Connect with us

Cyber Security

HijackLoader Expands Techniques to Improve Defense Evasion

Published

on

Written by Donato Onofri, Senior Red Team Engineer at CrowdStrike; and Emanuele Calvelli, Threat Research Engineer at CrowdStrike

CrowdStrike researchers have identified a HijackLoader (aka IDAT Loader) sample that employs sophisticated evasion techniques to enhance the complexity of the threat. HijackLoader, an increasingly popular tool among adversaries for deploying additional payloads and tooling, continues to evolve as its developers experiment and enhance its capabilities.

In their analysis of a recent HijackLoader sample, CrowdStrike researchers discovered new techniques designed to increase the defence evasion capabilities of the loader. The malware developer used a standard process hollowing technique coupled with an additional trigger that was activated by the parent process writing to a pipe. This new approach has the potential to make defence evasion stealthier.

The second technique variation involved an uncommon combination of process doppelgänging and process hollowing techniques. This variation increases the complexity of analysis and the defence evasion capabilities of HijackLoader. Researchers also observed additional unhooking techniques used to hide malicious activity.

This blog focuses on the various evasion techniques employed by HijackLoader at multiple stages of the malware.

HijackLoader Analysis

Infection Chain Overview

The HijackLoader sample CrowdStrike analyzed implements complex multi-stage behaviour in which the first-stage executable (streaming_client.exe) deobfuscates an embedded configuration partially used for dynamic API resolution (using PEB_LDR_DATA structure without another API usage) to harden against static analysis.
Afterwards, the malware uses WinHTTP APIs to check if the system has an active internet connection by connecting to https[:]//nginx[.]org.

If the initial connectivity check succeeds, then execution continues, and it connects to a remote address to download the second-stage configuration blob. If the first URL indicated below fails, the malware iterates through the following list:

  • https[:]//gcdnb[.]pbrd[.]co/images/62DGoPumeB5P.png?o=1
  • https[:]//i[.]imgur[.]com/gyMFSuy.png;
  • https[:]//bitbucket[.]org/bugga-oma1/sispa/downloads/574327927.png

Upon successfully retrieving the second-stage configuration, the malware iterates over the downloaded buffer, checking for the initial bytes of a PNG header. It then proceeds to search for the magic value  C6 A5 79 EA, which precedes the XOR key (32 B3 21 A5 in this sample) used to decrypt the rest of the configuration blob.

Following XOR decryption, the configuration undergoes decompression using the RtlDecompressBuffer API with COMPRESSION_FORMAT_LZNT1. After decompressing the configuration, the malware loads a legitimate Windows DLL specified in the configuration blob (in this sample, C:\Windows\SysWOW64\mshtml.dll).

The second-stage, position-independent shellcode retrieved from the configuration blob is written to the .text section of the newly loaded DLL before being executed. The HijackLoader second-stage, position-independent shellcode then performs some evasion activities (further detailed below) to bypass user mode hooks using Heaven’s Gate and injects subsequent shellcode into cmd.exe.The injection of the third-stage shellcode is accomplished via a variation of process hollowing that results in an injected hollowed mshtml.dll into the newly spawned cmd.exe child process.

The third-stage shellcode implements a user mode hook bypass before injecting the final payload (a Cobalt Strike beacon for this sample) into the child process logagent.exe. The injection mechanism used by the third-stage shellcode leverages the following techniques:

  • Process Doppelgänging Primitives: This technique is used to hollow a Transacted Section(dll) in the remote process to contain the final payload.
  • Process/DLL Hollowing: This technique is used to inject the fourth-stage shellcode that is responsible for performing evasion before passing execution to the final payload within the transacted section from the previous step.

The figure below, details the attack path exhibited by this HijackLoader variant.

