di_blog_post

Deep Instinct prevents more advanced threats than any EPP or EDR in the world.

Deep Instinct Blog: Breaking News and Updates

Explore Deep Instinct DSX

Prevent Zero-Day Attacks

Real-Time Malicious Verdicts

Real-Time Explainability

Lower TCO

Ensure Privacy & Compliance

Deep Instinct DSX

Cloud

Applications

Endpoints

Use Cases

Asset Library

Blog

Videos

Events & Webinars

Resources

About Deep Instinct

Our Customers

Newsroom

Careers

Contact Us

Company

Request Demo

Customer Portal

Integrations and Compliance

Training

Quick Links

Discover how our revolutionary deep learning-powered solution prevents and explains unknown, never-before-seen threats.

explore deep instinct dsx

why dsx

Prevent zero-day attacks

Detect and prevent threats in <20ms, faster than the blink of an eye.

real-time malicious verdicts

Gain actionable, AI-driven intelligence on zero-day threats in seconds.

Real-Time Insights & Explainability

Reduce cybersecurity costs with efficient, high-performance threat prevention.

Enhance data protection while meeting stringent privacy and regulatory requirements.

DEPLOYMENT

Secure your multi-cloud or hybrid infrastructure against zero-day threats.

CLOUD

Safeguard critical data on Network-Attached Storage systems from advanced cyber threats.

Defend SaaS and custom applications from zero-day vulnerabilities and threats.

APPLICATIONS

Protect devices and endpoints with AI-driven threat prevention.

ENDPOINTS

EXPLORE 

Threat Research

Voice Of SecOps

COMPARE

Deep Instinct complements Microsoft Defender with advanced threat prevention to stop threats before they enter your environment.

+ Microsoft Defender

Deep Instinct and Tanium deliver prevention-first endpoint security to reduce risk and boost productivity.

+ Tanium

EDR is not enough — enhance existing cybersecurity tools with advanced, real-time threat prevention using deep learning to produce defense in depth.

EXTEND/ENHANCE LEGACY AV

Replace outdated, legacy AV solutions with prevention-first, deep-learning-based protection purpose-built for cybersecurity.

REPLACE LEGACY AV

Faster and more accurate – Deep Instinct safeguards your data and protects your NAS storage better than Trellix.

REPLACE TRELLIX

Leadership Team

Board of Directors

Partners

Login

content_block

Perspective & Findings

<h4>Don’t Let Application File Uploads Become Malware Downloads</h4>

file-upload-security-blog.jpg

Recent Blog Posts

Listing preview

Perspective & Findings

image_media_card

Recent Blog Posts

listing_preview

BPFDoor Malware Evolves – Stealthy Sniffing Backdoor Ups Its Game

Who is the only NEW vendor in the 2022 Gartner® Magic Quadrant™ for Endpoint Protection Platforms?

ChatGPT and Malware: Making Your Malicious Wishes Come True

Top-3 Drawbacks of Content Disarm + Reconstruction (CDR) for Malware Prevention

LSASS Memory Dumps are Stealthier than Ever Before

LSASS memory dumps

Trending at Deep Instinct

carousel_cards

2019 almost passed without any completely new developments in wiper malware variants until mid-December, when an attack involving a new wiper dubbed Z

