>> In conclusion, why did we did we do this?
Why go into stack analysis mode
instead of just executing that in the VM?
We were able to understand them our a lot
better and relatively quickly too.
Didn't take us a few hours to get this done,
it took us a few minutes.
We were able to discover some indicators of compromise.
If someone was doing dynamic analysis
and another person was doing stack analysis,
they can both produce indicators of compromise.
But you'll notice, we doesn't really watch for any mutex
created or attempted to create,
when we were analyzing our malware dynamically.
But something we could
plant tool in our environment to do,
but it's not something I usually do.
We could confirm dynamic analysis
with a lot of our static analysis.
We could say, ''Oh yes, I saw it manipulating
the registry to open up or disable the firewall.
I saw that it had some code to create a service.
I saw anti-debugging code.''
If the dynamic person was trying to
execute any debugger and it failed,
you could say, ''Oh, I think I know why.''
You can go follow those functions and say,
''Okay, there's something I can do about that.
I can actually modify the malware to handle that."
In the future we can see that there's some plugins for
all the debug that
will defend against a lot of that anti-debugging code.
It would be anti-debugging code.
We also saw some tricks used by malware,
such as stack corruption to try to fool our disassembler.
We also saw import
hiding through dynamic function resolving.
It was trying to dynamically
resolve all the functions it needed,
from all the libraries it needed,
rather than list of minutes, import address table.
If we ever looked at the imports just by
themselves in the PE header with a PE Explorer,
we would only find a few function calls.
We wouldn't really know what it's trying to
do, such as mass,
width registry or access the Internet,
or access certain files.
We also saw those using some string obfuscation.
We didn't fully reverse
engineer how the strings were being obfuscated.
There's a little trick I'll show you in the next video
on the easy way to handle that.
Thanks for watching this video.