Patrick Staubmann - TA577從你身邊走過 - Pikabot中的間接系統調用.pdf

《Patrick Staubmann - TA577從你身邊走過 - Pikabot中的間接系統調用.pdf》由會員分享，可在線閱讀，更多相關《Patrick Staubmann - TA577從你身邊走過 - Pikabot中的間接系統調用.pdf（30頁珍藏版）》請在三個皮匠報告上搜索。

1、TA577 Walked Just Past YouIndirect Syscalls in PikabotPatrick StaubmannTeam Lead Threat AnalysisVMRay GmbH2Pikabot OverviewFirst SeenClassificationThreat ActorEvasion TechniquesEarly 2023(Down-)LoaderBackdoorTA577(Water Curupira)Well known for distributing QBotDistribution of Black Basta ransomwareI

2、ndirect System Calls3A closer look to PikabotLoading core modulePikabot went dark in 2024 (Operation Endgame).Butwe may see“powered-up”variants with enhanced loader and core modules.LoaderC2 CommunicationInjector(PE&Shellcode)Command ExecutionData Collection/FingerprintingCore Module4Pikabots Evasio

3、n TechniquesHardware-based EvasionTiming-based EvasionLimited ResourcesMore than 2 CPU Cores?At least 2 GB of memory?Sleep for certain time to hide behaviorUncommon API to pause executionBeep()5UncoveringIndirect Syscalls6WINDOWS API7From User Mode to Kernel ModeUSER MODEKERNELsample.exe.instruction

4、.instruction.call CreateFileWkernelbase.dllCreateFileW.instruction.instruction.call NtCreateFilentdll.dllNtCreateFile.instruction.instruction.syscall8kernelbase.dll(cont.).instructions.call NtCreateFileEDR(inline)Monitor HooksUSER MODEKERNELsample.exe.instruction.instruction.call CreateFileWkernelba

5、se.dllCreateFileWjmp edr.dllntdll.dllNtCreateFile.instruction.instruction.syscalledr.dll(hook)Monitor API Call9NATIVE FUNCTIONS10Using Native FunctionsUSER MODEKERNELsample.exe.instruction.instruction.call NtCreateFilekernelbase.dllCreateFileW.instruction.instruction.call NtCreateUserProcessntdll.dl

6、lNtCreateFile.instruction.instruction.syscall11Calling Native Functions12Avoiding Native FunctionsUSER MODEKERNELsample.exe.instruction.instruction.?kernelbase.dllCreateFileW.instruction.instruction.call NtCreateFilentdll.dllNtCreateFile.instruction.instruction.syscall?13DIRECT SYSCALLS14How are nat

7、ive functions implemented?USER MODEKERNELsample.exe.instruction.instruction.call NtCreateFilekernelbase.dllCreateFileW.instruction.instruction.call NtCreateFilentdll.dllNtCreateFile.instruction.instruction.syscall?15NtCreateFile in ntdll.dll16Direct Syscall17Using Direct SyscallsUSER MODEKERNELsampl

8、e.exemov r10,rcxmov eax,NtCreateFile.idsyscall.instruction.18INDIRECT SYSCALLS19Indirect SyscallsUSER MODEKERNELsample.exe.instruction.mov eax,idjmpntdll.dllNtCreateFilesyscall20Syscall Offset+0 x03+0 x08+0 x10+0 x1221Indirect Syscall22INDIRECT RANDOM SYSCALLS23Indirect Random SyscallsUSER MODEKERNE

9、Lsample.exe.instruction.mov eax,NtCreateFile.idjmpntdll.dllNtCreateAtomAsyscall24Indirect Random Syscall25SysWhispers2https:/ next?VEX&Syscalls(Vectored Exception Handling)ROP&Syscalls(Return Oriented Programming)Call Stack Spoofing2828TakeawaysPikabot29Key TakeawaysContemporary malware families are still focusing on circumventing sandboxes and EDRs with sophisticated techniques.Cat and mouse game:Malware will get better at camouflaging(in)direct syscalls,defenders need to stay up-to-date.Different implementations of syscall-based evasion techniques are on the rise.Q&AThank you.