ZeroCleare.jpg

2019 almost passed without any completely new developments in wiper malware variants until mid-December, when an attack involving a new wiper dubbed ZeroCleare was widely covered in the media. In stark contrast, 2020 has already opened with news about cyber-attacks by the DustMan wiper. It’s been a couple of months since we <a href="https://www.deepinstinct.com/2019/11/04/wiper-malware-devastation-down-memory-lane/">published an overview of wipers</a> and attacks that took place in the recent years, and with new developments occurring, we can provide additional insight into recent attacks with ZeroCleare and DustMan.
Iran has already established itself as a serious player in the cyber warfare field with targeted attacks dating back to the summer of 2012. Then, it released a destructive disk wiping malware dubbed Shamoon, against oil companies in Saudi Arabia and Qatar damaging approximately 30,000 workstations which lead to a weeklong restoration of their services. Following that, in November 2016 a newer version of Shamoon was seen in further attacks on Saudi Arabia’s energy sector, and again in January 2017 hitting the Saudi ministry of labor and large organizations in the chemical sector.
Like in past attacks, this time the Tactics, Techniques and Procedures (TTP) of the operation is similar. In general, what has changed are the names given to new wiper malware variants - ZeroCleare and DustMan, and a slight addition to the disk wiping toolset. The targets are once again organizations from the industrial sector, with a Middle Eastern origin. Additionally, similarly to Shamoon, ZeroCleare and Dustman have relied on legitimate software to circumvent Windows OS’s security features and anti-malware solutions. Somewhat amusingly, after almost a year since the latest attack with Shamoon v3, the same disk driver was used for the disk wiping functions. EldoS RawDisk driver, a legitimate tool for direct modification of data on computer’s hard drive, was employed ZeroCleare and DustMan for overwriting the MBR (Master Boot Record) and other disks. Just like the RawDisk, since the true intent of dual-use tools cannot always be determined by anti-malware heuristics, it often serves the attackers who successfully avoid detection, allowing them to achieve their destructive goal under the radar. This clever tactic has become a trend that is increasingly being seen in cyberattacks.
ZeroCleare, and its derivative - DustMan, had used an additional driver – VirtualBox’s VBoxDrv kernel driver which is vulnerable to shellcode (CVE-2008-3431). The VBoxDrv allowed ZeroCleare and DustMan to bypass a main Windows security feature - the Driver Signature Enforcement (DSE). The DSE denies drivers that aren’t digitally signed from being loaded under the Windows OS. Since the VBoxDrv is digitally signed it was exploited for loading the EldoS RawDisk driver to accomplish the disk wiping goals. At the core of this method of bypassing the DSE, is a modified version of Turla Driver Loader (TDL) available on <a href="https://github.com/hfiref0x/TDL" target="_blank" rel="noopener noreferrer">GitHub. </a>Dustman is slightly different from ZeroCleare. It delivers all the required payloads and drivers in a single executable, instead of bringing them separately like ZeroCleare did, but overall its functionality is the same.
According to initial reports from IBM’s X-Force, the operation was issued jointly by two Iranian hacking groups – APT34 (OILRIG/Helix) and xHunt. APT34 was working on gaining initial access to targets’ networks and was later joined by xHunt.
Wipers bring destruction to data almost instantly - any EDR product out there, being non-proactive, will be useless in preventing wipers from being executed on the system. Moreover, the dual-use tools, like EldoS RawDisk, often trusted by <a href="https://www.deepinstinct.com/product-overview/">cyber security solutions</a>, aren’t monitored, posing a high risk when these tools are used with malicious intents. Therefore, the monitoring of dual-use tools is good security practice and should be adopted by admins seeking to secure their IT infrastructure. Nevertheless, only prevention-focused solutions can assist in securing IT assets. Deep Instinct applies cutting-edge <a href="https://www.deepinstinct.com/">deep learning AI</a> technology to predict and prevent these destructive wipers, leaving no chance that any malware will be successful, saving admins from huge headaches and organizations from financial loss.

Clearing Disk to Zero, Leaving Admins to Byte the Dust

Amnesia is a primal human fear. It makes sense— what could be worse than losing every memory of your childhood, your loved ones, yourself? The concept

