HackTool.Win64.EDRSandBlast.THEOBBD

This Hacking Tool arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It does not have any backdoor routine.

Arrival Details

This Hacking Tool arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Propagation

This Hacking Tool does not have any propagation routine.

Backdoor Routine

This Hacking Tool does not have any backdoor routine.

Rootkit Capabilities

This Hacking Tool does not have rootkit capabilities.

Other Details

This Hacking Tool does the following:

• It monitors the activity of a process to detect EDR implementation and subsequently bypasses the detection mechanisms.
• It employs techniques utilized to bypass EDR detections both in user and kernel mode.
• It performs the following actions to bypass EDR detections:
  • Kernel Notify Routines Callbacks Removal → by exploiting vulnerable EDR drivers
  • Disable Object Callbacks → by either setting the Enabled flag in the callback structure, unlinking the Callbacklist of threads and process, or disabling object callbacks altogether
  • Bypass Minifilters' Callbacks → by unlinking the nodes from their lists, making them temporarily invisible from the filter manager loaded by the EDR using Windows Filter Manager
  • Disable ETW Microsoft-Windows-Threat-Intelligence Provider - by patching in kernel memory related to ETW TI
  • Bypass Userland Hooking → by using unhooking, custom or EDR's own trampoline, duplicate DLL, or direct syscall methods
  • Vulnerable Drivers Exploitation → by using vulnerable drivers to gain kernel read/write primitive
  • Detect EDR drivers and processes → detects if a driver or process belongs to an EDR product. If an EDR driver or process is unknown, it embeds the information to the tool
  • Bypass RunAsPPL → by elevating the protection level to dump the LSASS process memory
  • Bypass Credential Guard → by patching and enabling Wdigest to show cleartext credentials in LSASS memory
  • Offsets Retrieval → by utilizing hardcoded offsets instead of pattern searches to reliably perform kernel monitoring bypass operations
• It exploits vulnerabilities in the following known drivers:
  • RTCore64.sys → CVE-2019-16098
  • DBUtil_2_3.sys → CVE-2021-21551
  • gdrv.sys
• It checks for the presence of the following files:
  • {Malware Path}\gdrv.sys
  • {Malware Path}\RTCore64.sys
  • {Malware Path}\DBUtil_2_3.sys
  • {Malware Path}\NtoskrnlOffsets.csv → contains offsets used to perform Offsets Retrieval

It accepts the following parameters:

• -h | --help → Show this help message and exit.
• -v | --verbose → Enable a more verbose output.
  
  Actions mode:
  
  
• audit → Display the user-land hooks and / or Kernel callbacks without taking actions.
• dump → Dump the process specified by --process-name (LSASS process by default), as 'process_name' in the current directory or at the specified file using -o | --output .
• cmd → Open a cmd.exe prompt.
• credguard → Patch the LSASS process' memory to enable Wdigest cleartext passwords caching even if Credential Guard is enabled on the host. No kernel-land actions required.
• firewall → Add Windows firewall rules to block network access for the EDR processes / services.
• load_unsigned_driver → Load the specified unsigned driver, bypassing Driver Signature Enforcement (DSE). (Experimental)
• --usermode → Perform user-land operations (DLL unhooking).
• --kernelmode → Perform kernel-land operations (Kernel callbacks removal and ETW TI disabling).
  
  Hooking-related options:
  
  
• --add-dll {dll name or path} → Loads arbitrary libraries into the process' address space, before starting anything. This can be useful to audit userland hooking for DLL that are not loaded by default by this program. Use this option multiple times to load multiple DLLs all at once.
• --direct-syscalls → Use direct syscalls to dump the selected process memory without unhooking userland hooks.
• --unhook-method {N} → Choose the userland un-hooking technique, from the following:
• 0 → Do not perform any unhooking (used for direct syscalls operations).
• 1 (Default) → Uses the (probably monitored) NtProtectVirtualMemory function in ntdll to remove all present userland hooks.
• 2 → Constructs a 'unhooked' (i.e. unmonitored) version of NtProtectVirtualMemory, by allocating an executable trampoline jumping over the hook, and remove all present userland hooks.
• 3 → Searches for an existing trampoline allocated by the EDR itself, to get an 'unhooked' (i.e. unmonitored) version of NtProtectVirtualMemory, and remove all present userland hooks.
• 4 → Loads an additional version of ntdll library into memory, and use the version of NtProtectVirtualMemory present in this library to remove all present userland hooks.
• 5 → Allocates a shellcode that uses a direct syscall to call NtProtectVirtualMemory, and uses it to remove all detected hooks.
  
