fechar
fechar
Sua Rede do Amanhã
Sua Rede do Amanhã
Planeje seu caminho rumo a uma rede mais rápida, segura e resiliente projetada para os aplicativos e usuários aos quais você oferece suporte.
          Experimente a Netskope
          Get Hands-on With the Netskope Platform
          Here's your chance to experience the Netskope One single-cloud platform first-hand. Sign up for self-paced, hands-on labs, join us for monthly live product demos, take a free test drive of Netskope Private Access, or join us for a live, instructor-led workshops.
            Líder em SSE. Agora é líder em SASE de fornecedor único.
            Líder em SSE. Agora é líder em SASE de fornecedor único.
            A Netskope estreia como líder no Quadrante Mágico™ do Gartner® para Single-Vendor SASE
              Protegendo a IA generativa para leigos
              Protegendo a IA generativa para leigos
              Learn how your organization can balance the innovative potential of generative AI with robust data security practices.
                Modern data loss prevention (DLP) for Dummies eBook
                Prevenção Contra Perda de Dados (DLP) Moderna para Leigos
                Get tips and tricks for transitioning to a cloud-delivered DLP.
                  Livro SD-WAN moderno para SASE Dummies
                  Modern SD-WAN for SASE Dummies
                  Pare de brincar com sua arquitetura de rede
                    Compreendendo onde estão os riscos
                    Advanced Analytics transforms the way security operations teams apply data-driven insights to implement better policies. With Advanced Analytics, you can identify trends, zero in on areas of concern and use the data to take action.
                        Os 6 casos de uso mais atraentes para substituição completa de VPN herdada
                        Os 6 casos de uso mais atraentes para substituição completa de VPN herdada
                        Netskope One Private Access is the only solution that allows you to retire your VPN for good.
                          A Colgate-Palmolive protege sua “propriedade intelectual "” com proteção de dados inteligente e adaptável
                          A Colgate-Palmolive protege sua “propriedade intelectual "” com proteção de dados inteligente e adaptável
                            Netskope GovCloud
                            Netskope obtém alta autorização do FedRAMP
                            Escolha o Netskope GovCloud para acelerar a transformação de sua agência.
                              Let's Do Great Things Together
                              A estratégia de comercialização da Netskope, focada em Parcerias, permite que nossos Parceiros maximizem seu crescimento e lucratividade enquanto transformam a segurança corporativa.
                                Netskope solutions
                                Netskope Cloud Exchange
                                Netskope Cloud Exchange (CE) provides customers with powerful integration tools to leverage investments across their security posture.
                                  Suporte Técnico Netskope
                                  Suporte Técnico Netskope
                                  Nossos engenheiros de suporte qualificados estão localizados em todo o mundo e têm diversas experiências em segurança de nuvem, rede, virtualização, fornecimento de conteúdo e desenvolvimento de software, garantindo assistência técnica de qualidade e em tempo hábil.
                                    Vídeo da Netskope
                                    Treinamento Netskope
                                    Os treinamentos da Netskope vão ajudar você a ser um especialista em segurança na nuvem. Conte conosco para ajudá-lo a proteger a sua jornada de transformação digital e aproveitar ao máximo as suas aplicações na nuvem, na web e privadas.

                                      Netskope Threat Coverage: HermeticWiper

                                      Feb 25 2022

                                      Summary

                                      In January 2022, Netskope analyzed a destructive malware named WhisperGate, wiping files and corrupting disks during the aftermath of a geopolitical conflict in Ukraine. On February 24, the conflict escalated with Russian attacks in Ukraine, followed by a series of DDoS attacks against Ukrainian websites. 

                                      On February 24, 2022, a new malware called HermeticWiper was found in hundreds of computers in Ukraine. HermeticWiper corrupts disks on infected systems, similar to WhisperGate. However, HermeticWiper is a more complex malware, implementing techniques to avoid detection. In this blog post, we will analyze this new threat to demonstrate how it works.

                                      Analysis 

                                      We have analyzed two different HermeticWiper files, both digitally signed with a certificate issued to Hermetica Digital Ltd and valid until April 14, 2022.

                                      Example of Certificate used in HermeticWiper.
                                      Certificate used in HermeticWiper.

                                      Although this information can be easily changed, the first file was apparently compiled on December 28, 2021, while the second one was compiled on February 23, 2022.

                                      Screenshot of Compilation date of both HermeticWiper samples
                                      Compilation date of both HermeticWiper samples

                                      The two samples are 99% equal. The only difference is a small addition to the newer file within the main function.

                                      Graphic comparing both binaries of HermeticWiper.
                                      Comparing both binaries of HermeticWiper.

