Intercepting HTTP Traffic With The Debugger
Added 2024-09-26 00:44:39 +0000 UTCIn this tutorial we demonstrate how to use x64dbg to intercept network traffic in a target process. We are using Lumma Stealer as an example but the approach is roughly the same for all malware.
References
Sample
5aead2773474aa64c7e5300d49eca7ee01174fe806fd73f4a878ae4b2a4aaca1 [UnpacMe]
Lumma Stealer Analysis
Comments
It is not possible to decrypt the traffic if you are only capturing it, but with some modifications on the VM you can make it possible. The two approaches are to either dump the TLS master secret from the process (this is a good overview https://github.com/cuckoosandbox/cuckoo/issues/2103) or you need to install your own certificate in the store on the host and man-in-the-middle the traffic. Any MITM proxy will have instructions for this, for example https://github.com/mitmproxy
OALABS
2024-10-04 18:31:35 +0000 UTCUsing this technique, it appears we would see the TLS traffic in an unencrypted state which id very handy. If I was only capturing traffic with a network based capture, I would need some additional steps to see the same traffic in an unencrypted state. Awesome walk through, thanks!!
cyberw01f
2024-10-04 14:43:22 +0000 UTC