  BYOVD options:
  
  
• --dont-unload-driver → Keep the vulnerable driver installed on the host. Default to automatically uninstall the driver.
• --no-restore → Do not restore the EDR drivers' Kernel Callbacks that were removed. Default to restore the callbacks.
• --vuln-driver {gdrv.sys} → Path to the vulnerable driver file. Default to 'gdrv.sys' in the current directory.
• --vuln-service {SERVICE_NAME} → Name of the vulnerable service to intall / start.
  
  Driver sideloading options:
  
  
• --unsigned-driver {evil.sys} → Path to the unsigned driver file. Default to 'evil.sys' in the current directory.
• --unsigned-service {SERVICE_NAME} → Name of the unsigned driver's service to intall / start.
• --no-kdp → Switch to g_CiOptions patching method for disabling DSE (default is callback swapping).
  
  Offset-related options:
  
  --nt-offsets {NtoskrnlOffsets.csv} → Path to the CSV file containing the required ntoskrnl.exe's offsets. Default to 'NtoskrnlOffsets.csv' in the current directory.
• --fltmgr-offsets {FltmgrOffsets.csv} → Path to the CSV file containing the required fltmgr.sys's offsets. Default to 'FltmgrOffsets.csv' in the current directory.
• --wdigest-offsets {WdigestOffsets.csv} → Path to the CSV file containing the required wdigest.dll's offsets (only for the 'credguard' mode). Default to 'WdigestOffsets.csv' in the current directory.
• --ci-offsets {CiOffsets.csv} → Path to the CSV file containing the required ci.dll's offsets (only for the 'load_unsigned_driver' mode). Default to 'WdigestOffsets.csv' in the current directory.
• -i | --internet → Enables automatic symbols download from Microsoft Symbol Server. If a corresponding Offsets.csv file exists, appends the downloaded offsets to the file for later use. OpSec warning: downloads and drops on disk a PDB file for the corresponding image.
  
  Dump options:
  
  
• -o | --dump-output {DUMP_FILE} → Output path to the dump file that will be generated by the 'dump' mode. Default to 'process_name' in the current directory.
• --process-name {NAME} → File name of the process to dump (defaults to 'lsass.exe')

It accesses the following websites to download its configuration/component files:

• https://{BLOCKED}crosoft.com/download/symbols/fltMgr.pdb/A008BBBF87CC421FA0E568076A16F4BA2/fltMgr.pdb
• https://{BLOCKED}crosoft.com/download/symbols/ntkrnlmp.pdb/2E37F962D699492CAAF3F9F4E9770B1D2/ntkrnlmp.pdb
• https://{BLOCKED}prodscussu5shard2.blob.core.windows.net/b-4712e0edc5a240eabf23330d7df68e77/EAAFCA0A51F871E96A7816D54C085A13CE0C11FE586A49722B16B958FAAA707E00.blob?sv=2019-07-07&sr=b&si=1&sig=4ozlBuKC3%2FnXxfDNdGvUcp0O%2F8PPimxhmZoBFcE3vlA%3D&spr=https&se=2024-05-23T06%3A54%3A58Z&rscl=x-e2eid-24ef7390-c808438b-9d83c71f-eca211b7-session-87a87421-4eaf4224-af3648c6-6cb79d36
• https://{BLOCKED}prodscussu5shard64.blob.core.windows.net/b-4712e0edc5a240eabf23330d7df68e77/1FFEE3D6E1C2B9FCD4FFC89F42EB5CA37DDEC561FF3525C8C50C03544E0E6CA800.blob?sv=2019-07-07&sr=b&si=1&sig=OU7ULkXeUCrAyjlbkfuI%2Fcgo4MJaubID2iYqy6d7C88%3D&spr=https&se=2024-05-23T06%3A07%3A29Z&rscl=x-e2eid-293baf43-342b4890-a3be8f41-fef947a6-session-0a8541e2-ac464b41-82395d39-4b90186e