What We Do
How we do it
Resources
SECURITY ADVISORIES
May 11, 2022
CVE-2022-26923 - Active Directory Domain Services Elevation of Privilege Vulnerability
THE THREAT Microsoft has disclosed a new vulnerability impacting Active Directory Certificate Services (ADCS) tracked as CVE-2022-26923 (Active Directory Domain Services Elevation of Privilege Vulnerability). If exploited successfully, an authenticated attacker can escalate privileges in environments where ADCS is running on the domain. eSentire is aware of technical details and tooling [2] for…
Read More
View all Advisories →
Company
ABOUT ESENTIRE
About Us
eSentire is The Authority in Managed Detection and Response Services, protecting the critical data and applications of 1200+ organizations in 75+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events.
Read about how we got here
Leadership Work at eSentire
LATEST PRESS RELEASE
May 17, 2022
Cybersecurity Leader eSentire Continues Its Commitment to Rigorous Security Standards Earning PCI DSS Certification
Waterloo, ON, May 17, 2022 — eSentire, the Authority in Managed Detection and Response (MDR), maintains one of the most secure and robust IT environments of any MDR provider in the industry. To that end, eSentire today announced that it has received the Payment Card Industry Data Security Standard (PCI DSS) certification, considered one of the most stringent and comprehensive payment card…
Read More
Partners
PARTNER PROGRAM
e3 Ecosystem
We provide sophisticated cybersecurity solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs). Find out why you should partner with eSentire, the Authority in Managed Detection and Response, today.
Learn more
ECOSYSTEM PARTNER RESOURCES
Apply to become an e3 ecosystem partner with eSentire, the Authority in Managed Detection and Response.
Login to the Partner Portal for resources and content for current partners.
Search
Resources
Blog — Mar 31, 2022

eSentire Threat Intelligence Malware Analysis: CaddyWiper

Speak With A Security Expert Now

First discovered by ESET researchers in March 2022, CaddyWiper malware is a new type of wiper malware used by Russian threat actors to target Ukrainian organizations, and the fourth wiper identified since the invasion of the Ukraine. Unlike ransomware, the only objective of using wiper malware is to damage files, data, hard drives, or entire programs and cause as much destruction as possible in the targeted organization’s endpoints and network.

eSentire’s Threat Intelligence (TI) team assesses with high confidence that as the hybrid war between Russia and Ukraine continues, threat actors will continue developing more destructive malware with the goal to disrupt the operations in Ukrainian infrastructure since the wiping malware does not need to be sophisticated to perform the basic wiping capabilities.

Key Takeaways

  • eSentire TI assesses that CaddyWiper has a low level of sophistication compared to the other wipers observed targeting Ukrainian organizations (HermeticWiper).
  • CaddyWiper specifically doesn’t target Domain Controllers to keep the foothold on the victim’s network to be able to obtain credentials, move laterally and infect more machines.
  • eSentire TI assesses that it’s probable that this is done to keep the foothold on the Domain Controller and gain access to other machines on the network.
  • eSentire’s Threat Response Unit (TRU) is currently implementing the detections developed to identify CaddyWiper malware activities across MDR for Endpoint, performing global threat hunts against the IOCs associated with the CaddyWiper malware, and actively monitoring for any signs of compromise.

Case Study

The destructive malware named CaddyWiper was first reported by ESET Researchers on March 14, 2022. The malware was first detected at 11:38 a.m. local time (5:38 a.m. EST) targeting organizations in Ukraine. According to ESET, the infection mechanism is similar to the HermeticWiper malware in that it operates via Default Domain Policy.

Exhibit 1: First CaddyWiper detection by ESET


Technical Analysis on CaddyWiper

eSentire TI has observed 4 CaddyWiper samples targeting Ukrainian organizations in the wild including a UPX packed version. CaddyWiper is the fourth wiper observed targeting Ukrainian organizations since January 2022.

CaddyWiper is a PE32 (32-bit) executable written in C++ programming language with a file size of 9.00 KB (9,216 bytes). The compilation timestamp for all the wiper samples dates to March 14, 2022 (on the same day when the first attacks were observed).

The malware samples do not appear to be digitally signed except for one sample (SHA-256: 1e87e9b5ee7597bdce796490f3ee09211df48ba1d11f6e2f5b255f05cc0ba176). The file is signed by TrustAsia (Exhibit 2).

Exhibit 2: Digital Signature details


The wiper uses stackstrings, which is the technique used by malware developers to “conceal” the strings from an analyst (Exhibit 3).

Exhibit 3: Stackstrings used in CaddyWiper


The wiper checks if the infected machine is a Domain Controller via the DsRoleGetPrimaryDomainInformation API. The API gets state data for the computer, which includes the state of the directory service installation and domain data. If the infected machine is not a Domain Controller, the malware recursively wipes the files in C:\Users and D:\ directories. Additionally, CaddyWiper attempts to wipe the files in the driver letters alphabetically starting from D:\ drive until it reaches Z:\ drive (Exhibit 4).

While running the sample on the sandbox machine, the malware did not wipe all the files completely in the mentioned folders, except for shortcut files. The sample also skips wiping the files under C:\ drive.

Exhibit 4: CaddyWiper wipes the drives from D to Z letters


If the infected machine is the Domain Controller, the wiper will exit (Exhibit 5).

Exhibit 5: The malware doesn't proceed with executing the wiping instructions on a Domain Controller


The jump to the function responsible for wiping the files is not taken. Instead, it will exit via the RtlExitUserThread command (Exhibit 6).

