Kaspersky Threats — Exploit.Win32.Procdmp.u

Sınıf: Exploit

Exploits, açık veya kötü niyetli amaçlarla yerel veya uzak bilgisayarda çalışan yazılımlardaki bir veya daha fazla güvenlik açığından yararlanan veri veya yürütülebilir kod içeren programlardır. Çoğu zaman, kötü niyetli kullanıcılar, daha sonra kötü amaçlı kod yüklemek için (örneğin, tüm ziyaretçileri kötü niyetli bir programla tehlikeye girmiş bir web sitesine bulaştıracak şekilde) bir kurbanın bilgisayarına girmek için bir istismar kullanırlar. Ayrıca, kullanıcılardan herhangi bir işlem yapılmaksızın bir kurbanın bilgisayarını kesmek için, Net-Worms tarafından istismarlar yaygın olarak kullanılmaktadır. Nuker programları istismarlar arasında dikkate değerdir; Bu tür programlar, yerel veya uzak bilgisayarlara özel hazırlanmış istekleri göndererek sistemin çökmesine neden olur.

Platform: Win32

Win32, 32-bit uygulamaların yürütülmesini destekleyen Windows NT tabanlı işletim sistemlerinde (Windows XP, Windows 7, vb.) Bir API'dir. Dünyanın en yaygın programlama platformlarından biri.

Aile: Exploit.Win32.Procdmp

No family description

Examples

1ED12ED548459F97CAAD1D8C1ED5B4E7

Tactics and Techniques: Mitre*

TA0002

Execution

The adversary is trying to run malicious code. Execution consists of techniques that result in adversary-controlled code running on a local or remote system. Techniques that run malicious code are often paired with techniques from all other tactics to achieve broader goals, like exploring a network or stealing data. For example, an adversary might use a remote access tool to run a PowerShell script that does Remote System Discovery.

T1059.003

Windows Command Shell

Adversaries may abuse the Windows command shell for execution. The Windows command shell (cmd) is the primary command prompt on Windows systems. The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands. The command prompt can be invoked remotely via Remote Services such as SSH.

TA0005

Defense Evasion

The adversary is trying to avoid being detected. Defense Evasion consists of techniques that adversaries use to avoid detection throughout their compromise. Techniques used for defense evasion include uninstalling/disabling security software or obfuscating/encrypting data and scripts. Adversaries also leverage and abuse trusted processes to hide and masquerade their malware. Other tactics' techniques are cross-listed here when those techniques include the added benefit of subverting defenses.

T1036.005

Match Legitimate Resource Name or Location

Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is done for the sake of evading defenses and observation.

T1055.012

Process Hollowing

Adversaries may inject malicious code into suspended and hollowed processes in order to evade process-based defenses. Process hollowing is a method of executing arbitrary code in the address space of a separate live process.

T1218.011

Rundll32

Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: rundll32.exe {DLLname, DLLfunction}).

TA0006

Credential Access

The adversary is trying to steal account names and passwords. Credential Access consists of techniques for stealing credentials like account names and passwords. Techniques used to get credentials include keylogging or credential dumping. Using legitimate credentials can give adversaries access to systems, make them harder to detect, and provide the opportunity to create more accounts to help achieve their goals.

T1003.001

LSASS Memory

Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory. These credential materials can be harvested by an administrative user or SYSTEM and used to conduct Lateral Movement using Use Alternate Authentication Material.