What We Do
How We Do
Resources
Company
Partners
Get Started
Blog

eSentire Threat Intelligence Malware Analysis: CaddyWiper

BY eSentire Threat Response Unit (TRU)

March 31, 2022 | 6 MINS READ

Attacks/Breaches

Threat Intelligence

Threat Response Unit

Want to learn more on how to achieve Cyber Resilience?

TALK TO AN EXPERT

IN THIS POST

First discovered by ESET researchers in March 2022, CaddyWiper malware is a new type of wiper malware used by Russian threat actors to target Ukrainian organizations, and the fourth wiper identified since the invasion of the Ukraine. Unlike ransomware, the only objective of using wiper malware is to damage files, data, hard drives, or entire programs and cause as much destruction as possible in the targeted organization’s endpoints and network.

eSentire’s Threat Intelligence (TI) team assesses with high confidence that as the hybrid war between Russia and Ukraine continues, threat actors will continue developing more destructive malware with the goal to disrupt the operations in Ukrainian infrastructure since the wiping malware does not need to be sophisticated to perform the basic wiping capabilities.

Key Takeaways

  • eSentire TI assesses that CaddyWiper has a low level of sophistication compared to the other wipers observed targeting Ukrainian organizations (HermeticWiper).
  • CaddyWiper specifically doesn’t target Domain Controllers to keep the foothold on the victim’s network to be able to obtain credentials, move laterally and infect more machines.
  • eSentire TI assesses that it’s probable that this is done to keep the foothold on the Domain Controller and gain access to other machines on the network.
  • eSentire’s Threat Response Unit (TRU) is currently implementing the detections developed to identify CaddyWiper malware activities across MDR for Endpoint, performing global threat hunts against the IOCs associated with the CaddyWiper malware, and actively monitoring for any signs of compromise.

Case Study

The destructive malware named CaddyWiper was first reported by ESET Researchers on March 14, 2022. The malware was first detected at 11:38 a.m. local time (5:38 a.m. EST) targeting organizations in Ukraine. According to ESET, the infection mechanism is similar to the HermeticWiper malware in that it operates via Default Domain Policy.

Exhibit 1: First CaddyWiper detection by ESET


Technical Analysis on CaddyWiper

eSentire TI has observed 4 CaddyWiper samples targeting Ukrainian organizations in the wild including a UPX packed version. CaddyWiper is the fourth wiper observed targeting Ukrainian organizations since January 2022.

CaddyWiper is a PE32 (32-bit) executable written in C++ programming language with a file size of 9.00 KB (9,216 bytes). The compilation timestamp for all the wiper samples dates to March 14, 2022 (on the same day when the first attacks were observed).

The malware samples do not appear to be digitally signed except for one sample (SHA-256: 1e87e9b5ee7597bdce796490f3ee09211df48ba1d11f6e2f5b255f05cc0ba176). The file is signed by TrustAsia (Exhibit 2).

Exhibit 2: Digital Signature details


The wiper uses stackstrings, which is the technique used by malware developers to “conceal” the strings from an analyst (Exhibit 3).

Exhibit 3: Stackstrings used in CaddyWiper


The wiper checks if the infected machine is a Domain Controller via the DsRoleGetPrimaryDomainInformation API. The API gets state data for the computer, which includes the state of the directory service installation and domain data. If the infected machine is not a Domain Controller, the malware recursively wipes the files in C:\Users and D:\ directories. Additionally, CaddyWiper attempts to wipe the files in the driver letters alphabetically starting from D:\ drive until it reaches Z:\ drive (Exhibit 4).

While running the sample on the sandbox machine, the malware did not wipe all the files completely in the mentioned folders, except for shortcut files. The sample also skips wiping the files under C:\ drive.

Exhibit 4: CaddyWiper wipes the drives from D to Z letters


If the infected machine is the Domain Controller, the wiper will exit (Exhibit 5).

Exhibit 5: The malware doesn't proceed with executing the wiping instructions on a Domain Controller


The jump to the function responsible for wiping the files is not taken. Instead, it will exit via the RtlExitUserThread command (Exhibit 6).

The jump to the function responsible for wiping the files is not taken. Instead, it will exit via the RtlExitUserThread command (Exhibit 6).


The wiper enumerates through the files, takes ownership of the files overrides File Permissions with SeTakeOwnershipPrivilege and AdjustTokenPrivileges APIs and overwrites 10485760 bytes of data with zeroes (Exhibit 7).

Exhibit 7: The wiper is overwriting 10485760 bytes of data with 0's


After the malware finishes overwriting the files, it uses the DeviceIoControl API with the control code IOCTL_DISK_SET_DRIVE_LAYOUT_EX to access the extended information about the drive's partitions (decrements from Physical Drive 9 to Physical Drive 0). Specifically, it accesses the data on the Master Boot Record (MBR) and GUID Partition Table (GPT) partitions of the hard drives to proceed with the wiping process.

