di_blog_post

Deep Instinct prevents more advanced threats than any EPP or EDR in the world.

Deep Instinct Blog: Breaking News and Updates

Prevention Platform

Prevention for Applications

Prevention for Endpoints

Products

Prevent Ransomware

Prevent Zero-Day Attacks

Improve EPP Efficacy

Extend & Enhance EDR

Stop Fileless Attacks

Solutions

Deep Learning in Cybersecurity

Our Customers

+ MS Defender

VS Traditional Antivirus

Why Deep Instinct

About Deep Instinct

Newsroom

Careers

Contact Us

Company

Asset Library

Blog

Videos

Training

Resources

Request Demo

Customer Portal

Integrations and Compliance

Quick links

Events & Webinars

Leadership Team

Board of Directors

Partners

Login

content_block

Perspective & Findings

<h4>Don’t Let Application File Uploads Become Malware Downloads</h4>

file-upload-security-blog.jpg

Recent Blog Posts

Listing preview

Perspective & Findings

image_media_card

Recent Blog Posts

listing_preview

BPFDoor Malware Evolves – Stealthy Sniffing Backdoor Ups Its Game

Who is the only NEW vendor in the 2022 Gartner® Magic Quadrant™ for Endpoint Protection Platforms?

ChatGPT and Malware: Making Your Malicious Wishes Come True

Top-3 Drawbacks of Content Disarm + Reconstruction (CDR) for Malware Prevention

LSASS Memory Dumps are Stealthier than Ever Before

LSASS memory dumps

Trending at Deep Instinct

carousel_cards

Arid-Gopher.jpg

What is Arid Gopher? An Analysis of a New, Never-Before-Seen Malware Variant

Understanding and Preventing Re-Entry Abuse Blog

API-blog.png

Cybercriminals have developed a diverse toolset to uncover vulnerabilities and repurpose existing software features to find entry points through cyber defenses. In this blog, we’ll explore a new way to exploit reentrancy that can be used to evade the behavioral analysis of EDR and legacy antivirus products.While the technique we’ll examine focuses on a single-hooked API, this method of evasion can be used against almost any antivirus tool’s hooks by reverse-engineering the AV product to allow a bypass and custom-tailoring the bypass method.Most antivirus and <a href="https://www.deepinstinct.com/endpoint-detection-response" target="_self">endpoint detection and response (EDR)</a> products focus on scanning and detection, with some leveraging additional capabilities on top of their file scanning mechanism to detect malicious activity.One of these capabilities involves tracking processes in-memory through behavioral analysis or heuristics. In short, the antivirus solution will detect or prevent certain behaviors that are deemed to be malicious, such as dumping credentials from memory or injecting code into another process. Finding these malicious activities helps the antivirus software detect a threat that isn’t caught by the file-scanning capability. It is also useful when the file hash is not blacklisted, or the <a href="https://www.deepinstinct.com/prevent-fileless-malware" target="_self">attack is fileless</a>.In order to find malicious behavior in process, an antivirus product will usually have its own DLL loaded into every process via its signed kernel driver on process startup. Once loaded, this DLL will then place hooks on the APIs that require tracking.For code injection, kernel32.dll’s functions including “CreateRemoteThread,” “VirtualAllocEx,” and “WriteProcessMemory” will most frequently be used. Most of the time security vendors will prefer to hook the lowest-level API possible, such as hooking “NtWriteVirtualMemory” inside ntdll.dll instead of “WriteProcessMemory.” This is done for programs that do not call the higher-level APIs, which can limit the heuristics’ ability to catch malicious behavior.<h5>What is Inline Hooking?</h5>Userland hooks is a very popular way for antivirus tools to inspect the behavior of a process. Hooking is the process of intercepting a function call. As the guardian of the endpoint, intercepting calls to various APIs allows the antivirus product to not only detect, but also to prevent unwanted or suspicious activity. This is done most by inline hooking (sometimes known as detouring).<img data-image="qlu9mb7yhm24" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt2713eaae59a43747/6178faf63ce65615842b4220/image.png" data-sys-asset-uid="blt2713eaae59a43747" alt="image.png"/><h5>Hooking and Reentrancy</h5>A very common problem that occurs when hooking Windows APIs is reentrancy. This occurs when a thread calls a hooked API, and the hook then calls another hooked API, or even that same hooked API (either directly or indirectly). This process can lead to unnecessary overhead—and can also lead to an infinite recursion.Reentrancy issues are a significant challenge for antivirus tools because using hooks on every single process can cause severe stability issues, freezing, and other performance problems. A common approach to this is to be careful about what code to write in the hook itself and make sure to not call any other API (directly or indirectly); this method limits what behaviors can be monitored. However, a more elegant solution