Potential Kapeka Decrypted Backdoor Indicator
Detects the presence of a file that is decrypted backdoor binary dropped by the Kapeka Dropper, which disguises itself as a hidden file under a folder named "Microsoft" within "CSIDL_COMMON_APPDATA" or "CSIDL_LOCAL_APPDATA", depending on the process privileges. The file, typically 5-6 characters long with a random combination of consonants and vowels followed by a ".wll" extension to pose as a legitimate file to evade detection.
Sigma rule (View on GitHub)
1title: Potential Kapeka Decrypted Backdoor Indicator
2id: 20228d05-dd68-435d-8b4e-e7e64938880c
3status: experimental
4description: |
5 Detects the presence of a file that is decrypted backdoor binary dropped by the Kapeka Dropper, which disguises itself as a hidden file under a folder named "Microsoft" within "CSIDL_COMMON_APPDATA" or "CSIDL_LOCAL_APPDATA", depending on the process privileges.
6 The file, typically 5-6 characters long with a random combination of consonants and vowels followed by a ".wll" extension to pose as a legitimate file to evade detection.
7references:
8 - https://labs.withsecure.com/publications/kapeka
9 - https://app.any.run/tasks/1efb3ed4-cc0f-4690-a0ed-24516809bc72/
10author: Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems)
11date: 2024-07-03
12tags:
13 - attack.defense-evasion
14logsource:
15 category: file_event
16 product: windows
17detection:
18 selection_generic:
19 TargetFilename|contains:
20 - ':\ProgramData\'
21 - '\AppData\Local\'
22 TargetFilename|re: '\\[a-zA-Z]{5,6}\.wll'
23 selection_specific:
24 TargetFilename|endswith:
25 - '\win32log.exe'
26 - '\crdss.exe'
27 condition: 1 of selection_*
28falsepositives:
29 - Unknown
30level: high
References
-
This report provides an in-depth technical analysis of the backdoor and its capabilities, and analyzes the connection between Kapeka and Sandworm group. The purpose of this report is to raise awareness amongst businesses, governments, and the broader security community. WithSecure has engaged governments and select customers with advanced copies of this report. In addition to the report, we are releasing several artifacts developed as a result of our research, including a registry-based & hardcoded configuration extractor, a script to decrypt and emulate the backdoor’s network communication, and as might be expected, a list of indicators of compromise, YARA rules, and MITRE ATT&CK mapping
Read More -
Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.
Read More
Related rules
- AD Object WriteDAC Access
- ADS Zone.Identifier Deleted By Uncommon Application
- AMSI Bypass Pattern Assembly GetType
- APT PRIVATELOG Image Load Pattern
- APT27 - Emissary Panda Activity