One which is the wrong one.
So we select wrong by and delete it.
So now you're going to say this and then no, what is saved, we can put this piece to you to reanalyze
it.
So we go to
utilities saying open bees to do so is actually a trial and error sometimes takes a lot of work.
Even a dumb farm is necessary, contained, correct and backward, so it's is a matter of trial and
error.
If you find a few haters, you need to try each one.
And then like I have, I'm doing here until you get there.
Right.
So the right one is now the second one.
And we are trying to analyze it now.
So the new Dumphy is here to see if we can get Apiata this time.
OK, everybody here, see if you can get any libraries, if you can get libraries and in past is we
are correct, only strengthen the correct and backcourt to give you some time to finish his analysis
in his finished analysis.
And this time, I think we are correct.
You can see there are so many libraries and so many API books that means here correctly and the far
exceeded so many.
And then if you go these things.
As he was trying to get.
All right, you can see there is some kind of a 64 and 64, 64 including.
Kids who run for anything else is still being obfuscated.
You have things you find going in some registry key here.
So this is correct, much more information than the previous one.
So this is the kind of persistence here.
Scroll down and see if I actually had.
And we have HTP and you are in, so there could be
somebody who is trying to connect to so it is a good sign or indicate a compromise and here will be
some kind of message to show the user may be there.
And so, yes, it looks like it is holiday this for the.
There you go.
So many variables.
You can see some ransom, probably rain in some areas here.
OK, so it is a positive sign of any kind of compromise.
So it looks like you've done the correct and back court.
So the next video, we'll start to show you how to open it.
Engager if you wanted to use Keija to analyze this.
So thank you for watching.
I'll see you in the next on.