is simply to check for reentrancy. In this approach the hook’s trampoline will be called directly if reentrancy is detected, skipping whatever checks and logic the hook usually goes through in its process.Below is a diagram to show the flow of a reentrancy-friendly hook:<img data-image="51fqvdrot7c9" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt4afc4f4f72a4f7c3/6178fb1f5ae6d31579c1be3a/image.png" data-sys-asset-uid="blt4afc4f4f72a4f7c3" alt="image.png"/><h5>Technical Explanation</h5><h6>Locating Hooks</h6>For this next section we will play the part of the attacker and walk through the steps that one would take to evade antivirus with one line of code.The first step to locate a hook is to determine what APIs are hooked. <a href="https://guidedhacking.com/resources/hookshark-hookshark64-download.30/" target="_self">HookShark</a> is a terrific tool to detect inline hooking. It provides a quick way to find what APIs a security vendor hooks.<img data-image="njhdtuf14rv8" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltdfd1a29b7a2f5fbe/6178fb2fece6b40b35072700/image.png" data-sys-asset-uid="bltdfd1a29b7a2f5fbe" alt="image.png"/>For this example, when Notepad is launched, pressing “Scan this process” shows these results:<img data-image="iku7flg2ammy" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt20ca12233b5bb43d/6178fb42c05249199df194b2/image.png" data-sys-asset-uid="blt20ca12233b5bb43d" alt="image.png"/>An API that caught our attention is NtWriteVirtualMemory, which is used for process injection techniques. As the attacker, we will determine if the antivirus would detect the attempt at process hollowing (using the project here:<a href="https://github.com/m0n0ph1/Process-Hollowing" target="_blank"> https://github.com/m0n0ph1/Process-Hollowing</a>). As we can see, it was detected:<img data-image="m6avs4uscsv0" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt85cd92a33044918f/6178fb542378d322b063398c/image.png" data-sys-asset-uid="blt85cd92a33044918f" alt="image.png"/>The second step is to determine where the hook sits. Luckily for us, the hook is inside the antivirus’ injected DLL – aswhook.dll.<img data-image="xwjvyni4jd2m" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt530b79ae942221b3/6178fb60ece6b40b35072704/image.png" data-sys-asset-uid="blt530b79ae942221b3" alt="image.png"/><img data-image="3uch38rnstqh" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt3920462f2ededd08/6178fb7e412fb409f16bf8b9/image.png" data-sys-asset-uid="blt3920462f2ededd08" alt="image.png"/><h6>Disassembling the Hook</h6>Now that we know what file to disassemble, it should be very easy to open IDA and locate the hook.This is the function as seen in IDA:<img data-image="a8hpdtk536pb" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt8d59730b365dd078/6178fb929778eb18575b37e8/image.png" data-sys-asset-uid="blt8d59730b365dd078" alt="image.png"/>Now, we know this a hook for the function “NtWriteVirtualMemory,” so this should be what the API looks like:<pre>NTSTATUSNtWriteVirtualMemory( INHANDLEProcessHandle, INPVOIDBaseAddress, INPVOID Buffer, INULONGNumberOfBytesToWrite, INOUTPULONGNumberOfBytesWritten);</pre> Now, we can simply change the function’s definition and name: <img data-image="yz89k4qxtzeb" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blta35bc5a196d2f85f/6178fbaa16d29a13daa7b192/image.png" data-sys-asset-uid="blta35bc5a196d2f85f" alt="image.png"/>This will be easier to disassemble now that we know the type definitions of all the arguments.The hook looks like this:<img src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltf4c058861f81b164/6179ae76c1c6cd50df579a20/blog-hook-start.jpg" height="auto" data-image="xit6w3385p4q"/>Here is the decompiled version:<img data-image="zetg0s7fuggd" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltf80cea3fba15f9da/6178fc2c9778eb18575b37f2/image.png" data-sys-asset-uid="bltf80cea3fba15f9da" alt="image.png"/>As we can see, there are four conditional jumps being made before the hook logic starts. At least one of them should be the reentrancy check. If any of the conditions are met, the trampoline will be called directly, skipping the logic of the hook. As we see in the first screenshot, the first conditional jump checks whether ProcessHandle is a pseudo-handle (-1) to the current process. Since that isn’t very helpful, let’s see what the three other conditions are.<img data-image="7k0ht03xwr7u" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt4b279d09d0983587/6178fc3ab3a30224326378ca/image.png" data-sys-asset-uid="blt4b279d09d0983587" alt="image.png"/>As we see in this screenshot, var_4 is a pointer to an integer. If sub_10006820 returns something other than 0x0, or if var_4 is NULL or the value inside var_4 is 0x1, a conditional jump will occur.We can deduce that sub_10006820 sets the value of var_4, probably according to the value stored in dword_10008060. Let’s disassemble it:<img data-image="mopkmovtw3jb" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt04762957afbb5612/6178fc447569022433507d17/image.png" data-sys-asset-uid="blt04762957afbb5612" alt="image.png"/>First, we know inside fs:18h is the TEB (Thread Environment Block), so after we added “_TEB” struct definition to IDA, we can now see something pretty interesting:<img data-image="xf0f4audn54a" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltcc041fb9d5762845/6178fc5bc05249199df194b6/image.png" data-sys-asset-uid="bltcc041fb9d5762845" alt="image.png"/>In 0x10006837 we see that ecx is using an index in the TEB’s TlsSlots member. This refers to TLS – Thread Local Storage (see note #1).The TEB.TlsSlots array size is 64. But what if a program wants to allocate a TLS slot in the 65th index? In 0x1000682F, we see ecx being compared to the value 64. So, this translates roughly to the following C code:<pre>if (*dword_10008060 &lt;= 64) *arg_4 = TEB.TlsSlots[dword_10008060];</pre> In 0x10006844 ecx is being compared to 1088. IDA doesn’t offer any known constants for this seemingly arbitrary value. If we continue with the disassembly, however, this makes more sense:<img data-image="w4ww493td64s" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt0fcea1f8e2acbc93/6178fc7e2d2c9113dd588eeb/image.png" data-sys-asset-uid="blt0fcea1f8e2acbc93" alt="image.png"/>The instruction at 0x10006853 refers to edx again, which we know to be a pointer to TEB. This means that [edx+0F94h] translates to TEB.TlsExpansionSlots.Going back to the previous question – if a program calls TlsAlloc() after all the slots of the TEB.TlsSlots array are already allocated, TlsAlloc() will internally allocate memory on the heap via RtlAllocateHeap() and set TEB.TlsExpansionsSlots member to that allocated memory’s address. This gives the thread an additional 1024 TLS slots it can use. If there’s an attempt to write to a TLS slot whose index is above 64, it will write to the allocated memory on the heap instead of the TEB.TlsSlots array.So, now the number 1088 makes sense – it’s just the result of 1024 (number of available slots in the TlsExpansionSlots that are stored on the heap) + 64 (number of available slots in the TlsSlots that are stored directly inside the TEB). So, if the value stored in dword_10008060 is above 1088, it’s considered an illegitimate index.While we may be tempted to propose a solution where our malicious program allocates all the 1088 TLS slots in order for this subroutine to return STATUS_INVALID_PARAMETER, this solution isn’t possible because the vendor’s DLL allocates an index once it loads into the process, which is too early for us to intercept.Back to the code – if the conditional jump at 0x1000685B happens, the value inside arg_4 will be set to 0x0. This roughly translates to the following C code:<pre>if (TEB.TlsExpansionSlots == NULL) *arg_4 = 0x0;</pre> So now that we know how the value arg_4 is set, we can go back here:<img data-image="0rsb3lqfu4py" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltd3902f1a8e117fe7/6178fd199778eb18575b37f6/image.png" data-sys-asset-uid="bltd3902f1a8e117fe7" alt="image.png"/>We now know that var_4 is the value stored in the TLS slot, so we’ll rename it TlsValue. We also know dword_10008060 is a pointer to a TLS index, so we’ll rename it g_TlsIndex.This roughly translates to the following C code:<pre>PDWORD TlsValue; if (sub_10006820(g_TlsIndex, TlsValue) == 0 || TlsValue == NULL || *TlsValue == TRUE) // Skip the hook’s logic</pre> The instruction at 0x10002A81 sets the value stored at *TlsValue to 0x1. Later, we can see this value is set back to 0x0 (at 0x10002ABF): <img data-image="yxo9igmaljsn" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltf88cbaed666d5114/6178fd2f5ae6d31579c1be54/image.png" data-sys-asset-uid="bltf88cbaed666d5114" alt="image.png"/>To recap, the security vendor accesses a TLS slot via a global variable to store an address which points to a Boolean value, which, if set to FALSE will cause the code to perform the hook’s logic, and if it is TRUE, it will skip it and go straight to the trampoline. Once it finishes doing the hook’s logic it will reset the Boolean value back to FALSE.<h6>Exploiting the Reentrancy Mechanism</h6>If the g_TlsIndex is above 64, TlsExpansionSlots must be set to NULL so that TlsValue will also be set to NULL. If g_TlsIndex is 64 or below. TlsValue should be NULL or the Boolean value in the address stored inside of it must be set to TRUE.Without knowing the value of g_TlsIndex we have no way of knowing which TLS slot to manipulate, so what should we do?Our solution is to set all of the TLS slots and TlsExpansionSlots to NULL temporarily before a call to NtWriteVirtualMemory, and once we return from that call, we can restore all the TLS slots to their previous state. This is an easy solution that can be integrated with any malicious code; we simply have to slightly modify the source code of whatever offensive tools we want to use.A more elegant solution would be to use a C++ object that will be allocated on the stack. What it will do in its constructor is back up the values of all the TLS slots and the pointer of TlsExpansionSlots and then set them all to NULL, and once its destructor is called then it will restore the original values of all of the TLS slots and the pointer of TlsExpansionSlots.This action looks like this:<img data-image="4qll4tu9b605" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltb65f93615bb6886a/6178fd3fb3a30224326378ce/image.png" data-sys-asset-uid="bltb65f93615bb6886a" alt="image.png"/>Whenever we want to call an API that we know is hooked, we will simply create a block of code around the call to that API. Creating a block of code guarantees that TlsKiller’s destructor will be called as soon as the hooked API is over. In our case we know that WriteProcessMemory ends up calling NtWriteVirtualMemory so we must put TlsKiller in the same block as WriteProcessMemory. For the sake of brevity one example is given:<img data-image="86n8g5ein5ab" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blte93574cc799398ba/6178fd4f3ce65615842b422c/image.png" data-sys-asset-uid="blte93574cc799398ba" alt="image.png"/>After re-compiling and running the executable, we get this:<img data-image="ln129groaw99" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blta1951d18dc9ccd06/6178fd58fdb9af22b36e3b86/image.png" data-sys-asset-uid="blta1951d18dc9ccd06" alt="image.png"/>No complaints from the Antivirus!<h6>One Line of Code to Evade Antivirus</h6>It seems that by simply adding one line of code before a call to a hooked API we were able to completely evade the antivirus tool’s behavioral analysis.Depending on which attacks the antivirus aims to prevent with its memory heuristics it is possible to bypass whatever defense they will put up, as long as they use the same method of checking for reentrancy in their hooks.Some antivirus products may devise their own methods to avoid reentrancy, and others might use TLS indexes too, which means they will also be susceptible to this attack. While they might do it differently (for example, not use the heap at all and just set the TLS slots as Boolean value or as an integer value), it will take very little effort to see if their hooks can be bypassed.Other antivirus solutions might devise an entire mechanism altogether. It should also be noted that not all of the hooks placed by an antivirus have a mechanism to avoid reentrancy (for example NtProtectVirtualMemory is hooked but no check is done for reentrancy), so it is important to know which functions are affected by this.<h5>Conclusion:</h5>While Antivirus products have a high detection rate when it comes to known malware, they often prioritize stability first, requiring them to be compatible with edge-cases and overall performance. This lessens their security posture and opens up myriad possibilities for attackers. Therefore, a feature which was intended for stability can be re-purposed as a bypass method and open a path for intrusion and compromise. Further research will shed more light on which features of an antivirus can be abused.If you’d like to learn more about Deep Instinct’s industry-leading approach to stopping malware, backed by a $3M guarantee, please download our new eBook, <a href="https://info.deepinstinct.com/tof/ransomware-prevention?_ga=2.190475299.904700770.1623078264-1598413446.1621950290" target="_self">Ransomware: Why Prevention is better than the Cure</a>.<h5>Note #1: TLS Slots</h5>TLS stands for “Thread Local Storage,” which some researchers might recognize by name as a known mechanism to run code before the PE’s entrypoint (TLS callbacks). This is, however, something else and unrelated.Thread Local Storage is exactly what it sounds like – a place for threads to store their own local information in the TEB.TlsSlots array, which is an array of void pointers called TLS slots. Basically, that means that every thread has its own array which it can fill with values as it sees fit.Since the mechanism is a bit more complicated than just accessing an array, there are 4 APIs that can be used for TLS:TlsAlloc() – Allocates an index for the TLS. This index will be considered reserved and can be used by any thread to get and set their local values in their TEB.TlsSlots.TlsFree(DWORD dwTlsIndex) – Releases the index allocated by TlsAlloc().TlsGetValue(DWORD dwTlsIndex) – Returns the value stored in the thread’s TEB.TlsSlots[dwTlsIndex].TlsSetValue(DWORD dwTlsIndex, LPVOID lpTlsValue) – Sets lpTlsValue as the value in TEB.TlsSlots[dwTlsIndex].<h5>References:</h5><ul><li><a href="https://docs.microsoft.com/en-us/windows/win32/procthread/thread-local-storage" target="_self">https://docs.microsoft.com/en-us/windows/win32/procthread/thread-local-storage</a></li><li><a href="http://www.nynaeve.net/?p=181" target="_self">http://www.nynaeve.net/?p=181</a></li><li><a href="https://github.com/microsoft/detours/wiki/OverviewInterception" target="_self">https://github.com/microsoft/detours/wiki/OverviewInterception</a></li></ul><h2>Further Reading:</h2><ul><li><a href="https://www.deepinstinct.com/blog/new-fileless-attacks-found-in-event-logs" target="_self">https://www.deepinstinct.com/blog/new-fileless-attacks-found-in-event-logs</a></li></ul>

