The final post
This blog is no longer active. For new posts, https://aibaranov.github.io/
A blog about rootkits research and the Windows kernel
Latest posts
Windows Rootkits (and Bootkits) Guide v2
The picture from the movie Elysium Hello folks and have a good day. If u follow my blog, u might know that my two previous blog posts discussed km malware - rootkits and bootkits - focusing on the Ring 0 tricks they employ and the timeline of their appearance. I'm excited to share version two of my research paper "Windows Rootkits Guide", now titled "Windows Rootkits and Bootkits Guide," which…
Windows Rootkits Guide
Glad to present my deep dive into Windows rootkit families from early concepts to the latest sophisticated instances. This is an attempt to summarize information about them and highlight the Windows Internals tricks they leverage to achieve the necessary goals. The document includes a lot of links to information sources that cover the necessary Windows Internals knowledge and rootkit TTPs, so if…
Windows Bootkits Guide
There are two main sections in the article, an infographic and web links to researches, samples and sources. The Year column indicates the year of the malware's appearance or when the information became public, Infection refers to the disk entity to be infected (Master Boot Record, UEFI, Volume Boot Record), the detection names of three security vendors and the purpose of the payload. ✨eEye…
Guntior - the story of an advanced bootkit that doesn't rely on Windows disk drivers
I first stumbled upon this interesting malware sample about a decade ago, being a contributor to the kernelmodeinfo forum . Amid the rise of bootkits at that time, the dropper was captured in-the-wild and posted on one of malware trackers. The malware was called "Guntior", after the device object its authors had chosen for it (\Device\Guntior). The name also appears in AV detections. At this time,…
GMER - the art of exposing Windows rootkits in kernel mode
📌 Chapters: Introduction Some basic terms Howto Exploring Win11 disk subsystem Set up a secure environment Overview of the driver Patching kernel data Securing disk I/O operations Securing file I/O operations Tracing kernel mode code About PPL'ed processes 📝 Introduction GMER is a well-known powerful anti-rootkit tool, which has been used for years by Windows IT pros to detect the presence of…
Ky1vstar cyberattack - under the hood of the malicious scripts
The attack overview In mid-December, it was revealed that a devastating cyberattack hit Ukr@ine's biggest telecommunications company. The attack disabled the company's services for days (!), leaving over twenty million Ukrainians without mobile communication and internet access. Ukrainian officials described the attack as having disastrous consequences, causing the complete destruction of the…
Dissecting Windows Section Objects
The post has been improved with the corrections kindly reported by Andrea Allievi. Instead of introduction We can't imagine Windows without section objects (or file mapping objects in terms of Windows API) and hardly can we find a Windows kernel subsystem that doesn't address it. The great idea behind section objects is that instead of calling Windows File APIs to work with a file, you can read…
Inside the Windows Cache Manager
Introduction The cache is an integral part of the operating system and its hybrid kernel. Roughly speaking, it's just a virtual memory region in the kernel address space, on which the Cache Manager maps file data to provide quick access to them in the future. This access is frequently used by the File System Driver (FSD) or the Windows Memory Manager (VMM). Instead of reading file data from disk…
RIP Vitalik aka VK_Intel
https://www.darkreading.com/careers-and-people/vitali-kremez-dead-apparent-scuba-diving-accident
Why Google Chrome runs so many processes
Reading some topics at the Internet, it became clear that I'm not alone who have wondered why Google Chrome web browser (on Windows) runs so many processes even if one or two tabs have been opened in the browser. This situation looks more strange when I just have opened tabs without any content. In this blog post I want to talk about some hidden features of Chrome, which can be a cause of such…
What is a Proto-PTE and how Windows VMM works with it
A Proto-PTE (Prototype PTE, PPTE) is a basic block of the Windows VMM (Virtual Memory Manager) for help of which the OS can work with memory-mapped files (or Sections in the Native/NT kernel API terms). What I have learned from discussions with Windows Internals researchers, and my own experience, the PPTE is most tricky stuff a researcher can face with. But, in fact, here is nothing complicated…
Windows 10 RS5 introduces a new Software PTE type
As we already know, Microsoft tries to roll out a new security features (aka exploit mitigations) with each release of Windows 10 (RS_X). In previous releases was spotted a built into the OS EMET (aka Exploit Protection), Controlled Folder Access (Anti-Ransom_Encoder), KPTI, IOMMU devices support, Arbitrary Code Guard (ACG), Spectre-related mitigations, etc. A comprehensive list of such…
