Remcos RAT Unpacked From VB6 With x64dbg Debugger

[@itxmustfa]

Thanks bro i am learning from your KZbin channel from previous 3,4 months and really i am learning fast with your sharing stuff and really love from #Pakistan

[@andreabassi5048]

I discovered your channel a couple of minutes ago and I'm already in love with your videos. Really, thanks for what you're doing. Greetings from Italy.

[@anthonyc7407]

Incredible job! I really really enjoy these videos, especially since I'm working through my REM studies. Keep 'em coming!!

[@tyaprak]

Great educational video as always. Greetings from Turkey.

[@0xf0x]

Great vid, I’ve been playing around with lokibot recently which also has the same type of packer. Your technique worked like a charm on it. Another technique in my back pocket for future analysis, keep up the great work.

[@OALABS]

Awesome to hear that!! Thanks!

[@feifeilooper8312]

Yes,I have unpacked GandCrab2.0 samples what I have learned from your videos,I will keep curious ,thanks😁

[@OALABS]

Nice!!

[@billtibbs5768]

Love the videos. Looking forward to the special project reveal!

[@Timanator]

Great video!

[@d74g0n]

When i was in college ooph like 1999 me thinks; linux still was manual mounting drives and Vb6 was 'the future'. I passed with honours; and ended up learning essentially nothing; it wasn't until youtube came around that I learned... well more than 3 years of programming and system analyst material in one night . Derek banas ftw. what a time to be alive. We invented a book that will not burn, now everything gets really exciting for it. Buckle up. After big data, comes big good data, which translates to big philosophy. Reverse doomsday afoot. Golden age at 'the end of the rainbow'. ;)

[@EvilSapphireR]

Great video as always. I wonder what your unpacking technique would be if both the DOS string is wiped from the PE file AND a lot of VirtualAlloc method is called. Would love some input (or better yet, a video 😁) on that! Please keep on doing what you're doing, so many people like me hugely appreciate it!

[@OALABS]

Hey so that's a great question, and we covered a bit of that in one of our older videos on unpacking GandCrab. Basically you look for other parts of the PE that aren't erased like the sections table and use that to guess where the sections should be... it's not as simple as it sounds but it def works if you are persistent.

[@DmytriE]

Hey. It's me again with another question. You mentioned that one way to identify where the MZ magic number maybe is based on the multiple rows of null bytes appearing above it. However, you don't mention how to determine where to stop deleting bytes. Every byte counts and will affect the final outcome of the executable. I'd love to see a short video about that or a quick-ish(?) comment about this as well. Keep up the amazing videos!

[@OALABS]

Hey that's a great question. So the short answer is we just guessed since we assumed that the file would start at the the beginning of a 16byte offset so we chose the first 16byte offset of the first line that wasn't all null bytes. This also happens to be the beginning of the line since we have the hex editor adjusted to display 16byte lines. Though this was just a guess it usually works but if we get it wrong we actually have another tell we can use. So we know that at 0x3c from the MZ is a DWORD that will point to the PE header offset (where the PE bytes are). We can use this information to add or remove bytes until this equation becomes true.

[@anonymousquoll9316]

At about 7:46 you mention that "[the string you're inspecting] is loaded at 400 something so it's probably our own PE file." How do you know that this is where the PE file is loaded? Doesn't ASLR generally force PEs to load at random addresses, or is ASLR not mandatory in this case?

[@OALABS]

Hey that's a great catch! So we always disable ASLR to just to make things easier when we are debugging. oalabs.openanalysis.net/2019/06/12/disable-aslr-for-easier-malware-debugging/ But you are definitely correct, if we hadn't disabled it we could not have guessed the address of the binary.

[@unk6822]

why dont the developers just replace the pe header with random bytes..

[@OALABS]

That's a great question! In many cases the malware developers will actually do that. This is why searching for the DOS string is just a trick that works some of the time. But it's worth trying because if it works you can save some time : )

[@unk6822]

@@OALABS Oh okay, I just find it funny that these developers forget about that kind of stuff. But yes its definetly worth

[@abandonedmuse]

Can you do a video on catching fileless malware? No one has tutorials on this and I have a ton of files that have zero bytes but appear with code.

[@OALABS]

I'm not sure exactly what you mean by zero bytes but have code? Are there any hashes you could share? Do you mean the code is stored in an alternate data stream (ADS)? Usually the term "fileless malware" is used to refer to malware that stores itself in the registry (poweliks, kovter, etc) and uses in-memory injection. So nothing touches the disk as a file. I'm not sure if that's the same thing as what you are describing? Let me know and we can definitely do a video on it!

