Windows Backdoor 'Sleepwalker' Hides in Memory Until Activated by a 'Magic Packet'

"The Register has a story about a Windows backdoor that waits silently in memory for a 'magic packet' before springing into action," writes Slashdot reader fred133. "No outgoing traffic, just waiting..." From the report: Like a sleeper cell awaiting activation, a never-before-seen Windows backdoor dubbed Sleepwalker waits silently in memory for one specifically crafted network packet to wake it up and deliver commands using the malware's 23-instruction language. The commands can do everything from running code directly in memory to moving data off the computer. Malware researcher Dominik Reichel discovered the passive backdoor, which also has its own command language, and detailed Sleepwalker in a technical analysis on Monday. "What makes it worth writing up is what that packet carries: not a readable command, but a short program written in a command language of the backdoor's own design," Reichel said. "Its 23 instructions cover scheduling, several ways to move data, staged file delivery and running code directly in memory. Recovering the encryption key is not enough to understand one of these programs. The internal command language must be reverse engineered as well."

In addition to having its own command language, it's also notable that the remote host can be a VMware VMCI target instead of a normal network address. "Taken as a whole, the approach here is consistent with a targeted, well-resourced operation rather than an opportunistic one," Reichel wrote. The malware, hidden inside a 64-bit Windows DLL file, impersonates Microsoft's dpapi.dll, part of Windows' data protection API for protecting sensitive data. It exports the same seven functions as the real dpapi.dll, but attempts to forward calls to a file named dpapisvc.dll, which is not a real Windows component. The file also has a forged ESET Management Agent version resource, and loads via side-loading into ERAAgent.exe, the Windows executable for ESET Management Agent. After confirming that its host process is named ERAAgent.exe, Sleepwalker goes to sleep inside the computer's memory, which also helps it remain hidden from traditional anti-virus tools.

Unlike most backdoors, which call back to an attacker-controlled command-and-control (C2) server and start receiving commands, Sleepwalker lies in wait, checking every packet that passes through the network looking for a specific pattern - this is called a magic packet. Once it sniffs out a packet that matches the exact pattern, the backdoor decrypts the data and treats it as a command. "Because the backdoor never sends anything out on its own and does not open any obvious listening port by default, tools that watch for connections to known-bad domains or unusual outbound traffic will not see anything unusual," Reichel wrote. "The absence of outbound connections to known-bad infrastructure does not rule out an infection, either. A machine can be fully compromised by this backdoor while producing nothing at all for a network monitor to flag."

Help Me Understand

[SlashbotAgent]

It sounds very similar to how a Wake-on-LAN trigger works. Based on how that works, it requires another machine on the LAN with a foothold to send the magic packet?

So, we're looking for the machine with the foothold and anything that even vaguely related to that PoS ESET?

Re:Help Me Understand

[Errol backfiring]

Maybe, maybe not. Wake-on-LAN works from a remote system, without an outgoing request first. If this malware is so sophisticated, it could wait for any other program to call to the outside world. If the attacker has access to the network, it can inject something in the answer, thus bypassing a firewall. This could trigger the action and be otherwise seen as a defective network package, which is just asked for again. Nobody would notice a defective network package. This sounds quite scary.

Re:Help Me Understand

[Bert64]

This.
It doesn't need to be a special packet, it could be a specific pattern hiding inside any packet received by the host. You don't need the ability to send traffic directly to the target, just the ability to interact with a traffic flow in or out of the system.

Re:Help Me Understand

[clovis]

It sounds very similar to how a Wake-on-LAN trigger works. Based on how that works, it requires another machine on the LAN with a foothold to send the magic packet?

So, we're looking for the machine with the foothold and anything that even vaguely related to that PoS ESET?

The real problem here is the eternal Windows problem of dll side-loading.
That allows a system dll to be impersonated and evade sfc scannow protection. How it gets activated is by far less of a problem than that the bad code is already resident in memory waiting for instruction.
Also, there's the problem that someone has gotten the privilege to put it there.

Re:

[gweihir]

It depends. If it can just be a special layer 3/4 payload and not a magic layer 2 package, you can send it from outside to any machine that is Internet-reachable.

Re: Help Me Understand

[Midnight_Falcon]

That's going to limit the attack surface area to very little. It's not the 90s where all machines have a public IP, like in PPP dialup. Everything is behind NAT and an external firewall device (or cloud equivalent like a load balancer and a security group). If you've got Windows devices such as endpoints with unfiltered direct Internet access, you're going to have a lot more security problems that are easier for attackers than sophisticated malware. For most endpoints, this would mean tricking the infe

Re: Help Me Understand

[Midnight_Falcon]

You would need another computer on the LAN, a compromised firewall/router, or the presence of port forwarding internet-accessible ports routed to the affected machine to deliver the magic packet. It would also work if you sent a link that causes the machine to visit a plaintext HTTP website or run a plaintext dns query that returns the magic packet. Then it must have unfettered access to hit it's C&C server over the internet without being detected by local antivirus or network based intrusion detectio

Backdoor is badly used term

[evanh]

A backdoor implies it is designed into the system. Ie: It was M$'s doing, and they wanted it there.

Re:

[gweihir]

True. MS is just responsible for utterly shoddy IT security and fostering a culture of insecurity and bad code. That does not make them directly responsible that criminal people use the opportunities they created. They are the root-cause for the problem though.

Re:

[noshellswill]

Nothing shoddy about SLEEPWALKER.  M$ coded it, but You own it, you paid for it and you maintain it.  You do pay taxes ... right ? So ...   all  courtesy of the 3-letter Government agency that wrote  SLEEPWALKERS specs & penned  the "Agricultural Research"  check to M$ .  Only problem is that tax-paying citizens get no explicit ROI.

I'm curious.

[fuzzyfuzzyfungus]

This sounds like it was written by someone who actually knows what they are doing, so I assume that they know better than I; but I am surprised to hear that it is impersonating a system dll; since (in all comparatively recent windows versions) system components are signed. Absolutely tons of fuckery you can do to them and around them; but if dpapi.dll doesn't have a signature that checks out the mechanisms that try to keep OSes up and running on marginal hardware subject to random power loss will likely eventually object and attempt a repair, even if there isn't any more paranoid EDR tooling in place.

Is the on-disk copy of dpapi.dll untouched and only the in-memory instance tampered with?

Re:

[sabbede]

It's sideloaded, in that the fake dpapi.dll is placed in ESET's folder next to the executables so they use it instead of the one in system32. It doesn't look like it's signed, but instead has vendor info in there to trick ESET.

Sideloading is the same trick Reshade uses to inject shaders.

Re:

[nadass]

It's worth reading the actual researcher's article for all of the technical details (including scripts for detection) -- cuz the question seems to indicate that you have not read the actual source.

Nevertheless, here's some technical pieces that might shed enough light for you:

Indicators of compromise
SHA-256: d347170752a28e2b8c4b8b9f3cab2e3a6541ba11682c94498d26eb9002779d60
An unexpected dpapi.dll beside ERAAgent.exe
An unexpected dpapisvc.dll in the same directory
EveryoneIncludesAnonymous set to 1
An unexpected entry in NullSessionPipes

The registry values require comparison with a known-good baseline and are not proof of SLEEPWALKER on their own.

so

[awwshit]

You get infected by running ESET?

Terminate and Stay Resident.

[Fly Swatter]

We had these in the days of DOS, of course they weren't quite so nefarious because everything and everyone in the entire world were not connected to each other like idiots.