Trojan.Win64.EDRKILLSHIFT.YXEHUT

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Este malware infiltra el/los siguiente(s) archivo(s)/componente(s):

• %User Temp%\{10 Random Numbers}.sys → legitimate vulnerable driver detected as PUA.Win64.Rentdrv.THKOIBC

(Nota: %User Temp% es la carpeta Temp del usuario activo, que en el caso de Windows 2000(32-bit), XP y Server 2003(32-bit) suele estar en C:\Documents and Settings\{nombre de usuario}\Local Settings\Temp y en el case de Windows Vista, 7, 8, 8.1, 2008(64-bit), 2012(64-bit) y 10(64-bit) en C:\Users\{nombre de usuario}\AppData\Local\Temp).

Agrega las siguientes exclusiones mutuas para garantizar que solo se ejecuta una de sus copias en todo momento:

• DriverInstallMutex

Robo de información

Acepta los siguientes parámetros:

• -pass → used to provide the pass key needed to correctly decrypt {Malware File Path}\Data.bin

Otros detalles

Hace lo siguiente:

• It requires to be executed with the correct 64-character pass key.
• It requires the existence of the following file in the same directory as the malware to proceed with its behavior:
  • Data.bin → encrypted shellcode
• It checks for the existence of the following service:
  • Service Name: Kill{10 Random Numbers}
• If the service above is not found, it is then created with the following details and started subsequently:
  • Name: Kill{10 Random Numbers}
  • Binary Path: %User Temp%{10 Random Numbers}.sys
• It terminates the following EDR-related processes through a technique called Bring Your Own Vulnerable Driver:
  • AmSvc.exe
  • aswidsagent.exe
  • avastsvc.exe
  • avastui.exe
  • avgnt.exe
  • avguard.exe
  • avpui.exe
  • bdagent.exe
  • bdntwrk.exe
  • bdredline.exe
  • ccSvcHst.exe
  • CETASvc.exe
  • CNTAoSMgr.exe
  • coreFrameworkHost.exe
  • coreServiceShell.exe
  • CrAmTray.exe
  • CrsSvc.exe
  • CybereasonAV.exe
  • CylanceSvc.exe
  • cyserver.exe
  • CyveraService.exe
  • CyvrFsFlt.exe
  • ds_monitor.exe
  • dsa-connect.exe
  • edpa.exe
  • egui.exe
  • EIConnector.exe
  • ekrn.exe
  • elastic-agent.exe
  • elastic-endpoint.exe
  • EndpointBasecamp.exe
  • EPConsole.exe
  • EPSecurityService.exe
  • EPUpdateService.exe
  • ExecutionPreventionSvc.exe
  • filebeat.exe
  • fortiedr.exe
  • hurukai.exe
  • klwtblfs.exe
  • LogProcessorService.exe
  • macmnsvc.exe
  • masvc.exe
  • mbamservice.exe
  • mbamtray.exe
  • mcshield.exe
  • mfeann.exe
  • mfemms.exe
  • msascuil.exe
  • MsMpEng.exe
  • msseces.exe
  • MsSense.exe
  • nortonsecurity.exe
  • Notifier.exe
  • nsservice.exe
  • Ntrtscan.exe
  • pavfnsvr.exe
  • pavsrv.exe
  • PccNTMon.exe
  • psanhost.exe
  • PtSessionAgent.exe
  • PtSvcHost.exe
  • PtWatchDog.exe
  • QualysAgent.exe
  • RepMgr.exe
  • RepUtils.exe
  • RepUx.exe
  • RepWAV.exe
  • RepWSC.exe
  • rtvscan.exe
  • savservice.exe
  • SecurityHealthService.exe
  • SenseCncProxy.exe
  • SenseIR.exe
  • SenseNdr.exe
  • SenseSampleUploader.exe
  • SentinelAgent.exe
  • SentinelAgentWorker.exe
  • SentinelBrowserNativeHost.exe
  • SentinelHelperService.exe
  • SentinelServiceHost.exe
  • SentinelStaticEngine.exe
  • SentinelStaticEngineScanner.exe
  • shstat.exe
  • sophosav.exe
  • SophosClean.exe
  • SophosHealth.exe
  • sophossps.exe
  • sophosui.exe
  • TaniumClient.exe
  • TaniumCX.exe
  • TaniumDetectEngine.exe
  • tm_netagent.exe
  • TMBMSRV.exe
  • TmCCSF.exe
  • TmListen.exe
  • tmntsrv.exe
  • tmproxy.exe
  • TmWSCSvc.exe
  • Traps.exe
  • uiSeAgnt.exe
  • uiUpdateTray.exe
  • uiWinMgr.exe
  • updatesrv.exe
  • vsserv.exe
  • windefend.exe
  • winlogbeat.exe
  • WRCoreService.x64.exe
  • WRSA.exe
  • WRSkyClient.x64.exe
  • WSCommunicator.exe
  • xagt.exe
• It displays its logs on a console: