Observing OneNote activity with Process Monitor and Process Hacker!

🔥 FREE DOWNLOADABLE PDF - MALICIOUS DOCS QUICK REFERENCE
[ Ссылка ]

Understanding process activity can provide valuable insights where looking for malicious activity or creating rules to block it. With the recent surge in OneNote based malware, the the trend has been to use a variety of embedded scrips or even PE files to gain initial access. In this video, we'll cover a lot of ground by investigating how OneNote documents lure users into executing the malicious code. We'll observe process activity using Process Monitor and Process Hacker. Then use onedump to fully unravel the attack chain. We'll also investigate some anti-analysis in a .NET dropper and decrypt our final payload, which leads to AsyncRat.

Cybersecurity, reverse engineering, malware analysis and ethical hacking content!
🎓 Courses on Pluralsight 👉🏻 [ Ссылка ]
🌶️ YouTube 👉🏻 Like, Comment & Subscribe!
🙏🏻 Support my work 👉🏻 [ Ссылка ]
🌎 Follow me 👉🏻 [ Ссылка ], [ Ссылка ]
⚙️ Tinker with me on Github 👉🏻 [ Ссылка ]

Sample SHA256: 17915f90eb7e41c7d6e27c1d01edb3b6affabdbc6d02afc0df55352c57b9c22d

00:00 Introduction
01:20 Monitoring Process Behavior
03:40 Launching OneNote
04:31 Process Tree in ProcMon
05:27 Attached Files in OneNote
07:49 Moving to Analysis with OneDump.py
08:40 Detect-It-Easy and Attached File
09:52 Analyzing the BAT File
11:34 Decoding the Next Stage
14:07 Analyzing the .NET Binary with dnSpyEx
15:37 Observing Anti-Analysis
20:10 Dumping the Final Stage - AsyncRAT
21:55 AsyncRAT

свернуть