HackTool.Win64.EDRSandBlast.THEOBBD

它以文(wén)件的形式出现在系统中(zhōng)，可(kě)能(néng)是其他(tā)恶意软件投放的，或者是用(yòng)户在访问恶意网站时无意中(zhōng)下载的。

该恶意软件不具(jù)有(yǒu)任何传播例程。

该恶意软件不具(jù)有(yǒu)任何后门例程。

新(xīn)病毒详细信息

它以文(wén)件的形式出现在系统中(zhōng)，可(kě)能(néng)是其他(tā)恶意软件投放的，或者是用(yòng)户在访问恶意网站时无意中(zhōng)下载的。

传播

该恶意软件不具(jù)有(yǒu)任何传播例程。

后门例程

该恶意软件不具(jù)有(yǒu)任何后门例程。

其他(tā)详细信息

该程序执行以下操作(zuò)：

• It monitors the activity of a process to detect EDR implementation and subsequently bypasses the detection mechanisms.
• It employs techniques utilized to bypass EDR detections both in user and kernel mode.
• It performs the following actions to bypass EDR detections:
  • Kernel Notify Routines Callbacks Removal → by exploiting vulnerable EDR drivers
  • Disable Object Callbacks → by either setting the Enabled flag in the callback structure, unlinking the Callbacklist of threads and process, or disabling object callbacks altogether
  • Bypass Minifilters' Callbacks → by unlinking the nodes from their lists, making them temporarily invisible from the filter manager loaded by the EDR using Windows Filter Manager
  • Disable ETW Microsoft-Windows-Threat-Intelligence Provider - by patching in kernel memory related to ETW TI
  • Bypass Userland Hooking → by using unhooking, custom or EDR's own trampoline, duplicate DLL, or direct syscall methods
  • Vulnerable Drivers Exploitation → by using vulnerable drivers to gain kernel read/write primitive
  • Detect EDR drivers and processes → detects if a driver or process belongs to an EDR product. If an EDR driver or process is unknown, it embeds the information to the tool
  • Bypass RunAsPPL → by elevating the protection level to dump the LSASS process memory
  • Bypass Credential Guard → by patching and enabling Wdigest to show cleartext credentials in LSASS memory
  • Offsets Retrieval → by utilizing hardcoded offsets instead of pattern searches to reliably perform kernel monitoring bypass operations
• It exploits vulnerabilities in the following known drivers:
  • RTCore64.sys → CVE-2019-16098
  • DBUtil_2_3.sys → CVE-2021-21551
  • gdrv.sys
• It checks for the presence of the following files:
  • {Malware Path}\gdrv.sys
  • {Malware Path}\RTCore64.sys
  • {Malware Path}\DBUtil_2_3.sys
  • {Malware Path}\NtoskrnlOffsets.csv → contains offsets used to perform Offsets Retrieval