HackTool.Win64.EDRSandBlast.THEOBBD

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Diese Malware hat keine Verbreitungsroutine.

Diese Malware hat keine Backdoor-Routine.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Verbreitung

Diese Malware hat keine Verbreitungsroutine.

Backdoor-Routine

Diese Malware hat keine Backdoor-Routine.

Andere Details

Es macht Folgendes:

• It monitors the activity of a process to detect EDR implementation and subsequently bypasses the detection mechanisms.
• It employs techniques utilized to bypass EDR detections both in user and kernel mode.
• It performs the following actions to bypass EDR detections:
  • Kernel Notify Routines Callbacks Removal → by exploiting vulnerable EDR drivers
  • Disable Object Callbacks → by either setting the Enabled flag in the callback structure, unlinking the Callbacklist of threads and process, or disabling object callbacks altogether
  • Bypass Minifilters' Callbacks → by unlinking the nodes from their lists, making them temporarily invisible from the filter manager loaded by the EDR using Windows Filter Manager
  • Disable ETW Microsoft-Windows-Threat-Intelligence Provider - by patching in kernel memory related to ETW TI
  • Bypass Userland Hooking → by using unhooking, custom or EDR's own trampoline, duplicate DLL, or direct syscall methods
  • Vulnerable Drivers Exploitation → by using vulnerable drivers to gain kernel read/write primitive
  • Detect EDR drivers and processes → detects if a driver or process belongs to an EDR product. If an EDR driver or process is unknown, it embeds the information to the tool
  • Bypass RunAsPPL → by elevating the protection level to dump the LSASS process memory
  • Bypass Credential Guard → by patching and enabling Wdigest to show cleartext credentials in LSASS memory
  • Offsets Retrieval → by utilizing hardcoded offsets instead of pattern searches to reliably perform kernel monitoring bypass operations
• It exploits vulnerabilities in the following known drivers:
  • RTCore64.sys → CVE-2019-16098
  • DBUtil_2_3.sys → CVE-2021-21551
  • gdrv.sys
• It checks for the presence of the following files:
  • {Malware Path}\gdrv.sys
  • {Malware Path}\RTCore64.sys
  • {Malware Path}\DBUtil_2_3.sys
  • {Malware Path}\NtoskrnlOffsets.csv → contains offsets used to perform Offsets Retrieval