EDRKillShifter

T1583 Acquire Infrastructure QuadSwitcher acquired infrastructure to host their tooling.

T1587.001 Develop Capabilities: Malware The RansomHub, Play, Medusa, and BianLian gangs develop their own encryptors and related tooling.

Some samples, like those documented in early EDRKillShifter research, require a 64-character password supplied on the command line before they will execute, which gates the binary against sandbox analysis.

All samples require a unique 64-character password passed to the command line. If the password is wrong (or not provided), it won’t execute.

“The driver is executed by creating a service named ‘StopGuard’, with CreateServiceW writing a registry key at HKLM\System\ControlSet001\Services\StopGuard.”

The loader carries a legitimate Microsoft-signed driver embedded in its .data section, writes the driver to disk, and installs it as a service.

The attackers can further abuse this kernel-level access to move laterally within the network, deploy ransomware, steal data, backdoor compromised systems, and perform other nefarious actions without being detected.

"After the malware creates a new service for the driver, starts the service, and loads the driver"

“Adversaries weaponize known-vulnerable signed drivers” and use unauthenticated IOCTL interfaces to perform privileged kernel operations, including termination of PPL-protected processes.

"After the malware creates a new service for the driver, starts the service, and loads the driver"

“KillerUltra.exe — a custom-packed executable embedding the Zemana driver as a compiled-in resource”; EDRKillShifter “requires a 64-character password passed on the command line to decrypt its payload.”

The original filename is Loader.exe and its product name is ARK-Game. (Some members of the research team speculated that the threat actor tries to masquerade the final payload as a popular computer game named ARK: Survival Evolved.)

It also copies that data into a new file named Config.ini and writes that file to the same filesystem location where the binary was executed... The malware then deletes the config.ini file

When run with the correct password, the executable decrypts an embedded resource named BIN and executes it in memory.

RansomHub’s builder adds an additional layer of protection to its encryptors, a 64-character password, without which the encryptor does not work.

“The password-gating mechanism serves a dual purpose: it prevents sandbox detonation (the binary appears inert without the correct password).”

The loader carries a legitimate Microsoft-signed driver embedded in its .data section, writes the driver to disk, and installs it as a service.

The sole purpose of the final, decoded layer is to load the final payload dynamically into memory and execute it.

“Enumerate running EDR processes ... via Process32First/Next and resolve their PIDs,” followed by termination of each target.

“The password-gating mechanism serves a dual purpose: it prevents sandbox detonation (the binary appears inert without the correct password).”

...ultimately steal and encrypt data before extorting victims into paying a ransom... The attackers can further abuse this kernel-level access to move laterally within the network, deploy ransomware, steal data, backdoor compromised systems...

T1071 Application Layer Protocol In Play intrusions, payloads are retrieved via HTTP.

"steal and encrypt data before extorting victims"; "deploy ransomware, steal data, backdoor compromised systems"

EDR evasion tools like EDRKillShifter and the technique known as EDR-Freeze aim to blind endpoint detection and response software without triggering the alerts

“Adversaries weaponize known-vulnerable signed drivers to accomplish objectives that user-mode code could never achieve: terminating Protected Process Light (PPL) services, disabling Endpoint Detection and Response (EDR) sensors.”