Main Evasion Techniques Used by HijackLoader and Shellcode

The primary evasion techniques employed by the HijackLoader include hook bypass methods such as Heaven’s Gate and unhooking by remapping system DLLs monitored by security products. Additionally, the malware implements variations of process hollowing and an injection technique that leverages transacted hollowing, which combines the transacted section and process doppelgänging techniques with DLL hollowing.

Like other variants of HijackLoader, this sample implements a user mode hook bypass using Heaven’s Gate (when run in SysWOW64) — this is similar to existing (x64_Syscall function) implementations. This implementation of Heaven’s Gate is a powerful technique that leads to evading user mode hooks placed in SysWOW64 ntdll.dll by directly calling the syscall instruction in the x64 version of ntdll.

Each call to Heaven’s Gate uses the following as arguments:

  • The syscall number
  • The number of parameters of the syscall
  • The parameters (according to the syscall)

This variation of the shellcode incorporates an additional hook bypass mechanism to elude any user mode hooks that security products may have placed in the x64 ntdll. These hooks are typically used for monitoring both the x32 and x64 ntdll. During this stage, the malware remaps the .text section of x64 ntdll by using Heaven’s Gate to call NtWriteVirtualMemory and NtProtectVirtualMemory to replace the in-memory mapped ntdll with the .text from a fresh ntdll read from the file C:\windows\system32\ntdll.dll. This unhooking technique is also used on the process hosting the final Cobalt Strike payload (logagent.exe) in a final attempt to evade detection.

Process Hollowing Variation

To inject the subsequent shellcode into the child process cmd.exe, the malware utilizes common process hollowing techniques. This involves mapping the legitimate Windows DLL mshtml.dll into the target process and then replacing its .text section with shellcode. An additional step necessary to trigger the execution of the remote shellcode is detailed in a later section.

To set up the hollowing, the sample creates two pipes that are used to redirect the Standard Input and the Standard Output of the child process (specified in the aforementioned configuration blob, C:\windows\syswow64\cmd.exe) by placing the pipes’ handles in a STARTUPINFOW structure spawned with CreateProcessW API.

One key distinction between this implementation and the typical “standard” process hollowing can be observed here: In standard process hollowing, the child process is usually created in a suspended state. In this case, the child is not explicitly created in a suspended state, making it appear less suspicious. Since the child process is waiting for an input from the pipe created previously, its execution is hanging on receiving data from it. Essentially, we can call this an interactive process hollowing variation.

As a result, the newly spawned cmd.exe will read input from the STDIN pipe, effectively waiting for new commands. At this point, its EIP (Extended Instruction Pointer) is directed toward the return from the NtReadFile syscall. The following section details the steps taken by the second-stage shellcode to set up the child process cmd.exe ultimately used to perform the subsequent injections used to execute the final payload.

The parent process streaming_client.exe initiates an NtDelayExecution to sleep, waiting for cmd.exe to finish loading. Afterwards, it reads the legitimate Windows DLL mshtml.dll from the file system and proceeds to load this library into cmd.exe as a shared section. This is accomplished using the Heaven’s Gate technique for:

  • Creating a shared section object using  NtCreateSection
  • Mapping that section in the remote exe using NtMapViewOfSection

It then replaces the .text section of the mshtml DLL with malicious shellcode by using:

  • Heaven’s Gate to call  NtProtectVirtualMemory on exe to set RWX permissions on the .text section of the previously mapped section mshtml.dll
  • Heaven’s Gate to call NtWriteVirtualMemoryon the DLL’s .text section to stomp the module and write the third-stage shellcode

Finally, to trigger the execution of the remote-injected shellcode, the malware uses:

  • Heaven’s Gate to suspend (NtSuspendThread) the remote main thread
  • A new CONTEXT (by using NtGetContextThread and NtSetContextThread) to modify the EIP to point to the previously written shellcode
  • Heaven’s Gate to resume (NtResumeThread) the remote main thread of exe

However, because cmd.exe is waiting for user input from the STDINPUT pipe, the injected shellcode in the new process isn’t executed upon the resumption of the thread. The loader must take an additional step:

  • The parent process exe needs to write (WriteFile) \r\n string to the STDINPUT pipe created previously to send an input to cmd.exe after calling NtResumeThread. This effectively resumes execution of the primary thread at the shellcode’s entry point in the child process cmd.exe.