Evading EDR Detection with Reentrancy Abuse

In a previous article, we detailed the numerous ways to dump LSASS memory for credentials extraction, in this article we show a new way to dump LSASS 

LSASS.png

In a previous article, we detailed the numerous ways to <a href="https://www.deepinstinct.com/2021/01/24/lsass-memory-dumps-are-stealthier-than-ever-before/" target="_blank" rel="noopener">dump LSASS memory for credentials extraction</a>, in this article we show a new way to dump LSASS without dropping any new tool on the endpoint.MITRE Technique: <a href="https://attack.mitre.org/techniques/T1003/001" target="_blank" rel="noopener">T1003.001</a><h2>Technical Overview</h2>There is a very neat way to cause WerFault.exe (Windows Error Reporting process that handles process crashes) to create a memory dump of lsass.exe, in a directory of your choice. The major advantage of this technique is that it does not cause lsass.exe to crash, and since WerFault.exe is used to create file dumps all the time (not just lsass.exe), this method provides the added advantage of going undetected. &nbsp;WerFault.exe is a process known for dumping every crashing process, from an attacker standpoint this is appealing as their illicit credential extraction will appear benign because from a defender’s viewpoint it’s within the realm of normal activity.This method relies on a mechanism introduced in Windows 7 called Silent Process Exit, which provides the ability to trigger specific actions for a monitored process in one of two scenarios; either the process terminates itself by calling ExitProcess(), or another process terminates it via the TerminateProcess() API.There are multiple actions that can be configured to occur upon a silent process exit:<ul><li>Launch a monitor process</li><li>Display a pop-up</li><li>Create a dump file</li></ul>Option #1 can be used as a <a href="https://oddvar.moe/2018/04/10/persistence-using-globalflags-in-image-file-execution-options-hidden-from-autoruns-exe/" target="_self">persistence mechanism</a>. For the purpose of this study, we describe how to use option #3 for dumping lsass.To set-up a process for silent exit monitoring, a few registry settings must be set:<ol><li style="list-style-type: none;"><ol><li>The GlobalFlag for the process’ Image File Execution Options must be set to include the flag</li></ol></li></ol>FLG_MONITOR_SILENT_PROCESS_EXIT (0x200)2. SilentProcessExit must be set by either:a. Global settings, under the key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExitb. Application-specific settings, under the key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\ProcessNameThe SilentProcessExit settings are set by registry values, for that purpose the interesting ones are the following:ReportingMode (REG_DWORD) – Bitwise OR of the following flags:<ul><li>LAUNCH_MONITORPROCESS (0x1) – Launch a monitor process</li><li>LOCAL_DUMP (0x2) – Create a dump file for the process that caused the termination and the process that was terminated</li><li>NOTIFICATION (0x4) – Display pop-up notification</li></ul>LocalDumpFolder&nbsp;(REG_SZ) – The directory where the dump files will be created. Default location is %TEMP%\Silent Process Exit.DumpType – Specifies the type of dump file (Micro, Mini, Heap or Custom) according to the MINIDUMP_TYPE enum. Full minidump is a value of MiniDumpWithFullMemory (0x2).So, what would happen if the SilentProcessExit registry settings are set so that LSASS.exe will dump itself, and then either lsass.exe is killed or the computer is shut down?To answer this, we use taskkill to terminate lsass. This brings up this message because Windows really doesn’t like to have lsass.exe shut down:<img class="alignnone wp-image-10632 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt9d077b90b18a1fa4/611a79bacc91a61675b04d67/2.1-Windows-pop-up.png" width="602" height="156" style="width: 602px; height: 156px;"/>A warning like this is problematic for an endpoint user to see during an attempt to gather credentials, but it does provide a new directory under C:\temp, which contains the full memory dump of lsass.<img class="alignnone wp-image-10636 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt1f9c6c4b66f26553/611a79b82ba0021687d2f437/2.2-Ctemp.png" width="602" height="100" style="width: 602px; height: 100px;"/>Nice!A dump of taskkill.exe is also obtained which normally isn’t accessible if the computer had been shut down, instead of terminating lsass.exe. This happened because the Silent Process Exit mechanism also causes the process that initiated the termination to be dumped as well.The question we now need to ask ourselves is – how is the process dumped? Thanks to <a href="https://www.hexacorn.com/blog/2019/09/19/silentprocessexit-quick-look-under-the-hood/" target="_blank" rel="noopener">Hexacorn's blog</a>, we know that when a process terminates it calls the RtlReportSilentProcessExit() API from ntdll.dll, which will communicate to the Windows Error Reporting service (WerSvc under WerSvcGroup) that the process is performing a silent exit. The WER service will then launch WerFault.exe