04 - Walking the PEB, Enhancing IDA's Output w/ Structures, and Unlocking the Key to Runtime-Linking

In part 04, we'll take a close look at how Lockbit, and many other malware families, locate and use the PEB to identify in-memory DLLs. This allows for the malware to find libraries and functions it needs during runtime, while also avoiding using the pre-declared import table. This makes it more challenging for basic analysis and reverse engineering, as we have to initially investigate how these functions are being resolved. You'll also begin to see some additional twists that Lockbit adds to this process by using seeds...

Join this channel to get access to perks:

Cybersecurity, reverse engineering, malware analysis and ethical hacking content!
🌶️ YouTube 👉🏻 Like, Comment & Subscribe!

0:16 Finding the PEB reference
2:35 Accessing PEB structure members
4:17 Viewing relevant structures in WinDbg
12:00 Adding structures in IDA

[trevor]

I keep getting access violations when debugging with LB3.exe. Once the binary is loaded and I press start, it runs into

(f40.1d94): Access violation - code (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled

PS: I have started windbg as admin