                                      Looking at the code that was added, it’s checking the presence of “C:\Windows\SYSVOL”, which is a folder that exists in every domain controller, containing public files shared across the domain. If the folder exists, the code skips additional steps that reference common folders such as “Desktop” and “AppData”, which we show later in this analysis.

                                      Screenshot of Addition to the newest HermeticWiper sample.
                                      Addition to the newest HermeticWiper sample.

                                      Once running, HermeticWiper adjusts its privileges by enabling SeBackupPrivilege and SeShutdownPrivilege tokens via AdjustTokenPrivileges API.  With both enabled tokens, the malware can access any file in the system, bypassing the access control list (ACL), and can shut down the system.

                                      Example of HermeticWiper adjusting privileges.
                                      HermeticWiper adjusting privileges.

                                      Then, it dynamically resolves three APIs from “kernel32.dll” using a common technique via GetModuleHandle and GetProcAddress.

                                      Screenshot of Dynamically resolved APIs.
                                      Dynamically resolved APIs.

                                      These APIs are then used to verify whether the process is 32- or 64-bit. Also, HermeticWiper checks the OS version as a condition to load a compressed non-malicious driver named “empntdrv.sys” from its resources, which belongs to the EaseUS software, abused throughout the wiping process to access drives and partition information.

                                      Screenshot of HermeticWiper loading a resource.
                                      HermeticWiper loading a resource.

                                      The usage of drivers was already observed in other wiping malware, such as Shamoon. HermeticWiper is likely using this driver to stay under the radar, as many operations are executed through DeviceIoControl, avoiding other API calls.

                                      Screenshot of compressed drivers within HermeticWiper resources.
                                      Compressed drivers within HermeticWiper resources.

                                      After loading the resource, the malware disables crash dumps by changing the registry key value of “CrashDumpEnabled” to 0. Then, it drops the abused driver to  “C:\Windows\System32\Drivers\<random_2_characters>dr.sys”.

                                      Screenshot of Abused drivers being written into disk.
                                      Abused drivers being written into disk.

                                      It also creates a pipe that will be used to interact with the abused driver.

                                      Screenshot of malware creating a pipe.
                                      Malware creating a pipe.

                                      To prevent any file from being restored, it also disables the volume shadow copy service.

                                      Example of disabling volume shadow copy service.
                                      Disabling volume shadow copy service.

                                      HermeticWiper then starts enumerating physical drives in the system in a loop from 0 to 100. For each one of them, the abused driver is called to get the device number via DeviceIoControl API, and the drive’s Master Boot Record (MBR) is corrupted through a bit swapping routine.

                                      Screenshot of listing physical drives to trigger the wiping routine.
                                      Listing physical drives to trigger the wiping routine.

                                      This is quite different from WhisperGate, which replaces the MBR stub with a code that runs when the machine is rebooted. Although this should be enough to prevent the OS from being loaded, the code also enumerates the partitions for the physical drives, differentiating between NTFS and FAT. For NTFS, HermeticWiper parses the Master File Table (MFT) before corrupting files. 

                                      Screenshot comparing file system string with NTFS and FAT.
                                      Comparing file system string with NTFS and FAT.

                                      Further code is referencing user folders such as “Desktop” and “My Documents”, as well as the Windows event logs folder. This routine is skipped in the newest binary we analyzed, if the folder “C:\Windows\SYSVOL” exists, as we mentioned earlier.

                                      Screenshot of HermeticWiper referencing common folders.
                                      HermeticWiper referencing common folders.

                                      Conclusion

                                      HermeticWiper is a destructive malware that emerged during attacks in Ukraine, similar to WhisperGate. Netskope Threat Labs is continuously monitoring cyberthreats related to the conflict in Ukraine.

                                      Protection

                                      Netskope Threat Labs is actively monitoring this campaign and has ensured coverage for all known threat indicators and payloads. 

                                      • Netskope Threat Protection
                                        • Win32.Ransomware.KillDisk
                                      • Netskope Advanced Threat Protection provides proactive coverage against this threat.
                                        • Gen.Malware.Detect.By.StHeur indicates a sample that was detected using static analysis
                                        • Gen.Malware.Detect.By.Sandbox indicates a sample that was detected by our cloud sandbox

                                      IOCs

                                      A full list of IOCs and a Yara rule can be found in our GitHub repository.

                                      author image
                                      Gustavo Palazolo
                                      Gustavo Palazolo is an expert in malware analysis, reverse engineering and security research, working many years in projects related to electronic fraud protection.
                                      Gustavo Palazolo is an expert in malware analysis, reverse engineering and security research, working many years in projects related to electronic fraud protection.

                                      Mantenha-se informado!

                                      Assine para receber as últimas novidades do Blog da Netskope