which will do the dumping of the exiting process. The interesting thing to notice is that calling this API does not cause the process to exit. This prompted us to run this process on lsass.exe, to get the file dump, but without terminating lsass.Here is the function definition of RtlReportSilentProcessExit():<pre>&lt;span style="color: #119fc2;"&gt;NTSTATUS&lt;/span&gt;&lt;span style="color: #9d73c7;"&gt;(NTAPI&lt;/span&gt;* &lt;span style="color: #00ccff;"&gt;&lt;span style="color: #119fc2;"&gt;RtlReportSilentProcessExit&lt;/span&gt;&lt;span style="color: #000000;"&gt;)&lt;/span&gt;&lt;/span&gt; ( &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;span style="color: #9d73c7;"&gt;_In_&nbsp;&lt;/span&gt;&lt;span style="color: #119fc2;"&gt;HANDLE&lt;/span&gt; &nbsp;&nbsp;&nbsp; ProcessHandle, &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;span style="color: #9d73c7;"&gt;_In_&lt;/span&gt;&lt;span style="color: #119fc2;"&gt;NTSTATUS&lt;/span&gt; &nbsp; ExitStatus &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; );</pre>But what if we supply a ProcessHandle of LSASS.exe from OUTSIDE of LSASS?Calling RtlReportSilentProcessExit this way would require a handle to lsass.exe with PROCESS_VM_READ permissions and also need the SeDebugPrivilege privilege, otherwise, the dump file will be created but without any content. In addition, an x64 process is required to open a handle to an x64 lsass process.Using a program we have wrote that does just that, we can see here the dump file created:<img class="alignnone wp-image-10640 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt86403ffe090519e8/611a79b883a5a41684db9ed5/2.3-users-windows.png" width="602" height="204" style="width: 602px; height: 204px;"/>That’s great!Now, we can delete the unnecessary dump of our own process and send the lsass dump to our attacker server to have the credentials extracted.But can we go even further and force lsass.exe to create a dump of itself? Using CreateRemoteThread on lsass.exe, we were able to cause it to run RtlReportSilentProcessExit:<img class="alignnone wp-image-10628 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt0acecc8c4bcafef0/611a79ba9e3e001656bde9b0/2.4-Write-itself.png" width="602" height="152" style="width: 602px; height: 152px;"/>Voila, Lsass.exe’s own dump file!From an EDR standpoint, it will appear as though lsass.exe requested a dump of itself from WER. Since WER is the mechanism in Windows which is responsible for creating dump files anyway, it is likely to be whitelisted as a process that creates a dump file of lsass.exe in order to reduce false-positives.The code to perform both of these methods can be found in our <a href="https://github.com/deepinstinct/LsassSilentProcessExit" target="_blank" rel="noopener">GitHub repository</a>.<h3>Suggested Solutions</h3>In the following section, we detail the measures that can be taken to detect dumping of the lsass.exe process.Monitoring RegistrySet a rule of registry value creation of GlobalFlag:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsass.exeGlobalFlag&nbsp;&nbsp;&nbsp; REG_DWORD&nbsp;&nbsp;&nbsp; 0x200Note that GlobalFlag is a bitwise OR possibly numerous flags.The following registry key should also be monitored for creation and for changes:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\lsass.exeMonitor FilesSet a rule for file creation for anything with the following pattern of file name:&nbsp;“lsass*.dmp”RunAsPPLWindows enables the ability to launch the lsass.exe process as a Process Protected Light (PPL), which prevents any non-PPL process from using OpenProcess() to access lsass.exe. This neutralizes all methods described in this article (besides the full memory dump methods). The following registry value is required to be set:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; RunAsPPL&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; REG_DWORD 0x1&nbsp;The downside of this method is that setting lsass.exe prevents any third-party DLLs from loading into it, including known and benign authentication packages. If your organization utilizes some smart-card solution, for example, this is not an option.Due to the obscurity of this attack vector available AV and EDR solutions are not going to have these detection and mitigation configurations in place, rather they will need to be manually configured. In soon-to-be-delivered upcoming versions, Deep Instinct’s customers can expect to have <a href="https://www.deepinstinct.com/automatic-threat-analysis/" target="_blank" rel="noopener">automatic protection</a> from this technique within the credential dumping heuristic.<h2>Summary</h2>The numerous ways of dumping LSASS memory give attackers a range of options to stay undetected by antivirus products and EDRs. This new method that we have introduced to get a process dump of LSASS to disk, hasn’t been utilized before while the use of WER has the added benefit of making the illicit memory extraction appear benign. &nbsp;This creates a ripe opportunity for hackers, with the possibility of many security environments having the file dump process whitelisted.

