Unpacking Emotet malware part 02

muha2xmad.github.io/unpacking/emotet-part-2/

January 7, 2022

1/17

Muhammad Hasan Ali

Malware Analysis learner

5 minute read

As-salamu Alaykum

Part 01 summary

Download the sample: Here

found  VirtualAlloc  call in  sub_417D50

we search for abnormal jumps. we found

Introduction

we will debug our sample with x32dbg tool to unpack the Emotet malware

Notes to be taken

What is Packing: A trick which is Used to avoid A

What is a packer: A tool that compresses, encrypts, and/or modifies a malicious file
format. 1

Why using packers: To avoid A
researchers to analyze the code

We need to find the the original entry point (OEP). What is the OEP: is the address of
the malware’s first instruction (where malicious code begins) before it was packed. 2

How to find the OEP: find the 
exists in the tail of stub code , it points to address of unpack file. 3

How to the unpack happen? 3 As we see in the figure (1). OS create stub code with packed
file

What is stub code? 3 Stub code is responsible for unpacking packed sections, when
you are running the file ,the address of unpack file exists in the stub code to unpack
file. So at the end of the stub code we will see an unconditional jump (tail jump), that is
meant after execute the stub code will jump to the address of unpacking file.

and its address.

jmp ecx

V detection and analysis to make it harder for

tail jump

and its address.

V detection and analysis.

. the tail jump It’s an unconditional jump

2/17

Figure(1):

What is stack string? answer

We need to know what is  VirtualAlloc ? Here

Says that “Reserves, commits, or changes the state of a region of pages in the virtual
address space of the calling process. Memory allocated by this function is automatically
initialized to zero.”

Syntax

LPVOID VirtualAlloc( 
 [in, optional] LPVOID lpAddress, 
 [in]           SIZE_T dwSize, 
 [in]           DWORD  flAllocationType, 
 [in]           DWORD  flProtect 
);

The most important parameter of this function is  lpaddress
offset of the newly allocated memory. where we will extract the malware then dump it.

Start Debugging

Open our sample by x32dbg and hit the entry point

, which returns the starting

3/17

Figure(2):

We set a breakpoint over the jump instruction 
pressing  f2 . because after this jump the unpack process will happen.

Figure(3):

Then we press

jmp ecx  at the address  00417F1F  by

f9  to hit the breakpoint.

4/17

Figure(4):

Then press  f7  we jump to another function. If we analyze this function we will notice that:

epilogue

Figure(5):

Abnormal prologue

Figure(6):

The last figure shows the abnormal prologue (1). And (2) is a suspecious instruction which
we will know late that is new

So we set a breakpoint over this instruction 
and press  f9  to hit the breakpoint.

VirtualAlloc .

mov edx,dword ptr ds:[41C1B4]  by  f2

5/17

Figure(7):

Now if we  follow in dump

Then Press 
ds:[41C1B4]

Then Press 
was called from.

Here it return to this address 
section.

f8  it will  push edx
.

f8 . There is abnormal

We see that it’s allocating memory.

002302F0

Figure(9):

So step over it.

In the next part we will see functions (Unpacking routine) and we will explain it on the fly in
the next figure

to the stack which is the value of  mov edx,dword ptr

ret . Normal  ret  value will get back to wherever it

. Which will be the address of the unpacking

6/17

Figure(10):

Keep stepping over untill you reach the breakpoint.

Then we see this funtion and step into

Figure(11):

It uses stack strings. which is mentioned above In introduction. 
stack.

f7 .

(1) pushes them on the

7/17

Figure(12):

To get out from this function find

And these functions do the same as above. So step over them 
function without executing it: Double click over a function and press

Figure(13):

Untill we get to this last function. step into

ret  and set a breakpoint then press

f7 .

f9

f8 . to see what inside a
-  button to get out.

8/17

Figure(14):

After we get into the function we need to analyze it

Figure(14):

As we can see

push 40  RWX

Figure(15):

One step over

call edx

which is our indicator to know that this call could be

carefully

is calling  VirtualAlloc :

VirtuallAlloc

f8  and we will get the adress of newly memory allocated in  eax

9/17

Figure(16):

Then keep stepping over and get to this function 
over. As we see in the dump section, the function writes over the newly memory allocate with
the exe file.

Figure(17):

When keep stepping we see that it’s copying files to the exe file

.text

call 22FBC0  and then one more step

10/17

Figure(18):

then  .rdata  then  .data  then  .reloc

Untill we get to the last  ret 8  as shown.

Figure(19):

Stay awake our file is almost finished. After the second  ret .

Figure(20):

11/17

Now we can dump the unpacked exe. 
Mwmory map

Sorry for this Mistake in the next figure. It’s

Figure(21):

Then  right click  and then press

right click

Follow in Mwmory map

Dump memory to File

over  eax  and press  Follow in

12/17

Figure(22):

Now if we tried to open it in IDA. We will notice that’s can’t be analyzed

13/17

Figure(23):

So we need to repair section headers using

Before

PE bear  tool.

14/17

Figure(24):

After editing

Figure(25):

Then change the image base: if it’s different value of the OEP.

15/17

Figure(26):

Unmap the unpacked file

How we edit the section headers? ordered steps.

first: copy  Virtuall address  values into

second:  Raw size  Raw size of  .test

E000  -  1000  =  D000

Raw size of  .rdata  = Raw adress of

F000  -  E000  =  1000

Raw size of  .data  = Raw adress of

13000  -  F000  =  4000

Raw size of  .reloc  = still the same third: copy 
values.

After changing save the file. This is our unpacked malware

Raw address  values.

= Raw adress of  .rdata

.data  - Raw adress of

.reloc  - Raw adress of

Raw size  values into

- Raw adress of  .text

.rdata

.data

Virtual size

16/17

See you in the next article. inshAllah

Article quote

اﻷﺧﺮى ﻟﻦ ﻧﺨﺸﻰ اﻟﻐﺮقﻋﻠﻰ اﻟﻀﻔﺔِ

Refernces

1- https://www.mcafee.com/blogs/enterprise/malware-packers-use-tricks-avoid-analysis-
detection/

2-https://www.oreilly.com/library/view/learning-malware-analysis/9781788392501/12556df2-
7825-4e43-8811-c0fabeab78d8.xhtml

3- https://www.0xbyte.com/unpacking-mzp-ransomware-manually/

4-
https://isc.sans.edu/forums/diary/Stackstrings+type+2/26192/#:~:text=This%20is%20a%20te
chnique%20that,the%20allocated%20chunk%20of%20memory

5- https://msdn.microsoft.com/en-us/library/windows/desktop/aa366887(v=vs.85).aspx

17/17