HackTool.Win64.EDRSandBlast.THEOBBD

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Este malware no tiene ninguna rutina de propagación.

Este malware no tiene ninguna rutina de puerta trasera.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Propagación

Este malware no tiene ninguna rutina de propagación.

Rutina de puerta trasera

Este malware no tiene ninguna rutina de puerta trasera.

Otros detalles

Hace lo siguiente:

• It monitors the activity of a process to detect EDR implementation and subsequently bypasses the detection mechanisms.
• It employs techniques utilized to bypass EDR detections both in user and kernel mode.
• It performs the following actions to bypass EDR detections:
  • Kernel Notify Routines Callbacks Removal → by exploiting vulnerable EDR drivers
  • Disable Object Callbacks → by either setting the Enabled flag in the callback structure, unlinking the Callbacklist of threads and process, or disabling object callbacks altogether
  • Bypass Minifilters' Callbacks → by unlinking the nodes from their lists, making them temporarily invisible from the filter manager loaded by the EDR using Windows Filter Manager
  • Disable ETW Microsoft-Windows-Threat-Intelligence Provider - by patching in kernel memory related to ETW TI
  • Bypass Userland Hooking → by using unhooking, custom or EDR's own trampoline, duplicate DLL, or direct syscall methods
  • Vulnerable Drivers Exploitation → by using vulnerable drivers to gain kernel read/write primitive
  • Detect EDR drivers and processes → detects if a driver or process belongs to an EDR product. If an EDR driver or process is unknown, it embeds the information to the tool
  • Bypass RunAsPPL → by elevating the protection level to dump the LSASS process memory
  • Bypass Credential Guard → by patching and enabling Wdigest to show cleartext credentials in LSASS memory
  • Offsets Retrieval → by utilizing hardcoded offsets instead of pattern searches to reliably perform kernel monitoring bypass operations
• It exploits vulnerabilities in the following known drivers:
  • RTCore64.sys → CVE-2019-16098
  • DBUtil_2_3.sys → CVE-2021-21551
  • gdrv.sys
• It checks for the presence of the following files:
  • {Malware Path}\gdrv.sys
  • {Malware Path}\RTCore64.sys
  • {Malware Path}\DBUtil_2_3.sys
  • {Malware Path}\NtoskrnlOffsets.csv → contains offsets used to perform Offsets Retrieval