LSASS Memory Dumps are Stealthier than Ever Before - Part 2

Domain, local usernames, and passwords that are stored in the memory space of a process are named LSASS (Local Security Authority Subsystem Service). 

Rarely analyzed on its own, but rather as part of a wider attack chain, this article provides an in-depth analysis of LSASS dumps as an attack vector. By aggregating multiple sources of information, it focuses on the numerous ways known today to retrieve a dump file of LSASS. In Part 2, we introduce a new method of LSASS dumps that was found to be particularly stealthy that was discovered in Deep Instinct’s threat research labs.<h2>What Are LSASS Memory Dump Files and How Do Attackers Use Them?</h2>Domain, local usernames, and passwords that are stored in the memory space of a process are named LSASS (Local Security Authority Subsystem Service). If given the requisite permissions on the endpoint, users can be given access to LSASS and its data can be extracted for lateral movement and privilege escalation.It is increasingly common to see LSASS memory dump files being sent over the network to attackers in order to extract credentials in a stealthier manner. The alternative is running Mimikatz on the endpoint which might cause it to be blocked or detected by the local antivirus software.In fact, LSASS dumps were observed in the highly pervasive <a href="https://www.deepinstinct.com/2019/07/12/trickbooster-trickbots-email-based-infection-module/" target="_blank" rel="noopener">Trickbot</a> campaign that necessitated the applied effort of the US Cyber Command to break the bot’s connections to the larger network. While at the same time, Microsoft along with other partners, had to resort to securing court orders to take control and bring down Trickbot’s command and control servers.Arguably, the most notorious tool in the Windows landscape for red teams and threat actors is Mimikatz, the tool used to extract usernames and passwords from LSASS. Benjamin Delpy, its creator, has thoroughly researched the authentication process in Windows, and released an open-source tool with the capability of extracting Windows credentials that are stored in the LSASS process. He does this either by reading the memory structures inside LSASS memory space or by reading a full memory dump file of LSASS.Read more about <a href="https://attack.mitre.org/techniques/T1003/001" target="_self">MITRE's LSASS Memory Dumping</a>. <h2>Known Methods for Dumping LSASS</h2>1. Microsoft-Signed ToolsOut of all the options available, using Microsoft-signed binaries is an extremely convenient way to stealthily get a memory dump of LSASS, especially when they are already present on the workstation. Using these methods can deter blue teams because something like ProcDump is problematic to add to a blacklist. All these tools end-up calling the API mentioned in the “Custom Dump Tool” section.2. Task ManagerThe built-in task manager has a dumping mechanism for processes:<figure style = "float: none;width: 213px;max-width:auto;"><img class="alignnone wp-image-10258 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt597da55c9ad60b0d/611a79e949650215ea9eb537/Dialog-box-to-dump-file.png" alt="Dumping LSASS in Task Manager" /></figure>A dialog will be displayed and the dump file will be located in the TEMP folder as &lt;process name&gt;.DMP:<figure style = "float: none;width: 220px;max-width:auto;"><img class="alignnone wp-image-10262 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltb499d2e2ffe25cbe/611a79e7844c89162405ee58/file-location-of-dump.png" alt="LSASS dumping file located in TEMP folder" /></figure>3. Process ExplorerThe Sysinternals tool ProcExp.exe tool can also be used for process dumping:<figure style = "float: none;width: 382px;max-width:auto;"><img class="alignnone wp-image-10250 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltef4fdefe66de155d/611a79ea2ba0021687d2f449/Sysinternal-tool.png" alt="LSASS dumping with Sysinternals and ProcExp.exe tools" /></figure>The dump file location and name (excluding extension, which must be .dmp) can be set with the “Save As” dialog.4. ProcDumpThe Sysinternals tool ProcDump.exe is probably the tool that is used the most by malware to dump the LSASS process to disk, due to its command-line capabilities and since it’s not used exclusively for dumping the LSASS process. While the “.dmp” extension is necessary, the rest of the dump file name can be controlled in the arguments:<figure style = "float: none;width: 602px;max-width:auto;"><img class="alignnone wp-image-10278 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltad928c22509cd691/611a79e5239eb216a30d1b42/ProcDump.png" alt="ProcDump tool for LSASS dumping" /></figure>5. ProcDump With Clone Flag<figure style = "float: none;width: 602px;max-width:auto;"><img class="alignnone wp-image-10274 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltf53b3ffc881f835c/611a79e6bb11b815dcedc6eb/ProcDump-with-clone-flag.png" alt="LSASS dumping: Use ProcDump to clone lsass.exe and dump the clone to a disk" /></figure>Using the “-r” switch causes ProcDump to create a clone of lsass.exe and to dump the clone to disk.6. SQLDumperSQLDumper.exe is included with both Microsoft SQL and Office and has the <a href="https://lolbas-project.github.io/lolbas/OtherMSBinaries/Sqldumper/" target="_blank" rel="noopener">ability to produce a full dump file</a>.<figure style = "float: none;width: 602px;max-width:auto;"><img class="alignnone wp-image-10286 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltfd88bad22850968e/611a79e075cc581671070676/SQL-Dumper.png" alt="LSASS dumping with SQLDumper" /></figure>The first parameter is the PID of the process to dump. The dump file will be located in the current directory (“C:\users\windows” in my case), and the dump file name will have a pattern of SQLDmprxxxx.mdmp.7. Comsvcs.dllThe “comsvcs.dll” can be found in every Windows system and has an export that can be used to <a href="https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dump-credentials-from-lsass-process-without-mimikatz" target="_self">dump processes by their PID</a>. This is also a very popular choice among malware authors. The command line should be written in the following way:rundll32.exe comsvcs.dll MiniDump &lt;lsass PID&gt; &lt;out path&gt; full<figure style = "float: none;width: 602px;max-width:auto;"><img class="alignnone wp-image-10254 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltbc3182c4fe5de2bc/611a79e9180e12166a5b4b7c/comsvcs.png" alt="Use Comsvcs.dll to dump LSASS files." /></figure>Note, that the process needs to have a debug privilege, and for that reason, PowerShell was used for this command.8. PowerSploit Out-MiniDumpOne of the modules of PowerSploit, <a href="https://raw.githubusercontent.com/mattifestation/PowerSploit/master/Exfiltration/Out-Minidump.ps1" target="_self">Out-MiniDump</a>, which is a Powershell-based penetration toolkit, has the option to create a process’ full memory dump:<figure style = "float: none;width: 452px;max-width:auto;"><img class="alignnone wp-image-10270 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltd441c07f69d130ea/611a79e65fe4021650f8a7dd/PowerSploit.png" alt="Dumping LSASS with PowerSploit Out-MiniDump" /></figure><h2>Other Signed Tools</h2>Process Hacker is another great tool for producing memory dumps:<figure style = "float: none;width: 249px;max-width:auto;"><img class="alignnone wp-image-10282 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt5e1a2d1697772a50/611a79e5207bb815f5885765/Process-Hacker.png" alt="How to create an LSASS dump file with Process Hacker" /></figure>A “Save File” dialog will be opened in which you can specify any filename you want, including the extension.