GrayFish rootkit analysis
Earlier in this year, I published research of the rootkit that belong to famous state-sponsored cybergroup called "Equation Group" . Analyzed rootkit actually represents one of the Windows kernel mode network implant, which has been used by cybergroup as a network traffic sniffer on NDIS level. As we know from comprehensive research of Kaspersky Lab, Equation Group has an arsenal of various…
Stuxnet drivers: detailed analysis
There has passed already a lot of time since the publication of various detailed researches about Stuxnet and its components. All top AV vendors wrote own comprehensive papers, which reveal major information about destructive Stuxnet features. Some information about Stuxnet rootkits were published by Kaspersky here , Symantec here , ESET here . However, the published information is not complete,…
EquationDrug rootkit analysis (mstcp32.sys)
Malware arsenal that have been used by very sophisticated & so-called state-sponsored cyber group named "Equation Group" already was perfectly described by Kaspersky in their report. As always, it is hard to make an assumption about attribution of this malware as well as about origins of such elite cyber group. Anyway, it's obviously that code development and the cost of infrastructure for…
Finfisher rootkit analysis
My previous blog post was dedicated to very interesting malware that is called Wingbird . This malware has been used by NEODYMIUM cyber espionage group and contains rootkit to execute sensitive and important operations for attackers in a system. The first sample used rootkit for injection malicious code into Winlogon with removing ESET driver hooks in kernel SSDT, while second deploys rootkit for…
Wingbird rootkit analysis
In previous blog posts I've described rootkits that have been used by so-called state-sponsored actors for infecting their victims, providing malware persistence and achieving SYSTEM privileges into a system. I've mentioned Remsec (Cremes) rootkit that was used by Strider (ProjectSauron) cybergroup and Sednit rootkit of APT28 (Fancy Bear) group. While Remsec rootkit has been used by operators for…
Windows exploitation in 2016
"Windows exploitation in 2016" is out... :) Press-release https://www.eset.com/int/about/newsroom/research/eset-releases-annual-report-of-the-most-vulnerable-microsoft-windows-components/ Overview http://www.welivesecurity.com/2017/01/05/windows-exploitation-2016/ PDF http://www.welivesecurity.com/wp-content/uploads/2017/01/Windows-Exploitation-2016-A4.pdf
A note about Sednit rootkit
Sednit cyberespionage group is already a well-known for AVers & security community. It is also known as APT28, Fancy Bear, Pawn Storm, Sofacy. Wide range of various researches show for us that this cybergroup operates by state-sponsored malicious toolkits. Malware from these toolkits are intended for cyberespionage and data exfiltration from compromised systems. Recently my colleagues from ESET…
Remsec driver analysis - Agnitum driver exploitation
In previous three parts of "Remsec driver analysis" research I've tried to show, how Remsec (aka Cremes) Ring 0 code works and how it is loaded into a system. We already know that attackers were interested only in one purpose - run own malicious code with SYSTEM privileges. But as we already saw, they have used AVers drivers for this purpose: Agnitum driver on 32-bit system & Avast driver on x64.…
Remsec driver analysis - Part 3
In two previous blog posts I've described 32-bit plugin that was mentioned by Kaspersky in their technical analysis . The plugin is called kgate and it has some interesting features, including, exploiting 32-bit Agnitum driver to run rootkit driver, run 32-bit or 64-bit kernel mode code by non-standart way. It's hard to say how stable this code works on live system, because authors use…
Remsec driver analysis - Part 2
In previous blog post I've described 32-bit driver that has been used by attackers who are behind Strider cybergroup. I also pointed that from my point of view the driver was developed by skilled guys, but it contains two flaws. Firstly, authors forget to turn on SMEP again, after executing user mode code and they disable it each time when client tries to call 0x1173000C IOCTL code. Secondly, they…
Remsec driver analysis
Remsec or Cremes malware already was perfectly described by Kaspersky in their report . Symantec also did a blog post about it. This sophisticated malware toolkit refers to so-called state-sponsored actor, which was named by KL as ProjectSauron or Strider by SYMC. There are some similarities between Remsec and other serious state-sponsored projects like EvilBunny (Animal Farm) or Flame (Equation…
My opinions in media
Sednit aka Fancy Bear used Flash Player exploits in cyberattacks [RU] link E2EE in modern messengers: [15.07.16] [Geekbrains] [RU] link Messengers security, E2EE: [28.06.16] [Gazeta.RU] [RU] link Nemucod + TeslaCrypt campaign: [22.03.16] [Gizmodo India] [ENG] link Apple v FBI story: [29.02.16] [Gazeta.RU] [RU] link Most impressive hack stories of 2015: [12.12.15] [Gazeta.RU] [RU] link I'm talking…