Using PE-Sieve to Unpack and Analyze Packed Executables in Memory

Summary

A malware-analysis lesson demonstrates using PE-Sieve to dump a suspended packed process from memory, then explains alignment, import-table, and entry-point issues that remain when analyzing the unpacked code.

Key points

• PE-Sieve scans a selected process for memory modifications and can dump modules with realignment.
• The demonstration suspends a process after its behavior changes, such as making a request in FakeNet, to improve the chance that unpacked code is present in memory.
• The speaker verifies that the dumped executable contains previously hidden strings and examines its sections and code.
• A memory dump may retain packing artifacts, have an unresolved import table, and still point to the packer's entry point rather than the original entry point.
• The lesson presents memory dumping as a useful starting point, while noting that further work is needed to make the sample easier to analyze in IDA Pro.

People

Tools

Related Articles

• HVNC Backdoor Uses Fake Tax and DocuSign Lures to Target Latin American Organizationsany.runIDA Pro · YARA
• Modified UPX Packers Can Defeat Automated Unpacking Without Stopping ExecutionDr Josh Stroschein - The Cyber YetiFakeNet · hxd
• Bing SEO Poisoning Led to BumbleBee, AdaptixC2 and Akira Ransomware Intrusionsthedfirreport.comPE-sieve · YARA
• How Windows Malware Uses COM—and How Analysts Can Analyze Itblog.talosintelligence.comIDA Pro · YARA
• Amatera Stealer Adds Evasion Features and Expands Credential and Wallet Theftesentire.comIDA Pro · YARA