Potential Kapeka Decrypted Backdoor Indicator
Detects the presence of a file that is decrypted backdoor binary dropped by the Kapeka Dropper, which disguises itself as a hidden file under a folder named "Microsoft" within "CSIDL_COMMON_APPDATA" or "CSIDL_LOCAL_APPDATA", depending on the process privileges. The file, typically 5-6 characters long with a random combination of consonants and vowels followed by a ".wll" extension to pose as a legitimate file to evade detection.
Sigma rule (View on GitHub)
1title: Potential Kapeka Decrypted Backdoor Indicator
2id: 20228d05-dd68-435d-8b4e-e7e64938880c
3status: experimental
4description: |
5 Detects the presence of a file that is decrypted backdoor binary dropped by the Kapeka Dropper, which disguises itself as a hidden file under a folder named "Microsoft" within "CSIDL_COMMON_APPDATA" or "CSIDL_LOCAL_APPDATA", depending on the process privileges.
6 The file, typically 5-6 characters long with a random combination of consonants and vowels followed by a ".wll" extension to pose as a legitimate file to evade detection.
7references:
8 - https://labs.withsecure.com/publications/kapeka
9 - https://app.any.run/tasks/1efb3ed4-cc0f-4690-a0ed-24516809bc72/
10author: Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems)
11date: 2024-07-03
12tags:
13 - attack.defense-evasion
14 - detection.emerging-threats
15logsource:
16 category: file_event
17 product: windows
18detection:
19 selection_generic:
20 TargetFilename|contains:
21 - ':\ProgramData\'
22 - '\AppData\Local\'
23 TargetFilename|re: '\\[a-zA-Z]{5,6}\.wll'
24 selection_specific:
25 TargetFilename|endswith:
26 - '\win32log.exe'
27 - '\crdss.exe'
28 condition: 1 of selection_*
29falsepositives:
30 - Unknown
31level: high
References
-
This report provides an in-depth technical analysis of the backdoor and its capabilities, and analyzes the connection between Kapeka and Sandworm group. The purpose of this report is to raise awareness amongst businesses, governments, and the broader security community. WithSecure has engaged governments and select customers with advanced copies of this report. In addition to the report, we are releasing several artifacts developed as a result of our research, including a registry-based & hardcoded configuration extractor, a script to decrypt and emulate the backdoor’s network communication, and as might be expected, a list of indicators of compromise, YARA rules, and MITRE ATT&CK mapping
Read More -
Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.
Read More
Related rules
- DLL Names Used By SVR For GraphicalProton Backdoor
- Forest Blizzard APT - File Creation Activity
- Forest Blizzard APT - Process Creation Activity
- Kapeka Backdoor Configuration Persistence
- Kapeka Backdoor Execution Via RunDLL32.EXE