SYMBOLCOMMON_NAMEaka. SYNONYMS
win.alpc_lpe (Back to overview)

ALPC Local PrivEsc


There is no description at this point.

References
2018-09-05ESET ResearchMatthieu Faou
@online{faou:20180905:powerpool:5cde83e, author = {Matthieu Faou}, title = {{PowerPool malware exploits ALPC LPE zero‑day vulnerability}}, date = {2018-09-05}, organization = {ESET Research}, url = {https://www.welivesecurity.com/2018/09/05/powerpool-malware-exploits-zero-day-vulnerability/}, language = {English}, urldate = {2019-11-14} } PowerPool malware exploits ALPC LPE zero‑day vulnerability
ALPC Local PrivEsc PowerPool
Yara Rules
[TLP:WHITE] win_alpc_lpe_auto (20211008 | Detects win.alpc_lpe.)
rule win_alpc_lpe_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2021-10-07"
        version = "1"
        description = "Detects win.alpc_lpe."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.alpc_lpe"
        malpedia_rule_date = "20211007"
        malpedia_hash = "e5b790e0f888f252d49063a1251ca60ec2832535"
        malpedia_version = "20211008"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 488b00 48038528010000 48894508 4533c0 488b5508 }
            // n = 5, score = 100
            //   488b00               | imul                eax, eax, 0x12c
            //   48038528010000       | dec                 eax
            //   48894508             | lea                 ecx, dword ptr [0xa546]
            //   4533c0               | dec                 eax
            //   488b5508             | add                 ecx, eax

        $sequence_1 = { e8???????? 48833808 7356 488b8df8000000 e8???????? }
            // n = 5, score = 100
            //   e8????????           |                     
            //   48833808             | dec                 eax
            //   7356                 | lea                 edx, dword ptr [ebp + 0x50]
            //   488b8df8000000       | dec                 eax
            //   e8????????           |                     

        $sequence_2 = { 488bfc b932000000 b8cccccccc f3ab 488b8c24e8000000 488b85e0000000 488b4008 }
            // n = 7, score = 100
            //   488bfc               | dec                 eax
            //   b932000000           | mov                 dword ptr [ebp + 0xf8], eax
            //   b8cccccccc           | mov                 dword ptr [ebp + 0x118], 0
            //   f3ab                 | dec                 eax
            //   488b8c24e8000000     | mov                 dword ptr [ebp + 0xd8], eax
            //   488b85e0000000       | dec                 eax
            //   488b4008             | mov                 ecx, dword ptr [ebp + 0x100]

        $sequence_3 = { e8???????? 488d0decb30000 e8???????? 488d0df0b30000 }
            // n = 4, score = 100
            //   e8????????           |                     
            //   488d0decb30000       | mov                 eax, 0xcccccccc
            //   e8????????           |                     
            //   488d0df0b30000       | rep stosd           dword ptr es:[edi], eax

        $sequence_4 = { e8???????? 90 488b8d20010000 e8???????? 90 488b8520010000 488da508010000 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   90                   | lea                 ecx, dword ptr [0x9b7f]
            //   488b8d20010000       | mov                 eax, 8
            //   e8????????           |                     
            //   90                   | dec                 eax
            //   488b8520010000       | imul                eax, eax, 0
            //   488da508010000       | dec                 eax

        $sequence_5 = { 488bd1 488bc8 e8???????? 488b5508 488b8d10010000 e8???????? }
            // n = 6, score = 100
            //   488bd1               | dec                 eax
            //   488bc8               | mov                 eax, ecx
            //   e8????????           |                     
            //   488b5508             | dec                 eax
            //   488b8d10010000       | cmp                 eax, 0x2f
            //   e8????????           |                     

        $sequence_6 = { 483908 730c 488b8d20010000 e8???????? 488b8d20010000 e8???????? 488b8d28010000 }
            // n = 7, score = 100
            //   483908               | lea                 ecx, dword ptr [0xabe1]
            //   730c                 | dec                 eax
            //   488b8d20010000       | lea                 ecx, dword ptr [0xaef9]
            //   e8????????           |                     
            //   488b8d20010000       | dec                 eax
            //   e8????????           |                     
            //   488b8d28010000       | lea                 ecx, dword ptr [0xaedd]

        $sequence_7 = { 488b8d48010000 48894c2458 488b8d40010000 48894c2450 488b8d38010000 48894c2448 8b8d30010000 }
            // n = 7, score = 100
            //   488b8d48010000       | mov                 dword ptr [esp + 0x20], 0
            //   48894c2458           | jmp                 0xd2f
            //   488b8d40010000       | mov                 eax, dword ptr [esp + 0x20]
            //   48894c2450           | dec                 eax
            //   488b8d38010000       | imul                eax, eax, 0
            //   48894c2448           | dec                 eax
            //   8b8d30010000         | lea                 ecx, dword ptr [0xd732]

        $sequence_8 = { 488b00 488901 488b85c8000000 488985d8000000 }
            // n = 4, score = 100
            //   488b00               | dec                 eax
            //   488901               | lea                 eax, dword ptr [0x8ca9]
            //   488b85c8000000       | dec                 eax
            //   488985d8000000       | mov                 ecx, dword ptr [eax + ecx*8]

        $sequence_9 = { 486b856801000010 48894508 48817d0800100000 0f82dc020000 488b8560010000 48894528 488b4528 }
            // n = 7, score = 100
            //   486b856801000010     | dec                 eax
            //   48894508             | mov                 dword ptr [ebp + 0x2f8], eax
            //   48817d0800100000     | dec                 eax
            //   0f82dc020000         | lea                 ecx, dword ptr [ebp + 0x68]
            //   488b8560010000       | nop                 
            //   48894528             | dec                 eax
            //   488b4528             | lea                 ecx, dword ptr [ebp + 0x68]

    condition:
        7 of them and filesize < 540672
}
Download all Yara Rules