Interactive Process Hollowing Variation: Tradecraft Analysis

We have successfully replicated the threadless process hollowing technique to understand how the pipes trigger it. Once the shellcode has been written as described, it needs to be activated. This activation is based on the concept that when a program makes a syscall, the thread waits for the kernel to return a value.

In essence, the interactive process hollowing technique involves the following steps:

  • CreateProcess: This step involves spawning the exe process to inject the malicious code by redirecting STDIN and STDOUT to pipes. Notably, this process isn’t suspended, making it appear less suspicious. Waiting to read input from the pipe, the NtReadFile syscall sets its main thread’s state to Waiting and _KWAIT_REASON to Executive, signifying that it’s awaiting the execution of kernel code operations and their return.
  • WriteProcessMemory: This is where the shellcode is written into the exe child process.
  • SetThreadContext: In this phase, the parent sets the conditions to redirect the execution flow of the exe child process to the previously written shellcode’s address by modifying the EIP/RIP in the remote thread CONTEXT.
  • WriteFile: Here, data is written to the STDIN pipe, sending an input to the exe process. This action resumes the execution of the child process from the NtReadFile operation, thus triggering the execution of the shellcode. Before returning to user space, the kernel reads and restores the values saved in the _KTRAP_FRAME structure (containing the EIP/RIP register value) to resume from where the syscall was called. By modifying the CONTEXT in the previous step, the loader hijacks the resuming of the execution toward the shellcode address without the need to suspend and resume the thread, which this technique usually requires.

Transacted Hollowing² (Transacted Section/Doppelgänger + Hollowing)

The malware writes the final payload in the child process logagent.exe spawned by the third-stage shellcode in cmd.exe by creating a transacted section to be mapped in the remote process. Subsequently, the malware injects a fourth-stage shellcode into logagent.exe by loading and hollowing another instance of mshtml.dll into the target process. The injected fourth-stage shellcode performs the aforementioned hook bypass technique before executing the final payload previously allocated by the transacted section.

Transacted Section Hollowing

Similarly to process doppelgänging, the goal of a transacted section is to create a stealthy malicious section inside a remote process by overwriting the memory of the legitimate process with a transaction. In this sample, the third-stage shellcode executed inside cmd.exe places a malicious transacted section used to host the final payload in the target child process logagent.exe. The shellcode uses the following:

  • NtCreateTransactionto create a transaction
  • RtlSetCurrentTransaction and CreateFileW with a dummy file name to replace the documented  CreateFileTransactedW
  • Heaven’s Gate to call NtWriteFilein a loop, writing the final shellcode to the file in 1,024-byte chunks
  • Creation of a section backed by that file (Heaven’s Gate call NtCreateSection)
  • A rollback of the previously created section by using Heaven’s Gate to call  NtRollbackTransaction

Existing similar implementations have publicly been observed in this project that implements transaction hollowing.

Once the transacted section has been created, the shellcode generates a function stub at runtime to hide from static analysis. This stub contains a call to theCreateProcessW API to spawn a suspended child process logagent.exe (c50bffbef786eb689358c63fc0585792d174c5e281499f12035afa1ce2ce19c8) that was previously dropped by cmd.exe  under the %TEMP% folder.

