Hello and welcome in this let practical.
I would like you to try to analyze this on your own first.
This can be downloaded from the resource section to let one dash dot net, dash Trojan, dungey the
password and zip it is cracking lessons dot com.
So please post the video and give it a try first and then watch the rest of this video after you have
tried to analyze it.
So I will try to analyze it first, using the dynamic analysis that is to execute it and analyze it
using process Hekker and process monitor as well as Wireshark.
And then after that only I will try to avoid the static analysis.
OK, I hope you are going to try.
After unzipping this file, you have a folder.
I'll put mine on a desktop and within the folder is a father Melva itself dot net grabbing.
The first thing we can do is to try to get the hash of this file and look it up in various total.
So to get ahead of this file, you can click on this.
And then take on Hashmat funds.
And over here, you could find this slightly copy modified, open up your browser and head over to Aristotle,
just click on Search and directly and paste the hash in this box and enter.
And I just thought I would give you the results.
Fifty nine hundred sixty nine search engines, various search engines has detected this fire and the
name of it is a Trojan.
Generally, you can see it is a kind of stela information.
Stela is a spyware.
So now we know.
So that is quite helpful.
Next thing you want to do is confirm that this is a Donnette executable.
So before we proceed further, let us make a copy of this and then Renesmee.
To something simpler, maybe we will call it executable as well, because we want to run it, you will
call it an extension and for the name itself, we can just call it malware.
Yes.
Don't have security yet, open the IEEE and scan to make sure it is net executable.
So look for your utilities folder in a flash folder and then.
No, for the IEEE detected easy prey on the tree dots and navigate to the location of the Net malware
SFR.
Which is seeing the desktop calling on you to open and let us Kanafani, it has detected as a dot net
framework executable and the compiler is built on it and it doesn't appear to be back.
But this is not reliable barbeques to be paid.
So now we confirm that it is done in a second stage of the analysis.
We will open it will be spy by this video.
I want to do the dynamic analysis us in the second part, the video we do the static analysis very we
open evidenced by.
To analyze it, we need to run it, but before we run it, let's fire a few programs.
Now, make sure that you have disable the Internet for this virtual machine, because we don't want
to accidentally cause it to reach out to the command and control server or worse still, to spread to
other computers on your network.
If it is who.
So disable your network and then over here will fire a few programs starting the process monitor.
So click on Process Monitor.
Yes.
And then over here you can filter.
So we are going to filter the name of this malware because otherwise it will show everything that is
running in the operating system.
So on future and then here in the first propagandise select processed name and here it is.
And here typing this name net malware, not XY.
And you click on and click apply immediately.
You see that think shows that because it is Futrelle filtering out only this.
At the moment, we do need for it to capture anything yet so we can temporary policy, so we click on
the pause button.
OK, so now the next thing is we want to run process Hekker to see whatever additional processes that
the malware might spawn.
So to launch process hacker going to meant to fly here and then the utilities look for process hacker
over here and click on.
Yes.
And what more do we need is Wireshark to capture the network traffic, so same thing in the same folder
as in flair and a net look for Russia and launch it.
But yes, Russia is now running and then look for local air connection and double click on it.
And then over here we are going to filter the HTP traffic.
So this timing HDB and hit enter.
So this is the track.
It is connecting to any to service, command and control service.
So now we have set up our tools ready to detonate the malware inside this virtual machine.
So we have got a process monitor to monitor the process, the malware process when it runs.
We have got the YHA to capture the traffic network traffic, if any.
And we also have a process hacker to see if our process in the process was born.
Any additional children processer when it is running in the next video.
We will continue to run the malware itself.
So I'll see you in the next one.