shutterstock_1142082479.jpg

Amnesia is a primal human fear. It makes sense— what could be worse than losing every memory of your childhood, your loved ones, yourself? The concept is so frightening that it has been used in hit movies like Men in Black and Total Recall.
Reality is no less terrifying.  While we aren’t under threat of having our personal memories erased, critical data on our computers can be destroyed by a cyberweapon known as wiper malware.
<h3>What is wiper malware?</h3>
Wiper malware strikes by wiping specific files, or the entire hard disk of an infected computer.  Unlike ransomware criminals who encrypt data and hold it for ransom, wiper criminals destroy data entirely. They are not motivated by financial gain but have been compared to terrorists, looking to sow fear and uncertainty by creating irreversible financial and reputational damage to a country, organization or business. And like terror attacks, detection is useless— once they strike, the damage is irreversible. One of the largest wiper attacks, NotPetya in 2017, is estimated to have caused over $10 billion of damage across the globe.
<h3>What are the attack vectors for wipers?</h3>
Wipers aim to create maximum devastation in the minimum amount of time.  They generally have three targets:  files (data), the boot section of the operating system and backups,  Often targeting all three.
<h3>Files</h3>
Since deleting or overwriting all files on a disk can take time, wipers often affect the files partially, rendering them unusable. In other cases, wipers choose to damage specific files according to file type or other parameters. Another tactic is to encrypt various key points of the disk drive, like in ransomware. However, unlike ransomware, wipers employ "key-less" encryption so that there's no decryption key for reversing the wiper's dirty work. Wipers also target the Master File Table (MFT) that stores information describing every file on the computer including access permissions, creation date, and disk location. When the MFT is damaged, the files stored on a disk become unrecoverable i.e. the filesystem (NTFS) won't be able to reconstruct them from the disk. Since the files are not stored contiguously, it is near impossible to restore the files without the MFT.
<h3>Boot sector</h3>
The Master Boot Record (MBR) contains information about the filesystem, disk partitions, and can invoke the boot loaders in Volume Boot Records (VBRs). If the MBR and/or VBR are damaged or altered, the computer won't be able to boot the OS and load the filesystem. Unlike files, which take time to destroy or overwrite, the MBR/VBRs can be altered in seconds and the computer will become unbootable. MBR/VBRs can be damaged either through key-less encryption, or corruption of the record's data (overwriting).
<h3>Backups</h3>
Wipers do everything to make sure that the targeted data is unrecoverable. Therefore in addition to damaging files and the boot sector, they also target the features in the Windows operating system that can help restore damaged file systems. For example, they delete volume shadow copies, a Windows backup feature, and attack the Windows Recovery Console, a command-line interface with a range of tools that can assist in restoring Windows to a normal state. By destroying backups, they ensure that their victims are unable to salvage any data.
<h3>How can you protect yourself?</h3>
Since wipers destroy data as soon as they are activated, an EDR response is useless. Therefore, like with other types of terror, protection from wipers necessitates a focus on prevention. Choosing a <a href="https://www.deepinstinct.com/product-overview/">security solution</a> with strong predictive capabilities that can <a href="https://www.deepinstinct.com/automatic-threat-analysis/">analyze threats pre-execution</a>, before the threat materializes, is critical to protecting your data from wiper malware.
&nbsp;
For more information about how you can keep your enterprise safe from attack, read the Deep Instinct report on Wiper malware. It addresses
<ul>
<li>The various attack vectors associated with wiper malware</li>
<li>An overview of wiper attacks over the past year and</li>
<li>A prediction of how future wiper attacks will occur.</li>
</ul>
<a href="https://info.deepinstinct.com/whitepaper-the-wiper-landscape" target="_blank" rel="noopener noreferrer"><img class="alignnone wp-image-6209" src="https://www.deepinstinct.com/wp-content/uploads/2019/11/Wiper_malware-banner-450x113.jpg" alt="" width="509" height="128" /></a>

Wiper Malware: Devastation Down Memory Lane

Malware developers are perpetually on the look-out for new techniques that will enable their malicious files of "destruction and chaos" to stay undete