The jump to the function responsible for wiping the files is not taken. Instead, it will exit via the RtlExitUserThread command (Exhibit 6).


The wiper enumerates through the files, takes ownership of the files overrides File Permissions with SeTakeOwnershipPrivilege and AdjustTokenPrivileges APIs and overwrites 10485760 bytes of data with zeroes (Exhibit 7).

Exhibit 7: The wiper is overwriting 10485760 bytes of data with 0's


After the malware finishes overwriting the files, it uses the DeviceIoControl API with the control code IOCTL_DISK_SET_DRIVE_LAYOUT_EX to access the extended information about the drive's partitions (decrements from Physical Drive 9 to Physical Drive 0). Specifically, it accesses the data on the Master Boot Record (MBR) and GUID Partition Table (GPT) partitions of the hard drives to proceed with the wiping process.

Exhibit 8: Decrementing loop (the wiper decrements the drives from 9 to 0)


We assess that the wiper sample does not have any similarities with the previous wipers (WhisperGate, HermeticWiper, IsaacWiper) that were used to target Ukrainian organizations. The only distinctive characteristic of CaddyWiper is that it does not target Domain Controllers. We believe it’s probable that this is done to keep the foothold on the Domain Controller to gain access to other machines on the network and that CaddyWiper was developed within one month or less.

What eSentire is doing about it

Our Threat Response Unit (TRU) combines threat intelligence gleaned from research, security incidents, and the external threat landscape to create actionable outcomes for our customers. We are taking a holistic response approach to combat all malware by deploying countermeasures, such as:

Our detection content is backed by investigation runbooks, ensuring our SOC cyber analysts respond rapidly to any intrusion attempts. In addition, our Threat Response Unit closely monitors the threat landscape and addresses capability gaps and conducts retroactive threat hunts to assess customer impact.

Recommendations from eSentire’s Threat Response Unit (TRU)

We recommend implementing the following controls to help secure your organization against the CaddyWiper malware:

While the Tactics, Techniques, and Procedures (TTPs) used by adversaries grow in sophistication, they lead to a limited set of choke points at which critical business decisions must be made. Intercepting the various attack paths utilized by the modern threat actor requires actively monitoring the threat landscape, developing, and deploying endpoint detection, and the ability to investigate logs & network data during active intrusions.

eSentire’s Threat Response Unit (TRU) is a world-class team of threat researchers who develop new detections enriched by original threat intelligence and leverage new machine learning models that correlate multi-signal data and automate rapid response to advanced threats.

If you’re not currently engaged with an MDR provider, eSentire MDR can help you reclaim the advantage and put your business ahead of disruption.

Learn what it means to have an elite team of Threat Hunters and Researchers that works for you. Connect with an eSentire Security Specialist.

Appendix

Sources

Indicators of Compromise

Name File Hash (SHA-256)
CaddyWiper ea6a416b320f32261da8dafcf2faf088924f99a3a84f7b43b964637ea87aef72
CaddyWiper a294620543334a721a2ae8eaaf9680a0786f4b9a216d75b55cfd28f39e9430ea
CaddyWiper 1e87e9b5ee7597bdce796490f3ee09211df48ba1d11f6e2f5b255f05cc0ba176
CaddyWiper (UPX packed) f1e8844dbfc812d39f369e7670545a29efef6764d673038b1c3edd11561d6902

Yara Rules

import "pe"
import "hash"
import "math"
rule CaddyWiper_1: detection
CaddyWiper_a294620543334a721a2ae8eaaf9680a0786f4b9a216d75b55cfd28f39e9430ea
{
condition:
    for any i in (0..pe.number_of_sections - 1): (
        hash.md5(pe.sections[i].raw_data_offset,
        pe.sections[i].raw_data_size) == 
        "f0d4c11521fc3891965534e6c52e128b" and
        pe.sections[i].name == ".text") and
    for any i in (0..pe.number_of_sections - 1): (
        math.entropy(pe.sections[i].raw_data_offset, pe.sections[i].raw_data_size) >= 5 and
        pe.sections[i].name == ".text") and
    pe.imports("netapi32.dll", "DsRoleGetPrimaryDomainInformation") and
    uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and
    filesize < 11KB
}
rule CaddyWiper: detection CaddyWiper_2
{
meta:
    hash = "f1e8844dbfc812d39f369e7670545a29efef6764d673038b1c3edd11561d6902"
strings:
    $packer = "UPX0" ascii nocase
    $packer1 = "UPX1" ascii nocase
    $packer2 = "UPX2" ascii nocase
    $function = "DsRoleGetPrimaryDomainInformation" ascii nocase
condition:
    uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 
    and (3 of ($packer*) and $function) 
    and filesize < 26KB
}

Skip To:

  • Key Takeaways
  • Case Study
  • Technical Analysis on CaddyWiper
  • What eSentire is doing about it
  • Recommendations from eSentire’s Threat Response Unit (TRU)
  • Appendix
View Most Recent Blogs
eSentire Threat Response Unit (TRU)
eSentire Threat Response Unit (TRU)

Our industry-renowned Threat Response Unit (TRU) is an elite team of threat hunters and researchers, that supports our 24/7 Security Operations Centers (SOCs), builds detection models across our Atlas XDR Cloud Platform, and works as an extension of your security team to continuously improve our Managed Detection and Response service. TRU has been recognized for its threat hunting, original research and content development capabilities. TRU is strategically organized into cross-functional groups to protect you against advanced and emerging threats, allowing your organization to gain leading threat intelligence and incredible cybersecurity acumen.