HackTool.Win64.EDRSandBlast.THEOBBD

 Analysis by: Neljorn Nathaniel Aguas

 ALIASES:

Trojan:Win32/Seheq!rfn (MICROSOFT)

 PLATFORM:

Windows

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:
 INFORMATION EXPOSURE:

  • Threat Type: Hacking Tool

  • Destructiveness: No

  • Encrypted: No

  • In the wild: Yes

  OVERVIEW

Infection Channel:

Downloaded from the Internet, Dropped by other malware

This Hacking Tool arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It does not have any backdoor routine.

  TECHNICAL DETAILS

File Size:

248,832 bytes

File Type:

EXE

Memory Resident:

No

Initial Samples Received Date:

22 May 2024

Payload:

Connects to URLs/IPs, Exploits vulnerabilities

Arrival Details

This Hacking Tool arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Propagation

This Hacking Tool does not have any propagation routine.

Backdoor Routine

This Hacking Tool does not have any backdoor routine.

Rootkit Capabilities

This Hacking Tool does not have rootkit capabilities.

Other Details

This Hacking Tool does the following:

  • It monitors the activity of a process to detect EDR implementation and subsequently bypasses the detection mechanisms.
  • It employs techniques utilized to bypass EDR detections both in user and kernel mode.
  • It performs the following actions to bypass EDR detections:
    • Kernel Notify Routines Callbacks Removalby exploiting vulnerable EDR drivers
    • Disable Object Callbacksby either setting the Enabled flag in the callback structure, unlinking the Callbacklist of threads and process, or disabling object callbacks altogether
    • Bypass Minifilters' Callbacksby unlinking the nodes from their lists, making them temporarily invisible from the filter manager loaded by the EDR using Windows Filter Manager
    • Disable ETW Microsoft-Windows-Threat-Intelligence Provider - by patching in kernel memory related to ETW TI
    • Bypass Userland Hookingby using unhooking, custom or EDR's own trampoline, duplicate DLL, or direct syscall methods
    • Vulnerable Drivers Exploitationby using vulnerable drivers to gain kernel read/write primitive
    • Detect EDR drivers and processesdetects if a driver or process belongs to an EDR product. If an EDR driver or process is unknown, it embeds the information to the tool
    • Bypass RunAsPPLby elevating the protection level to dump the LSASS process memory
    • Bypass Credential Guardby patching and enabling Wdigest to show cleartext credentials in LSASS memory
    • Offsets Retrievalby utilizing hardcoded offsets instead of pattern searches to reliably perform kernel monitoring bypass operations
  • It exploits vulnerabilities in the following known drivers:
  • It checks for the presence of the following files:
    • {Malware Path}\gdrv.sys
    • {Malware Path}\RTCore64.sys
    • {Malware Path}\DBUtil_2_3.sys
    • {Malware Path}\NtoskrnlOffsets.csv → contains offsets used to perform Offsets Retrieval

It accepts the following parameters:

  • -h | --helpShow this help message and exit.
  • -v | --verboseEnable a more verbose output.

    Actions mode:

  • auditDisplay the user-land hooks and / or Kernel callbacks without taking actions.
  • dumpDump the process specified by --process-name (LSASS process by default), as 'process_name' in the current directory or at the specified file using -o | --output .
  • cmdOpen a cmd.exe prompt.
  • credguardPatch the LSASS process' memory to enable Wdigest cleartext passwords caching even if Credential Guard is enabled on the host. No kernel-land actions required.
  • firewallAdd Windows firewall rules to block network access for the EDR processes / services.
  • load_unsigned_driverLoad the specified unsigned driver, bypassing Driver Signature Enforcement (DSE). (Experimental)
  • --usermodePerform user-land operations (DLL unhooking).
  • --kernelmodePerform kernel-land operations (Kernel callbacks removal and ETW TI disabling).

    Hooking-related options:

  • --add-dll {dll name or path}Loads arbitrary libraries into the process' address space, before starting anything. This can be useful to audit userland hooking for DLL that are not loaded by default by this program. Use this option multiple times to load multiple DLLs all at once.
  • --direct-syscallsUse direct syscalls to dump the selected process memory without unhooking userland hooks.
  • --unhook-method {N}Choose the userland un-hooking technique, from the following:
  • 0Do not perform any unhooking (used for direct syscalls operations).
  • 1 (Default) → Uses the (probably monitored) NtProtectVirtualMemory function in ntdll to remove all present userland hooks.
  • 2Constructs a 'unhooked' (i.e. unmonitored) version of NtProtectVirtualMemory, by allocating an executable trampoline jumping over the hook, and remove all present userland hooks.
  • 3Searches for an existing trampoline allocated by the EDR itself, to get an 'unhooked' (i.e. unmonitored) version of NtProtectVirtualMemory, and remove all present userland hooks.
  • 4Loads an additional version of ntdll library into memory, and use the version of NtProtectVirtualMemory present in this library to remove all present userland hooks.
  • 5Allocates a shellcode that uses a direct syscall to call NtProtectVirtualMemory, and uses it to remove all detected hooks.

    BYOVD options:

  • --dont-unload-driverKeep the vulnerable driver installed on the host. Default to automatically uninstall the driver.
  • --no-restoreDo not restore the EDR drivers' Kernel Callbacks that were removed. Default to restore the callbacks.
  • --vuln-driver {gdrv.sys}Path to the vulnerable driver file. Default to 'gdrv.sys' in the current directory.
  • --vuln-service {SERVICE_NAME}Name of the vulnerable service to intall / start.

    Driver sideloading options:

  • --unsigned-driver {evil.sys}Path to the unsigned driver file. Default to 'evil.sys' in the current directory.
  • --unsigned-service {SERVICE_NAME}Name of the unsigned driver's service to intall / start.
  • --no-kdpSwitch to g_CiOptions patching method for disabling DSE (default is callback swapping).

    Offset-related options:

    --nt-offsets {NtoskrnlOffsets.csv}Path to the CSV file containing the required ntoskrnl.exe's offsets. Default to 'NtoskrnlOffsets.csv' in the current directory.
  • --fltmgr-offsets {FltmgrOffsets.csv}Path to the CSV file containing the required fltmgr.sys's offsets. Default to 'FltmgrOffsets.csv' in the current directory.
  • --wdigest-offsets {WdigestOffsets.csv}Path to the CSV file containing the required wdigest.dll's offsets (only for the 'credguard' mode). Default to 'WdigestOffsets.csv' in the current directory.
  • --ci-offsets {CiOffsets.csv}Path to the CSV file containing the required ci.dll's offsets (only for the 'load_unsigned_driver' mode). Default to 'WdigestOffsets.csv' in the current directory.
  • -i | --internetEnables automatic symbols download from Microsoft Symbol Server. If a corresponding Offsets.csv file exists, appends the downloaded offsets to the file for later use. OpSec warning: downloads and drops on disk a PDB file for the corresponding image.

    Dump options:

  • -o | --dump-output {DUMP_FILE}Output path to the dump file that will be generated by the 'dump' mode. Default to 'process_name' in the current directory.
  • --process-name {NAME}File name of the process to dump (defaults to 'lsass.exe')

It accesses the following websites to download its configuration/component files:

  • https://{BLOCKED}crosoft.com/download/symbols/fltMgr.pdb/A008BBBF87CC421FA0E568076A16F4BA2/fltMgr.pdb
  • https://{BLOCKED}crosoft.com/download/symbols/ntkrnlmp.pdb/2E37F962D699492CAAF3F9F4E9770B1D2/ntkrnlmp.pdb
  • https://{BLOCKED}prodscussu5shard2.blob.core.windows.net/b-4712e0edc5a240eabf23330d7df68e77/EAAFCA0A51F871E96A7816D54C085A13CE0C11FE586A49722B16B958FAAA707E00.blob?sv=2019-07-07&sr=b&si=1&sig=4ozlBuKC3%2FnXxfDNdGvUcp0O%2F8PPimxhmZoBFcE3vlA%3D&spr=https&se=2024-05-23T06%3A54%3A58Z&rscl=x-e2eid-24ef7390-c808438b-9d83c71f-eca211b7-session-87a87421-4eaf4224-af3648c6-6cb79d36
  • https://{BLOCKED}prodscussu5shard64.blob.core.windows.net/b-4712e0edc5a240eabf23330d7df68e77/1FFEE3D6E1C2B9FCD4FFC89F42EB5CA37DDEC561FF3525C8C50C03544E0E6CA800.blob?sv=2019-07-07&sr=b&si=1&sig=OU7ULkXeUCrAyjlbkfuI%2Fcgo4MJaubID2iYqy6d7C88%3D&spr=https&se=2024-05-23T06%3A07%3A29Z&rscl=x-e2eid-293baf43-342b4890-a3be8f41-fef947a6-session-0a8541e2-ac464b41-82395d39-4b90186e

  SOLUTION

Minimum Scan Engine:

9.800

SSAPI PATTERN File:

2.725.00

SSAPI PATTERN Date:

09 May 2024

Step 1

Before doing any scans, Windows 7, Windows 8, Windows 8.1, and Windows 10 users must disable System Restore to allow full scanning of their computers.

Step 2

Note that not all files, folders, and registry keys and entries are installed on your computer during this malware's/spyware's/grayware's execution. This may be due to incomplete installation or other operating system conditions. If you do not find the same files/folders/registry information, please proceed to the next step.

Step 3

Search and delete these files

[ Learn More ]
There may be some files that are hidden. Please make sure you check the Search Hidden Files and Folders checkbox in the "More advanced options" option to include all hidden files and folders in the search result.  
  • {Malware Path}\gdrv.sys
  • {Malware Path}\RTCore64.sys
  • {Malware Path}\DBUtil_2_3.sys
  • {Malware Path}\NtoskrnlOffsets.csv

Step 4

Scan your computer with your Trend Micro product to delete files detected as HackTool.Win64.EDRSandBlast.THEOBBD. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check the following Trend Micro Support pages for more information:


Did this description help? Tell us how we did.