Full Report
Huntress analysts recently observed a novel set of tactics, techniques, and procedures used by a threat actor for data collection and exfiltration.
Analysis Summary
# Tool/Technique: Memory Dumping via MemProcFS and Dokan File System
## Overview
This technique involves the use of legitimate forensic and file system tools—**MemProcFS** and the **Dokan File System driver**—to facilitate credential dumping and data collection. By mounting physical memory as a virtual file system, threat actors can access process memory (including sensitive processes like LSASS) as simple files, bypassing some traditional security monitoring that looks for direct memory access API calls (like `ReadProcessMemory`).
## Technical Details
- **Type:** Technique / Tool Manipulation (Living-off-the-Land adjacent)
- **Platform:** Windows
- **Capabilities:** Memory analysis, virtual file system mounting, credential dumping, and data exfiltration.
- **First Seen:** Reported by Huntress in December 2023.
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1219 - Remote Access Software] (TeamViewer)
- **[TA0006 - Credential Access]**
- [T1003.001 - OS Credential Dumping: LSASS Memory]
- **[TA0007 - Discovery]**
- [T1057 - Process Discovery]
- **[TA0009 - Collection]**
- [T1005 - Data from Local System]
- **[TA0010 - Exfiltration]**
- [T1567 - Exfiltration Over Web Service] (Inferred from context)
## Functionality
### Core Capabilities
- **Virtual Memory Mounting:** Uses the Dokan driver to mount the system's physical memory or specific process memory as a virtual drive (e.g., `M:\`).
- **File-Based Memory Access:** Enables the actor to interact with process memory using standard file system commands (like `copy` or `powershell` archiving) rather than specialized exploit code.
- **Stealthy Credential Dumping:** Facilitates the creation of `.dmp` files from active processes by simply navigating to a virtual folder (e.g., `M:\pid\[PID]\minidump\minidump.dmp`).
### Advanced Features
- **MemProcFS Integration:** Leverages a powerful forensic framework to translate complex memory structures into a human-readable folder hierarchy.
- **Bypassing EDR:** By using a legitimate file system driver (Dokan) to access memory, the actor may evade detections tuned to monitor specific "suspicious" API calls associated with credential theft.
## Indicators of Compromise
- **File Names:**
- `Dokan_x64.msi.zip`
- `MemProcFS.zip`
- `minidump.dmp`
- `dokanctl.exe`
- **Network Indicators:**
- `193[.]149[.]176[.]90` (Source of tool downloads)
- **Behavioral Indicators:**
- Short-duration TeamViewer sessions (e.g., ~18 seconds) with null or unusual user fields.
- Execution of `curl.exe` to download `.zip` or `.msi` files to `C:\Users\Public\`.
- Installation of the Dokan driver (`msiexec.exe /i ... Dokan_x64.msi`).
- Creation of unusual mount points (e.g., `\DosDevices\M:`).
- Use of `dokanctl.exe /r n` to remove the driver shortly after activity.
- Windows Event Log source "dokan2" with Event ID 1.
## Associated Threat Actors
- While specific group names were not identified in this report, the TTPs align with sophisticated actors focusing on data exfiltration and credential harvesting. Similar TeamViewer-based attacks have been linked to various ransomware precursors and cryptomining groups.
## Detection Methods
- **Signature-based detection:** Monitor for the presence of MemProcFS and Dokan driver binaries in non-developer or non-forensic environments.
- **Behavioral detection:**
- Alert on the mounting of new drives via `dokanctl.exe`.
- Monitor for `msiexec.exe` installing file system drivers from `C:\Users\Public\`.
- Alert on PowerShell or Command Prompt accessing paths containing `\minidump\minidump.dmp`.
- **Event Logs:** Monitor Windows Event Log for Event ID 1 from source "dokan2".
## Mitigation Strategies
- **Access Control:** Restrict the ability of standard users to install drivers or run `msiexec`.
- **Software Restriction:** Block or alert on the use of unauthorized remote access tools like TeamViewer; use enterprise-managed solutions with MFA.
- **Hardening:** Implement LSA Protection (`RunAsPPL`) to make credential dumping from LSASS more difficult.
- **Process Monitoring:** Audit the use of `curl.exe` and `powershell.exe` for downloading files from external, untrusted IP addresses.
## Related Tools/Techniques
- **LSASS Dumping:** Similar goal to Procdump or Comsvcs.dll dumping.
- **Impacket:** Often used in conjunction with credential theft for lateral movement.
- **Rclone:** Frequently used by similar actors for the exfiltration phase following data collection.