evasion-techniques.jpg

<a href="https://www.deepinstinct.com/2018/07/10/why-deep-learning-is-the-only-option-for-stopping-unknown-malware-2/" target="_self">Malware developers</a> are perpetually on the look-out for new techniques that will enable their malicious files of "destruction and chaos" to stay undetected. This not only means going undetected on the compromised machine but more importantly, hiding their malicious indicators and behaviors from detection tools. For this reason malware developers invest a lot of time and resources to discover techniques that will enable them to hide malicious files from <a href="https://www.deepinstinct.com/automatic-threat-analysis/" target="_blank" rel="noopener noreferrer">automated threat analysis</a> systems and detection and response tools by drawing on the latest in evasion techniques.As solution providers wisen-up to the latest evasion techniques, malware developers are forced to adjust and become even more enterprising in their techniques,&nbsp; effectively creating a perpetual cat and mouse race. In Deep Instinct's Malware Evasion Techniques blog series we reflect back on this series of developments and provide a basic summary for those interested in learning more on the topic.<h3>Introduction</h3>Often to avoid detection, malware will leverage various evasion techniques that involve process manipulation to execute malicious code, and especially process injection. When malware is running on the infected machine its process can be easily detected by <a href="https://www.deepinstinct.com/automatic-threat-analysis/" target="_blank" rel="noopener noreferrer">analysts and security programs</a>, by just checking the list of running processes and filtering out the expected processes that are part of the operating system or belong to installed applications. To hide on the infected system, malware can load its malicious payload inside a legitimate process without arousing suspicion.Process injection and manipulation is a prominent method used by attackers due to the stealth it offers and its ability to evade both cybersecurity analysts and solutions. Attackers are no longer concerned with just loading malware on to victims’ devices but are also innovating the way they embed it into existing processes so that they can remain undetected and launch and execute additional successful attacks. And with so many viable techniques and variations, it becomes increasingly difficult for analysts and software to identify its existence in what appears to be seemingly normal processes running on their systems. Now more than ever it is imperative that cybersecurity companies provide advanced <a href="/glossary/malware-detection" target="_self">malware detection</a> technologies and capabilities that are effective irrespective of who made the latest move – the cat or the mouse.In this blog, the first in our series on malware evasion techniques, we present the most widely-used process injection and manipulation techniques, provide examples for malware families that use these techniques, and explain how to detect them.<h3>DLL Injection</h3>DLL injection is one of the simplest and most common processes injection techniques. To execute a malicious Dynamic-Link Library (DLL) under another process malware writes the path of a malicious DLL into a remote process’ address space. Then, to invoke the DLL's execution, the malware creates a remote thread from the targeted process. This technique implies that the malicious DLL is stored on a disk before injecting it into the remote process.Steps for DLL injection:<ol><li>Locate the target process by traversing the running processes and call OpenProcess for obtaining a handle to it.</li><li>Allocate the space for injecting the path of the malicious DLL file to the target process with a call to VirtualAllocEx with the targeted process handle.</li><li>Write the path of the DLL into the allocated space with WriteProcessMemory.</li><li>Retrieve the address of LoadLibrary from kernel32.dll, that given the path to DLL, loads it into memory (does not execute it though).</li><li>Call CreateRemoteThread passing it the address of LoadLibrary causing the injected DLL file’s path to be loaded into memory and executed.</li></ol>The downside of this technique is that the malicious DLL file must be stored on disk, which exposes it to detection by regular security solutions. Nevertheless, this technique is employed by malware developers and is widespread in the wild. For example, Poison Ivy, a popular and long-standing RAT, uses DLL injection. Poison Ivy has been involved in several APT campaigns recommending itself as a tool of choice by APT groups for espionage operations.&nbsp;<h3>Reflective DLL Loading (Injection)</h3>Reflective DLL injection, unlike regular DLL injection described above, is a stealthier technique introduced by <a href="https://github.com/stephenfewer/ReflectiveDLLInjection" target="_blank" rel="noopener noreferrer">Steven Fewer</a>, for injecting and executing a DLL inside another process. For some, this technique might be considered as “self-loading”, rather than process injection. To avoid storing the DLL on disk, malware will have to manually map the DLL’s raw binary into virtual memory, as the Windows loader would do, but without calling the Windows API’s LoadLibrary that might be detected by tools monitoring the LoadLibrary calls. It will be enough to get the correct address of the injected export function that will fully load and map remaining components of the DLL inside the target process, e.g. ReflectiveLoader().Reflective DLL injection can be summarized in the following steps:<ol><li>Locate and open the target process with Read-Write-eXecute permissions using OpenProcess.</li><li>Calculate the size of the DLL data that needs to be allocated in memory.</li><li>Allocate enough space in memory for the DLL with VirtualAllocEx.</li><li>Write DLL’s raw data into the allocated space.</li><li>Calculate the offset to the exported function used for doing reflective loading found in the DLL, e.g. ReflectiveLoader().</li><li>Execute the reflective loader function in the target process using the CreateRemoteThread passing it the offset of the ReflectiveLoader().</li><li>The ReflectiveLoader() will search for the Process Environment Block (PEB) of the target process using the appropriate CPU register. The located PEB will be used to find the address of kernel32.dll in memory and other required libraries.