Exhibit 8: Decrementing loop (the wiper decrements the drives from 9 to 0)


We assess that the wiper sample does not have any similarities with the previous wipers (WhisperGate, HermeticWiper, IsaacWiper) that were used to target Ukrainian organizations. The only distinctive characteristic of CaddyWiper is that it does not target Domain Controllers. We believe it’s probable that this is done to keep the foothold on the Domain Controller to gain access to other machines on the network and that CaddyWiper was developed within one month or less.

What eSentire is doing about it

Our Threat Response Unit (TRU) combines threat intelligence gleaned from research, security incidents, and the external threat landscape to create actionable outcomes for our customers. We are taking a holistic response approach to combat all malware by deploying countermeasures, such as:

Our detection content is backed by investigation runbooks, ensuring our SOC cyber analysts respond rapidly to any intrusion attempts. In addition, our Threat Response Unit closely monitors the threat landscape and addresses capability gaps and conducts retroactive threat hunts to assess customer impact.

Recommendations from eSentire’s Threat Response Unit (TRU)

We recommend implementing the following controls to help secure your organization against the CaddyWiper malware:

While the Tactics, Techniques, and Procedures (TTPs) used by adversaries grow in sophistication, they lead to a limited set of choke points at which critical business decisions must be made. Intercepting the various attack paths utilized by the modern threat actor requires actively monitoring the threat landscape, developing, and deploying endpoint detection, and the ability to investigate logs & network data during active intrusions.

eSentire’s Threat Response Unit (TRU) is a world-class team of threat researchers who develop new detections enriched by original threat intelligence and leverage new machine learning models that correlate multi-signal data and automate rapid response to advanced threats.

If you’re not currently engaged with an MDR provider, eSentire MDR can help you reclaim the advantage and put your business ahead of disruption.

Learn what it means to have an elite team of Threat Hunters and Researchers that works for you. Connect with an eSentire Security Specialist.

Appendix

Sources

Indicators of Compromise

Name File Hash (SHA-256)
CaddyWiper ea6a416b320f32261da8dafcf2faf088924f99a3a84f7b43b964637ea87aef72
CaddyWiper a294620543334a721a2ae8eaaf9680a0786f4b9a216d75b55cfd28f39e9430ea
CaddyWiper 1e87e9b5ee7597bdce796490f3ee09211df48ba1d11f6e2f5b255f05cc0ba176
CaddyWiper (UPX packed) f1e8844dbfc812d39f369e7670545a29efef6764d673038b1c3edd11561d6902

Yara Rules

import "pe"
import "hash"
import "math"
rule CaddyWiper_1: detection
CaddyWiper_a294620543334a721a2ae8eaaf9680a0786f4b9a216d75b55cfd28f39e9430ea
{
condition:
    for any i in (0..pe.number_of_sections - 1): (
        hash.md5(pe.sections[i].raw_data_offset,
        pe.sections[i].raw_data_size) == 
        "f0d4c11521fc3891965534e6c52e128b" and
        pe.sections[i].name == ".text") and
    for any i in (0..pe.number_of_sections - 1): (
        math.entropy(pe.sections[i].raw_data_offset, pe.sections[i].raw_data_size) >= 5 and
        pe.sections[i].name == ".text") and
    pe.imports("netapi32.dll", "DsRoleGetPrimaryDomainInformation") and
    uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and
    filesize < 11KB
}
rule CaddyWiper: detection CaddyWiper_2
{
meta:
    hash = "f1e8844dbfc812d39f369e7670545a29efef6764d673038b1c3edd11561d6902"
strings:
    $packer = "UPX0" ascii nocase
    $packer1 = "UPX1" ascii nocase
    $packer2 = "UPX2" ascii nocase
    $function = "DsRoleGetPrimaryDomainInformation" ascii nocase
condition:
    uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 
    and (3 of ($packer*) and $function) 
    and filesize < 26KB
}
eSentire Threat Response Unit (TRU)
eSentire Threat Response Unit (TRU)

The eSentire Threat Response Unit (TRU) is an industry-leading threat research team committed to helping your organization become more resilient. TRU is an elite team of threat hunters and researchers that supports our 24/7 Security Operations Centers (SOCs), builds threat detection models across the eSentire XDR Cloud Platform, and works as an extension of your security team to continuously improve our Managed Detection and Response service. By providing complete visibility across your attack surface and performing global threat sweeps and proactive hypothesis-driven threat hunts augmented by original threat research, we are laser-focused on defending your organization against known and unknown threats.

Read the Latest from eSentire