After the target process has been created, the sample uses Heaven’s Gate to:

  • Read its PEBby calling NtReadVirtualMemory to retrieve its base address (0x400000)
  • Unmap the exe image in the logagent.exe process by using  NtUnMapViewofSection
  • Hollow the previously created transacted section inside the remote process by remapping the section at the same base address (0x400000) with NtMapViewofSection

Process Hollowing

After the third-stage shellcode within cmd.exe injects the final Cobalt Strike payload inside the transacted section of the logagent.exe process, it continues by process hollowing the target process to write the fourth shellcode stage ultimately used to execute the final payload (loaded in the transacted section) in the remote process. The third-stage shellcode maps the legitimate Windows DLL C:\Windows\SysWOW64\mshtml.dll in the target process before replacing its .text with the fourth-stage shellcode and executing it via NtResumeThread.

This additional fourth-stage shellcode written to logagent.exe performs similar evasion activities to the third-stage shellcode executed in cmd.exe (as indicated in the hook bypass section) before passing execution to the final payload.

Indicators of Compromise (IOCs)

File SHA256
streaming_client.exe 6f345b9fda1ceb9fe4cf58b33337bb9f820550ba08ae07c782c2e142f7323748

MITRE ATT&CK Framework

The following table maps reported HijackLoader tactics, techniques and procedures (TTPs) to the MITRE ATT&CK framework.

ID Technique Description
T1204.002 User Execution: Malicious File The sample is a backdoored version of streaming_client.exe, with the Entry Point redirected to a malicious stub.
T1027.007 Obfuscated Files or Information: Dynamic API Resolution HijackLoader and its stages hide some of the important imports from the IAT by dynamically retrieving kernel32 and ntdll API addresses. It does this by parsing PEB->PEB_LDR_DATA  and retrieving the function addresses.
T1016.001 System Network Configuration Discovery: Internet Connection Discovery This variant of HijackLoader connects to a remote server to check if the machine is connected to the internet by using the  WinHttp API (WinHttpOpenRequest and WinHttpSendRequest).
T1140 Deobfuscate/Decode Files or Information HijackLoader utilizes XOR mechanisms to decrypt the downloaded stage.
T1140 Deobfuscate/Decode Files or Information HijackLoader utilizes RtlDecompressBuffer to LZ decompress the downloaded stage.
T1027 Obfuscated Files or Information HijackLoader drops XOR encrypted files to the %APPDATA% subfolders to store the downloaded stages.
T1620 Reflective Code Loading

 

HijackLoader reflectively loads the downloaded shellcode in the running process by loading and stomping the mshtml.dll module using the LoadLibraryW and VirtualProtect APIs.
T1106 Native API

 

HijackLoader uses direct syscalls and the following APIs to perform bypasses and injections: WriteFileW, ReadFile, CreateFileW, LoadLibraryW, GetProcAddress, NtDelayExecution, RtlDecompressBuffer, CreateProcessW, GetModuleHandleW, CopyFileW, VirtualProtect, NtProtectVirtualMemory, NtWriteVirtualMemory, NtResumeThread, NtSuspendThread, NtGetContextThread, NtSetContextThread, NtCreateTransaction, RtlSetCurrentTransaction, NtRollbackTransaction, NtCreateSection, NtMapViewOfSection, NtUnMapViewOfSection, NtWriteFile, NtReadFile, NtCreateFile and CreatePipe.
T1562.001 Impair Defenses: Disable or Modify Tools HijackLoader and its stages use Heaven’s Gate and remap x64 ntdll to bypass user-space hooks.
T1055.012 Process Injection: Process Hollowing HijackLoader and its stages implement a process hollowing technique variation to inject in cmd.exe and logagent.exe.
T1055.013 Process Injection: Process Doppelgänging The HijackLoader shellcode implements a process doppelgänging technique variation (transacted section hollowing) to load the final stage in logagent.exe.
Continue Reading

Cyber Security

Netskope Joins Google Workspace Security Alliance

Published

on

Netskope has joined the Google Workspace Security Alliance to extend security and data protection for Workspace users. The Netskope One Platform provides a number of advanced security capabilities that protect data, defend against threats, and ensure users have fast and secure access to Google Workspace productivity and collaboration tools, including Gemini for Workspace.

As organizations increasingly adopt cloud technologies to drive innovation and efficiency, they are also challenged to secure sensitive data from a range of cyber risks, including:

  • Ongoing increases in the number of users uploading sensitive data to personal instances of cloud applications
  • New and evolving threat techniques such as abuse of certain applications for critical data access, back doors, and financial gain; compromise of credentials to access critical business data; insider threats; and more
  • Data exposure from the insecure use of both managed and unmanaged AI-based productivity tools

Netskope and Google Workspace empower organizations to embrace modern collaboration and productivity by enabling the secure use of AI-based productivity tools. Netskope provides advanced data loss prevention (DLP) techniques, delivering real-time visibility and control over users, data, and corporate vs. personal cloud instances. In addition, Netskope’s comprehensive threat protection through both API and inline controls detects threats in Google applications and monitors data movement and threat propagation between Google Workspace apps and third-party ecosystem applications.

“Netskope is proud to expand its partnership with Google Workspace by joining the Workspace Security Alliance. There are already thousands of customers using Netskope to safeguard their Google Workspace applications, and this new partnership further enhances the secure usage capabilities for application specific data protection policies,” said Andy Horwitz, VP, Global Partner Ecosystems, Netskope. “Together, Netskope and Google Workspace can help customers modernize their productivity stack. We look forward to helping customers safely optimize their employees’ daily productivity.”

The Netskope and Google Workspace partnership enables organizations to embrace collaboration and productivity while safeguarding critical data. Joint customers can now more effectively:

  1. Support best practice use of Gemini for Google Workspace: Leverage real-time user coaching to help enforce best practices in application usage. Organizations can gain visibility into data movement to minimize sensitive information sharing while achieving data compliance objectives.
  2. Protect sensitive data: Detect and manage access to sensitive data within Google Workspace applications, enforcing policies to prevent unauthorized data movement across platforms, including third-party services like Microsoft OneDrive, Box and Dropbox.
  3. Stop insider threats like data exfiltration: Prevent the download of sensitive data from Google Workspace business instances and then the upload to personal instances, which is one of today’s top reasons for data loss. Additionally, apply this control to unmanaged devices: allow unmanaged or personal device access to a specific cloud app for collaboration, however, do not allow downloading of sensitive data.
  4. Detect and stop elusive threats and malware: Protect against malware and phishing delivered from the cloud. Netskope’s multi-layered advanced threat protection (ATP) enhances security within Google Workspace and across cloud applications.
  5. Maintain compliance in Google Workspace: Ensure that organizations can adhere to regulations and meet compliance needs by enforcing security policies within Google Workspace.

“By partnering with Netskope, a leading SASE vendor, customers can confidently expand their Google Workspace adoption leveraging their existing IT infrastructure investments,” said Nikhil Sinha, Group Product Manager, Google Workspace. “Netskope instance awareness enables fine grained data governance policy differences to both corporate and personal Google Workspace accounts. We are excited to partner with Netskope to provide these advanced security capabilities to our customers.”

Continue Reading

Channel Talk

AmiViz and BitSight Join Forces to Elevate Middle East Risk Management

Published

on

AmiViz has partnered with Bitsight, a leading provider of cyber risk management solutions. This collaboration marks a significant step forward in bolstering cybersecurity capabilities across the region and facilitating Bitsight’s expansion efforts in the Middle East.

The partnership between AmiViz and Bitsight will enhance the cybersecurity landscape in the Middle East by introducing state-of-the-art solutions designed to tackle the evolving cyber threats confronting regional organizations. With both companies committed to improving cybersecurity awareness and resilience, they are set to pave the way for a safer and more secure digital environment in the region.

Commenting on the partnership with Bitsight, Ilyas Mohammed, COO at AmiViz said, “Our decision to onboard Bitsight demonstrates our commitment towards the evolution of the cybersecurity landscape in the Middle East. As organizations grapple with increasingly sophisticated cyber threats, the partnership between these two industry leaders promises to deliver enhanced value by equipping organizations with the tools and insights needed to effectively manage cyber risks and safeguard their digital assets in an ever-evolving threat landscape.”

Bitsight’s solutions can proactively assess and manage their cyber risk exposure and provide organizations with actionable intelligence to optimize their security investments, streamline vendor risk management processes, and enhance cyber resilience. With a focus on continuous monitoring and data-driven insights, Bitsight empowers organizations to make informed decisions and stay ahead of emerging cyber threats.

The Middle East has often been an attractive target for cyber-attacks, and this partnership will empower companies to address vulnerabilities and protect their digital assets proactively. By combining AmiViz’s deep understanding of the regional market dynamics with Bitsight’s cutting-edge technology and global expertise, the partnership will offer next-generation cybersecurity solutions tailored to the unique challenges and requirements of Middle Eastern organizations.

“We are proud to partner with AmiViz to transform the cyber risk management landscape in the Middle East,” said Xavier Artiguebieille, Senior Vice President, EMEA Sales at Bitsight. “Our combined efforts will equip organizations with the critical tools and intelligence needed to navigate and mitigate the complexities of modern cyber threats, enhancing their overall security and resilience.”

Continue Reading

Artificial Intelligence

ESET’s New AI Assistant Streamlines Threat Detection and Response

Published

on

ESET has introduced ESET AI Advisor, an innovative generative AI-based cybersecurity assistant that transforms incident response and interactive risk analysis. First showcased at RSA Conference 2024, the new solution is now available as part of the ESET PROTECT MDR Ultimate subscription tier and ESET Threat Intelligence.

Unlike other vendor offerings and typical generative AI assistants that focus on soft features like administration or device management, ESET AI Advisor seamlessly integrates into the day-to-day operations of security analysts, conducting in-depth analysis. Building on over two decades of ESET’s expertise in AI-driven endpoint protection, the offering provides detailed incident data and SOC team-level advisory. This is a game-changer for companies with limited IT resources who want to utilize the advantages of advanced Extended Detection and Response (XDR) solutions and threat intelligence feeds.

“As cybersecurity threats become increasingly sophisticated, ESET remains committed to providing cutting-edge solutions that address these challenges. The ESET AI Advisor module represents a significant leap forward in our mission to close the cybersecurity skills gap and empower organizations to safeguard their digital assets effectively,” said Juraj Malcho, Chief Technology Officer at ESET.

One of the primary benefits of this new solution is closing the cybersecurity skills gap. Security analysts of all skill levels can use ESET AI Advisor to conduct interactive risk identification, analysis, and response capabilities, which are provided in an easily understandable format. The user-friendly interface makes sophisticated threat data actionable even for less experienced IT and security professionals.

The ESET AI Advisor also excels in facilitating faster decision-making for critical incidents. Security analysts can simply consult the ESET AI Advisor to understand the specific threats their environment faces. Leveraging extensive XDR collected data, the ESET AI Advisor identifies and analyzes potential malware threats, providing intuitive insights into their behaviour and impact. It assists in recognizing phishing attempts and advising users on how to avoid falling victim to fraudulent emails or websites. By monitoring network traffic, the ESET AI Advisor can flag unusual or suspicious behaviour, helping security teams take appropriate action. Its ability to automate repetitive tasks is an additional advantage. Managing routine processes such as data collection, extraction, and basic threat detection, allows security teams to focus on more strategic initiatives.

In ESET Threat Intelligence, the new module will help researchers analyze vast quantities of unique APT reports and understand latest developments in world of cyber threats. With its conversational prompts and interactive dialogue, ESET AI Advisor empowers organizations to analyze and mitigate threats effortlessly and fortify their cybersecurity posture.

Continue Reading
Advertisement

Follow Us

Trending

Copyright © 2021 Security Review Magazine. Rysha Media LLC. All Rights Reserved.