eSentire Threat Intelligence Malware Analysis: CaddyWiper

First discovered by ESET researchers in March 2022, CaddyWiper malware is a new type of wiper malware used by Russian threat actors to target Ukrainian organizations, and the fourth wiper identified since the invasion of the Ukraine. Unlike ransomware, the only objective of using wiper malware is to damage files, data, hard drives, or entire programs and cause as much destruction as possible in the targeted organization’s endpoints and network.

eSentire’s Threat Intelligence (TI) team assesses with high confidence that as the hybrid war between Russia and Ukraine continues, threat actors will continue developing more destructive malware with the goal to disrupt the operations in Ukrainian infrastructure since the wiping malware does not need to be sophisticated to perform the basic wiping capabilities.

Case Study

The destructive malware named CaddyWiper was first reported by ESET Researchers on March 14, 2022. The malware was first detected at 11:38 a.m. local time (5:38 a.m. EST) targeting organizations in Ukraine. According to ESET, the infection mechanism is similar to the HermeticWiper malware in that it operates via Default Domain Policy.

Technical Analysis on CaddyWiper

eSentire TI has observed 4 CaddyWiper samples targeting Ukrainian organizations in the wild including a UPX packed version. CaddyWiper is the fourth wiper observed targeting Ukrainian organizations since January 2022.

CaddyWiper is a PE32 (32-bit) executable written in C++ programming language with a file size of 9.00 KB (9,216 bytes). The compilation timestamp for all the wiper samples dates to March 14, 2022 (on the same day when the first attacks were observed).

The malware samples do not appear to be digitally signed except for one sample (SHA-256: 1e87e9b5ee7597bdce796490f3ee09211df48ba1d11f6e2f5b255f05cc0ba176). The file is signed by TrustAsia (Exhibit 2).

The wiper uses stackstrings, which is the technique used by malware developers to “conceal” the strings from an analyst (Exhibit 3).

The wiper checks if the infected machine is a Domain Controller via the DsRoleGetPrimaryDomainInformation API. The API gets state data for the computer, which includes the state of the directory service installation and domain data. If the infected machine is not a Domain Controller, the malware recursively wipes the files in C:\Users and D:\ directories. Additionally, CaddyWiper attempts to wipe the files in the driver letters alphabetically starting from D:\ drive until it reaches Z:\ drive (Exhibit 4).

While running the sample on the sandbox machine, the malware did not wipe all the files completely in the mentioned folders, except for shortcut files. The sample also skips wiping the files under C:\ drive.

If the infected machine is the Domain Controller, the wiper will exit (Exhibit 5).

The jump to the function responsible for wiping the files is not taken. Instead, it will exit via the RtlExitUserThread command (Exhibit 6).

The wiper enumerates through the files, takes ownership of the files overrides File Permissions with SeTakeOwnershipPrivilege and AdjustTokenPrivileges APIs and overwrites 10485760 bytes of data with zeroes (Exhibit 7).

After the malware finishes overwriting the files, it uses the DeviceIoControl API with the control code IOCTL_DISK_SET_DRIVE_LAYOUT_EX to access the extended information about the drive's partitions (decrements from Physical Drive 9 to Physical Drive 0). Specifically, it accesses the data on the Master Boot Record (MBR) and GUID Partition Table (GPT) partitions of the hard drives to proceed with the wiping process.

We assess that the wiper sample does not have any similarities with the previous wipers (WhisperGate, HermeticWiper, IsaacWiper) that were used to target Ukrainian organizations. The only distinctive characteristic of CaddyWiper is that it does not target Domain Controllers. We believe it’s probable that this is done to keep the foothold on the Domain Controller to gain access to other machines on the network and that CaddyWiper was developed within one month or less.

What eSentire is doing about it

Our Threat Response Unit (TRU) combines threat intelligence gleaned from research, security incidents, and the external threat landscape to create actionable outcomes for our customers. We are taking a holistic response approach to combat all malware by deploying countermeasures, such as:

• Implementing the detections to identify CaddyWiper malware activities across eSentire MDR for Endpoint solutions.
• Performing global threat hunts against the IOCs associated with the CaddyWiper malware
• Actively monitoring for any signs of compromise.

Our detection content is backed by investigation runbooks, ensuring our SOC cyber analysts respond rapidly to any intrusion attempts. In addition, our Threat Response Unit closely monitors the threat landscape and addresses capability gaps and conducts retroactive threat hunts to assess customer impact.

Recommendations from eSentire’s Threat Response Unit (TRU)

We recommend implementing the following controls to help secure your organization against the CaddyWiper malware:

• Address security issues in Active Directory: thoroughly reviewing and securing SYSVOL permissions, patching any known vulnerabilities, implementing Least-Privilege Administrative Models.
• If working with organizations based in Ukraine, perform access control review on the traffic.
• Confirm that all the devices are protected with Endpoint Detection and Response (EDR) solutions.

While the Tactics, Techniques, and Procedures (TTPs) used by adversaries grow in sophistication, they lead to a limited set of choke points at which critical business decisions must be made. Intercepting the various attack paths utilized by the modern threat actor requires actively monitoring the threat landscape, developing, and deploying endpoint detection, and the ability to investigate logs & network data during active intrusions.

eSentire’s Threat Response Unit (TRU) is a world-class team of threat researchers who develop new detections enriched by original threat intelligence and leverage new machine learning models that correlate multi-signal data and automate rapid response to advanced threats.

If you’re not currently engaged with an MDR provider, eSentire MDR can help you reclaim the advantage and put your business ahead of disruption.

Learn what it means to have an elite team of Threat Hunters and Researchers that works for you. Connect with an eSentire Security Specialist.

Appendix

Sources

• https://www.welivesecurity.com/2022/03/15/caddywiper-new-wiper-malware-discovered-ukraine/
• https://twitter.com/ESETresearch/status/1503436420886712321?s=20&t=9fWLU5NluwqmWqf8d0zD8g
• https://docs.microsoft.com/en-us/windows/win32/api/

Indicators of Compromise

Yara Rules

import "pe"
import "hash"
import "math"
rule CaddyWiper_1: detection
CaddyWiper_a294620543334a721a2ae8eaaf9680a0786f4b9a216d75b55cfd28f39e9430ea
{
condition:
    for any i in (0..pe.number_of_sections - 1): (
        hash.md5(pe.sections[i].raw_data_offset,
        pe.sections[i].raw_data_size) == 
        "f0d4c11521fc3891965534e6c52e128b" and
        pe.sections[i].name == ".text") and
    for any i in (0..pe.number_of_sections - 1): (
        math.entropy(pe.sections[i].raw_data_offset, pe.sections[i].raw_data_size) >= 5 and
        pe.sections[i].name == ".text") and
    pe.imports("netapi32.dll", "DsRoleGetPrimaryDomainInformation") and
    uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and
    filesize < 11KB
}

rule CaddyWiper: detection CaddyWiper_2
{
meta:
    hash = "f1e8844dbfc812d39f369e7670545a29efef6764d673038b1c3edd11561d6902"
strings:
    $packer = "UPX0" ascii nocase
    $packer1 = "UPX1" ascii nocase
    $packer2 = "UPX2" ascii nocase
    $function = "DsRoleGetPrimaryDomainInformation" ascii nocase
condition:
    uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 
    and (3 of ($packer*) and $function) 
    and filesize < 26KB
}