Welcome back.
In a previous video before they set up the tools they are going to use before we run them away in this
dynamic analysis.
So in this video, we are going to continue.
So not here now.
We are ready to run.
So we return on the capture now, which Fostoria and then if you want, we can also go to the tombs
here and look at the process, see where we can look at the details of the processes which are running
in this operating system, this virtual machine.
Know that under the command column, we can also see the command line that started the process itself,
as well as any parameters to any.
All right.
So the end closes for now.
And now we are going to detonate our malware.
So go back to the folder Vietnamese file and click on the malware with the extension.
And immediately starts executing, as you can see.
And if you look here, he doesn't show that he has created any any processes as well.
And if you look at the way I it also doesn't seem to be trying to communicate out anyway, so that is
not taking a look at process monitor and see what is happening.
Yes.
And this is a long list.
Scroll down to see what is currently doing so you can scroll all the way to the bottom to see what it
is currently doing.
So now here you see it is trying to read your meals.
Meals, tasty scraps.
What you might see this thing popping up saying the application was unable to start correctly, asking
you to close.
Do not close it.
Just using our continuing analysis.
You you will see this also looking for this study.
And then you keep scrolling upwards to look for more interesting things.
And here is some new statistics, probably trying to steal some immune information.
And here is also some evidence of looking for messages or messaging services as well as email identities.
Look, profiles.
User named Isabelle.
It's always accounts fishing for accounts.
Computer names and you see tons, but here is Neil Klein, Wazira Klein.
OK.
You do not discover much because probably the email email quit.
So anyway, if you never had an agreement, we could probably have discovered much more information
about what it is trying to steal, for example, the Firefox and Croom's passwords, as well as other
passwords.
So anyway, let us try to look at the strings now to look for the strings in memory.
We can go over to the process hacker and double click on the process, a hangover to the memory tech
and click on the strings button and click OK.
So here are looking for any kind of hasty dip, so just cool down and see if we can find any and we
found quite a lot of things here.
Serabee Pottery.
I met password GDP, SMTP password too.
So this could be what he's trying to steal and even looking for this Gmail and Yahoo!
Account passwords, login name and password for Google.
And here is evidence that is using Picolo and encryption IP, and this is used by Firefox to encrypt
the passwords.
So it appears he may be stealing that Firefox passwords and ESKIL three as well, probably trying to
access the decrypted passwords for the Chrome chrome passwords.
That's also Tandberg, which is the Mozilla mule train.
So this might be education is trying to steal the Mille Collines password email password.
OK, let's try to filter for hash GDP to see if we can find any command and control servers.
So just typing HTP and click OK.
And it seems nothing he up and that because the program could be for sure, he could include any HDB
service here, and you see this reference to an insult.
This could be this could be a decryption software suggesting that there might be an embedded EIC inside
this malware.
So now we have a good overview of what it is trying to do.
Vickery's to steal email and browser passwords.
So this is the next step.
We are going to look at the static analysis.
So thank you for watching.
I'll see you in the next one.