How do I extract or dump injected executable code/payload from malware using the x32dbg trick? My malware sample is injecting an Exe PE file in a legitimate File like "Explorer.exe". How do I dump the File?
1 Answer
First of all you can attach x32dbg to the process where PE was injected. Next you must trace the address of allocated memory where the malicious PE was written to. If you got that informations you can select bytes that PE consists of from Dump Window in x32dbg, then Right-Click and select "Dump to file" option.
In my opinion the whole process is even easier with Process Hacker tool, where you have to just spot the address where PE was written and then dump all pages to file.
-
-
This means if the malware injects into "Explorer.exe" then I have to do The Process hacker tool trick on Explorer.exe . Right? Jan 6 at 3:00
-
Find all calls of WinAPI function WriteProcessMemory, determine its arguments. Find the place in code where it is called. This can help you to find injector code, process name and the address.– strannyiJan 6 at 9:26
-
@DavidL.Wilson yes, exactly. Because this is the target where code will exist after injection and also after possible unpacking or decrypting routines. That space in "explorer.exe" can be found in "memory" tab of Process Hacker. Moreover it should be marked as "Private" type of memory and its protection flags should be "RX" or "RWX".– r4v1ckJan 6 at 9:59
-
@DavidL.Wilson As I said, you have to track down by yourself address of allocated memory space. You can do it by debugging injector. Specificaly you can put a breakpoint on all VirtualAllocEx, VirtualProtect, WriteProcessMemory (as it was stated by strannyi), CreateRemoteThread calls, etc. Take a look at all API functions that are used by malware to perform injections, then put BPs on them.– r4v1ckJan 6 at 12:35