</li><li>Traverse the located kernel32’s exported functions to find the correct addresses of Windows API functions that’ll be used for fixing the addresses of other DLL’s imported functions like LoadLibraryA, GetProcAddress, and VirtualAlloc.</li><li>Using the functions from step 8 load the DLL into memory and call its entry point.</li></ol>Recent Ramnit variants have been spotted employing a reflective DLL loading to execute its modules under legitimate processes. Ramnit is a widespread banking Trojan that has been active since 2010. In 2015 Europol has brought Ramnit’s C&C servers down, but it didn’t cease its activity and is still one of the popular banking malware in recent years.<h3>Portable Executable Loading (Injection)</h3>Just like with reflective DLL loading, Portable Executable injection and loading does not require the DLL (or executable) to be stored on disk. And similarly, PE injection involves some work to correctly load and execute the injected PE. To load and execute the injected PE, malware needs to calculate the new base address of the injected PE to properly change its fixed addresses. To accomplish this, malware will traverse its relocation table inside the target process to compute the correct addresses.PE Loading in a nutshell:<ol><li>Using the PE header of the current image, get its base address and size.</li><li>In the processes injecting the PE, allocate memory for the image using VirtualAlloc.</li><li>Copy the image into the locally allocated memory using memcpy.</li><li>In the target process, allocate memory for the injected image with VirtualAllocEx.</li><li>In the process injecting the PE, find the relocation table offset from loaded in local memory.</li><li>Fix all the absolute addresses of the image to work with the address returned by VirtualAllocEx, by traversing the relocation table from step 5.</li><li>Inject (copy) the image from the local process to the target process’ allocated memory using WriteProcessMemory.</li><li>Find the correct address of the exported function to be executed inside the target process:</li></ol>a) Subtract the function’s address in the injecting process from the base addressb) In the target process, add the result from (b) to the address of the allocated memory9. Execute the injected by creating a new thread with CreateRemoteThread passing it the remote address of the function from step 8.Note: In addition to calculating the base address and fixing the absolute addresses of the injected PE, it might be necessary to fix the injected IAT to call imported functions from. Check step 8 from “Reflective DLL Loading” shown above.In practice, PE loading has been employed by several actors, including Turla – a Russian-based APT group. Turla’s espionage platform has employed PowerSploit’s <a href="https://github.com/PowerShellMafia/PowerSploit/blob/master/CodeExecution/Invoke-ReflectivePEInjection.ps1" target="_self">Invoke-ReflectivePEInjection.ps1</a> for PE loading into random processes.<h3>Process Hollowing</h3>Another approach for making the legitimate process run the malicious payload is process hollowing. In this technique, a legitimate process is started by malware in a suspended state. Then, while in a suspended state, the target process’ memory is unmapped (hollowed) to contain the malicious payload.Steps for process hollowing:<ol><li>Start a new process in a suspended state by calling CreateProcess with CreationFlags parameter set to CREATE_SUSPENDED=0x00000004.</li><li>Unmap the memory of the target process using ZwUnmapViewOfSection or NtUnmapViewOfSection.</li><li>Allocate space in memory for the malicious payload using VirtualAllocEx.</li><li>Inject the payload in the allocated memory region with WriteProcessMemory.</li><li>Change the execution point of the targeted process to start from the correct point in the injected payload by calling GetThreadContext.</li><li>Resume targeted process execution by calling ResumeThread.</li></ol>Process hollowing was seen in very popular banking malware – TrickBot. Since 2016 TrickBot has been a major threat compromising online banking (and other services) accounts of thousands of victims. Process Hollowing is only one of several evasion techniques employed by Trickbot over the years.<h3>The Next Level</h3>In the past years new process injection and manipulation techniques have been introduced and are rapidly gaining popularity amongst malware developers as well as security researchers – AtomBombing and Process Doppelgänging.AtomBombing relates to a set of process injection techniques that utilize Windows’ APC (Asynchronous Procedure Call). It uses the global atom table, used by Windows for sharing and storing data, to store its malicious code and be executed by a legitimate process. This technique has been observed in Dridex – a popular banking trojan.Process Doppelgänging relies on the Windows Transactional NTFS (TxF), a feature that ensures data integrity by allowing only one transacted handle to write to a file, preventing the write operations by other handles. Other handles may read the version of data stored at the time when the initial write handle was obtained. If the application fails during the write operation, TxF performs a rollback to the initial version of the data. In Process Doppelgänging the TxF transaction created from a legitimate application is used to overwrite file contents visible only within the context of this transaction with malicious data. From here, similarly to other injection and loading techniques, the malicious data is loaded into memory. Then, the overwritten data is rolled back by TxF, removing the evidence of malicious data from disk. Finally, the loaded malicious code gets executed by a newly created process. This technique is becoming popular and is being employed by malware families like AZORult, LokiBot, Pony Stealer and others.&nbsp;Malware will always seek a way to infect its victims. “Good” malware will infect its victims with minimum impact on the targeted system, disguising its presence as much as possible to avoid suspicion. Here we presented a basic overview of some of the evasion techniques seen in malware that attempts to disguise itself inside legitimate processes. We hope this overview will be a good starting point for understanding malware evasion techniques. Be aware and stay safe.Read the <a href="https://www.deepinstinct.com/2019/10/29/malware-evasion-techniques-part-2-anti-vm-blog/" target="_blank" rel="noopener noreferrer">next blog</a> in the series focused on anti-virtualization malware.

Discover how Deep Instinct DSX protects your NAS storage more effectively than Trellix.

David Krivobokov

From David Krivobokov.