<a href="https://info.deepinstinct.com/8-reasons-why-edr-is-not-enough" class="inline-block tracking-widder font-bold uppercase text-cta button_btn--square__qkto_ button_btn--yellow__9MFxXinline-block tracking-widder font-bold uppercase text-cta button_btn--square__qkto_ button_btn--yellow__9MFxX" style="text-decoration-line: none;text-decoration-thickness: initial;text-decoration-style: initial;text-decoration-color: initial;" target="_self">8 Reasons Why EDR Is Not Enough</a><h3>Full LSASS Memory Dump Options</h3>Dumping the entire RAM to disk is another way to get credentials out of LSASS. Although this tends to be less preferred because producing a full dump will take some time and take up a lot of space on disk, which is usually not desirable for attackers.1. Live memory dumpOut of all the options for full memory dumping listed here, this method is probably the most practical for an attacker. There are some signed kernel drivers that can go through the entire memory and dump it to disk. WinPmem for example is signed by Google and allows for the creation of a full memory dump. <a href="https://labs.f-secure.com/blog/rethinking-credential-theft/" target="_blank" rel="noopener">Physmem2profit</a> utilizes WinPmem with a C2 server to allow reading LSASS memory through the WinPmem driver, without dropping the full memory to disk.2. Hibernation fileThe hiberfil.sys can be copied with a tool like<a href="https://github.com/jschicht/RawCopy" target="_blank" rel="noopener"> RawCopy</a> to extract credentials with explanations available on how to <a href="https://diverto.github.io/2019/11/05/Extracting-Passwords-from-hiberfil-and-memdumps" target="_blank" rel="noopener">get the credentials out of the hibernation file</a>.3. VMEM/VMSN fileA full memory dump can be extracted from the memory file created when either taking a snapshot of a virtual machine or by suspending one. See an explanation of <a href="https://diverto.github.io/2019/11/05/Extracting-Passwords-from-hiberfil-and-memdumps" target="_blank" rel="noopener">how to extract LSASS credentials</a> from hibernation and VMEM files.<h2>Custom Dump Tool: How to Do a Manual LSASS Dump</h2>While the options above provide a good opportunity to get a dump file of LSASS, these tools can often be detected by their command line or output dump file. For example, ProcDump requires the “-ma” options, and Task Manager drops a file name “lsass.DMP” to the hard disk. These artifacts are incriminating, and a simple threat hunt can catch these activities. This makes it preferable to write a program that manually dumps the LSASS process (one tool that does this is <a href="https://github.com/outflanknl/Dumpert" target="_blank" rel="noopener">DumpErt</a>). Below, are two example methods of achieving this:1. MiniDumpWriteDump methodInside dbghelp.dll there’s a function called MiniDumpWriteDump, which is <a href="https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpapiset-minidumpwritedump" target="_self">&nbsp;</a>:<figure style = "float: none;width: 372px;max-width:auto;"><img class="alignnone wp-image-10266 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt0594c87a4359df44/611a79e83ad228160f2ddeb7/MiniDumpWriteDump.png" alt="how to do an lsass dump with MiniDumpWriteDump" /></figure>Internally, MiniDumpWriteDump uses the undocumented NtReadVirtualMemory API to read the process memory of its target.2. MiniDumpWriteDump + PssCaptureSnapshotSince opening a privileged handle to LSASS and passing it to MiniDumpWriteDump can be incriminating, a more stealthy method is to create a process snapshot of LSASS using the <a href="https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dumping-lsass-passwords-without-mimikatz-minidumpwritedump-av-signature-bypass" target="_blank" rel="noopener">PssCaptureSnapshot API</a>, which is also documented by MSDN. In fact, this method of process dumping is documented on its own page in <a href="https://docs.microsoft.com/en-us/previous-versions/windows/desktop/proc_snap/export-a-process-snapshot-to-a-file" target="_blank" rel="noopener">MSDN</a>.Every tool listed in all the previous categories of LSASS memory dumping uses one of these two methods (excluding the full memory dumping methods).<h2>Summary</h2>In this article, we have laid out all known methods of dumping the lsass.exe process for credential extraction. Since different EDRs have different ways of detecting a memory dump of lsass.exe, for IT security practitioners it serves to be aware of all the different methods to make sure all possible attempts are caught. Upon identifying one of the credential-stealing methods described here, the methods to mitigate this attack vector are detailed in the MITRE ATT&CK framework. However, with the release of Deep Instinct’s credential dumping heuristic in version 2.5 of our <a href="/product-overview/" target="_blank" rel="noopener">cybersecurity product</a>, all of our customers are protected from this type of malicious activity.Make sure to check out Part II of this series, where we introduce a <a href="/blog/lsass-memory-dumps-are-stealthier-than-ever-before-part-2" target="_blank" rel="noopener">new lsass.exe dumping method</a> that has never been analyzed before.<a href="https://info.deepinstinct.com/8-reasons-why-edr-is-not-enough" class="inline-block tracking-widder font-bold uppercase text-cta button_btn--square__qkto_ button_btn--yellow__9MFxXinline-block tracking-widder font-bold uppercase text-cta button_btn--square__qkto_ button_btn--yellow__9MFxX" style="text-decoration-line: none;text-decoration-thickness: initial;text-decoration-style: initial;text-decoration-color: initial;" target="_self">8 Reasons Why EDR Is Not Enough</a><h2>Further Reading:</h2><ul><li><a href="/blog/lsass-memory-dumps-are-stealthier-than-ever-before-part-2" target="_self">https://www.deepinstinct.com/blog/lsass-memory-dumps-are-stealthier-than-ever-before-part-2</a></li><li><a href="/blog/2022-cyber-threat-landscape-report" target="_self">https://www.deepinstinct.com/blog/2022-cyber-threat-landscape-report</a></li><li><a href="/blog/what-s-new-in-deep-instinct-3-0" target="_self">https://www.deepinstinct.com/blog/what-s-new-in-deep-instinct-3-0</a></li></ul>

Deep Instinct Included in the 2022 Gartner® Magic Quadrant™ for Endpoint Protection Platforms (EPP)