When the threat actors behind the #RansomHub #ransomware want to attack a target, they go to some lengths to prevent EDR or endpoint protection software from ruining their day.
The latest blog from #Sophos #XOps investigates how they do that, using a tool we call #EDRKillShifter
Threat actors deploy the tool, then execute it using a password as a command line argument to the program.
They went to extraordinary lengths to conceal the function of the tool, even building in polymorphic code that modifies the next subroutine as it runs, revealing the next instruction only after the prior line of code executes. 3/
As it executes, #EDRKillShifter loads an embedded, encrypted resource into memory. That code extracts the next layer of tool, the abusable #BYOVD driver and a #Go binary.
It uses a SHA-256 hash of the initial password (used to execute the tool) as a decryption key for these second-layer payloads. 4/
The two drivers we've seen abused are known in the industry as #BYOVD payloads. One is a file called RentDrv2 (hosted on https://github.com/keowu/BadRentdrv2) and the other is named ThreatFireMonitor (also on Github, with a proof of concept at https://github.com/BlackSnufkin/BYOVD/tree/main/TfSysMon-Killer).
No matter which driver gets used, #EDRKillShifter writes them out to the %temp% directory using a random 10-digit filename. 5/
A vulnerable driver exploited by me (BYOVD) that is capable of terminating several EDRs and antivirus software in the market, rendering them ineffective, working for both x32 and x64(CVE-2023-44976...
Sophos currently detects EDRKillShifter as Troj/KillAV-KG. In addition, behavioral protection rules that protect against defense evasion and privilege escalation block these system calls from going through. #EDRKillShifter is a dud on boxes we protect. /end
Sophos X-Ops