[@abandonedmuse]

OALabs I may not be referring to the correct name then. They appear as having zero bytes. So they are stored on a server and sync up on the computer. Last night for example I was trying to put two files into VT and they were coming up as zero bytes so I couldn’t upload them. They are PE files, and may be hosted on an ASP. NET site. I’m using your videos to teach me how to reverse engineer but a lot of these I cannot even open. I do go into control panel and change mobsync settings (mind you I don’t even allow my mobile to sync with this but I cannot turn it off) to “allow all offline” and that helps with some files. Also what is ADS? This sounds interesting and yes I have tons of hashes. Unfortunately I cannot send you these files because technically they don’t exist on my machine. They are like ghosts but I do have the hashes of the ones with information inside. Here for example is a Virtual Shadow disk I found in my disk manager. “PersistentUserDisk.vhdx” www.joesandbox.com/analysis/212055/0/html I have a ton of hashes on VT under the name @secresearcher www.virustotal.com/bg/user/SECResearcher/ Some of the crazy files: www.virustotal.com/graph/SECResearcher/ Example of null byte files I’m talking about check out the comments section: www.virustotal.com/gui/file/e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855/behavior/VirusTotal%20Box%20of%20Apples A file OPSWAT caught last night: metadefender.opswat.com/results#!/file/bzE5MDMxM0gxT2JLQXFMdlZTMTVkR05pZHVI/regular/sandbox/5e6479be561bbf69fb66d29d

[@OALABS]

Ok interesting, I'm still not clear on how you know these are executable files if they have zero bytes and they are hosted on a remote server? Wouldn't that just mean they are empty files? If I misunderstood and these file are local you could try checking if they have an alternate data stream. You can use a tool like docs.microsoft.com/en-us/sysinternals/downloads/streams to check the files. But if they are hosted on a server (not your host) then this won't be the case. The one file you mention (vhdx) is not an executable file, it's a container used to mimic a virtual disk docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/hh831446(v%3Dws.11). There are multiple reasons you might see these temporary files, but none that I know to be malicious?

[@abandonedmuse]

OALabs so I wouldn’t believe them to be malicious either except they take my admin rights, nor do I host a server, nor am I part of an enterprise etc etc. it just makes no sense. As for them being executables I’m pretty sure I just explained that incorrectly. They are files within the system that are unknown or are not supposed to be there. I’m not sure how much you read of the JoeSandbox file but it’s actually containing a file called DEMUL.EXE which is apparently a SegaDreamcast ROM? Like WTF? i never even put that in there. You have to understand this is a reformatted computer. Like I recently reformatted and have not even put any files inside. I’m not sure I understand it very well either but I’m trying to figure it all out. From what I can tell it replaces some of my other legitimate windows files with customized versions also. They are actual windows files but they have some bizarre stuff in them. What that is? Well that’s what I am trying to learn from you so I make sense to people like you who are more advanced. I love malware reverse engineering but I am at the very beginning of my studies and I only started researching because of this insanity on my computer. It’s what I want to do for the rest of my life though. It’s like a microbiologist working at a biological weapons lab but on computers. Just as interesting and a lot less mess lol

[@abandonedmuse]

OALabs heads up tried to run streams and it won’t let me. Sigh. I’m at my wits end with this. It’s a $1200 Dell laptop that’s a year old. I can’t even run virtual box to work on my pentesting or reverse engineering. It’s super frustrating.

[@chaitanyaghorpade830]

Why does this trick doesn't work for GuLoader ?

[@OALABS]

GuLoader is very unique ... first, it doesn't actually use the VB code to do an of the work, it just used it to redirect execution to embedded shell-code. Once in the shellcode there is another loader stage that is decrypted prior to the payload launching. It also had multiple anti-VM and anti-debugger features. I recommend checking out this excellent write up www.crowdstrike.com/blog/guloader-malware-analysis/

[@chaitanyaghorpade830]

@@OALABS I was looking into sample 01a99da3e8056311a350ff3d19b6257f6cd4ee36 This has different anti debug or anti vm tricks. We can execute sample on mentioned blog but sample I am looking into it is not getting executed. I tried various sandbox. Technique is mentioned here www.joesecurity.org/blog/3535317197858305930 Could you please check it and explain it in short video whenever you get time.

[@igornoto]

Hi i have disabled ASLR with regkey, but when i try to dump the payload, basically the extracted bin is different from the dumped one.... is possible that is ASLR? Because i followed exactly step by step, and i found the payload with header, but when i go to memory map e try to save as bin, it extract a different file....

[@igornoto]

The address in references is 1001604E, when i extract the bin, it extract the 10010000 address in memory map, but is different from the dump of the references.....

[@igornoto]

it seems that the payload is no written in memory....

[@igornoto]

Sorry dumped correctly! Amazing video fantastic you are awesome!