DarkWidow

A Customizable Dropper Tool targeting Windows.

---

Honourable Mentions:

1. BlackHat Asia, 2024 - Call For Tools
2. BlackHat USA, 2024 - Call For Tools
3. BlackHat SecTor, 2024 - Call For Tools
4. BlackHat Europe, 2024 - Call For Tools
5. Wild West Hacking Fest 2024 - Arsenal

• Thanks a lot to Soumyadeep Da aka @SoumyadeepBas12 for encouraging me to apply for these conferences, else I wouldn't have done it :)
• Thanks a lot to Faran aka @Chrollo_l33t for helping me to create the Slides and PPT for the presentation for this tool :)

---

Capabilities:

1. Indirect Dynamic Syscall. (MITRE ATT&CK TTP: T1106)
2. SSN + Syscall address sorting via Modified TartarusGate approach
3. Remote Process Injection via APC Early Bird to CUT OFF telemetry Catching by EDR. (MITRE ATT&CK TTP: T1055.004)
4. Spawns a sacrificial Process as the target process, not disrupting already open processes in the environment.
5. ACG(Arbitrary Code Guard)/BlockDll mitigation policy on spawned sacrificial process.
6. PPID spoofing (MITRE ATT&CK TTP: T1134.004)
7. Api and Dll resolving from TIB (Directly via offset (from TIB) -> TEB -> PEB -> resolve Nt Api) (MITRE ATT&CK TTP: T1106)
8. Cursed Nt API hashing (MITRE ATT&CK ID: S0574)

Bonus: If blessed with Admin privilege =>

1. Disables Event Log via killing EventLog Service Threads (MITRE ATT&CK TTP: T1562.002)

Disadv: If threads are resumed, all events that occurred during the suspension of Event Logger, get logged Again!

So, thought of killing them instead!

"It's more Invasive than suspension, but the decision is always up to the operator. Besides, killing threads get logged on the kernel level" - @SEKTOR7net

While Killing only those threads in the indirect syscall implant, was facing an error. I was unable to get the "eventlog" SubProcessTag Value. So thought of killing all threads, i.e. killing the whole process (responsible svchost.exe). Yeah creating an IOC!.

=

1. EDR/Ring-3/UserLand hook Bypass

2. The syscall and return statement are executed from memory of ntdll.dll

3. EDR detection based on checking the return address in the call stack can be bypassed.

Compile:

Directly via VS compiler:

Also add /MT compiler flag! => To statically links CRT functions together in a binary (Yeah, U guessed it, it bloats the implant)

2. Also via compile.bat (prefer option 1.)

./compile.bat

Usage:

PS C:> .\x64\Release\indirect.exe
[!] Wrong!
[->] Syntax: .\x64\Release\indirect.exe <PPID to spoof>

In Action:

https://github.com/reveng007/DarkWidow/assets/61424547/62a90c5b-84af-4389-8ddc-9f7926debdcf

Successful Execution WithOut Creating Alert on Sofos XDR EndPoint:

---

Further Improvements:

1. PPID spoofing (Emotet method)
2. Much Stealthier Use Case of EventLog Disabling!

---

Portions of the Code and links those helped:

1. TIB:

   • https://en.wikipedia.org/wiki/Win32_Thread_Information_Block
   • https://www.wikiwand.com/en/Win32_Thread_Information_Block

2. GS and FS register:

   • https://stackoverflow.com/questions/39137043/what-is-the-gs-register-used-for-on-windows
   • https://stackoverflow.com/questions/10810203/what-is-the-fs-gs-register-intended-for#:~:text=The%20registers%20FS%20and%20GS,to%20access%20thread%2Dspecific%20memory.

3. PEB LDR structure:

   • BlackHat - What Malware Authors Don't Want You to Know - Evasive Hollow Process Injection by @monnappa22

   • A pic of process Memory from the Above link:
     

   • From labs.cognisys.group, a blog by @D1rkMtr :
     

4. TIB -> TEB -> PEB -> Resolve Nt API and API hashing

   • https://stackoverflow.com/questions/41277888/iterating-over-peb-dllname-shows-only-exe-name

   • https://doxygen.reactos.org/d7/d55/ldrapi_8c_source.html#l01124

   • labs.cognisys.group, a blog by @D1rkMtr

   • A pic of the snippet from the above link, which I used here to resolve API dynamically without HardCoding Offsets:
     

   • The Api hashing code that I applied:

#include <stdint.h>
#include <stdio.h>
#include <Windows.h>

DWORD64 djb2(const char* str)
{
	DWORD64 dwHash = 0x7734773477347734;
	int c;

	while (c = *str++)
		dwHash = ((dwHash << 0x5) + dwHash) + c;


	return dwHash;
}

int main(int argc, char** argv)
{
	if (argc < 2)
	{
		printf("[!] Wrong!\n");
		printf("[->] Syntax: .\\%s <NTFuncName>\n\n", argv[0]);
		return 1;
	}

	const char* string = argv[1];

	DWORD64 hashvalue = djb2(string);

	printf("Hash Value: 0x%llX\n", hashvalue);

	return 0;
}

5. ACG(Arbitrary Code Guard)/BlockDll mitigation policy:

   • links:
   • Protecting Your Malware by @xpn
   • Wraith by @winterknife
   • spawn and HOLLOW by @0xBoku

6. PPID Spoofing Detection:

   • PPID Spoofing Detect by @spotheplanet
   • If got time, I will be adding a detection Portion to this portion! -> [Remaining..............................................!]

7. Moneta Detection and PESieve Detection:\

   • Moneta:
     

   • PESieve:
     

8. Capa Scan:
   

9. How Thread Stack Looks of the Implant Process: