Full Report
Hackers could be outsmarting preventive tools by making trivial changes to default settings. We dive into our research in this blog.
Analysis Summary
# Tool/Technique: Randomized API Hashing Evasion
## Overview
This technique involves modifying the default hashing algorithms used by malware and offensive frameworks (specifically Cobalt Strike and Metasploit) to resolve Windows API functions. By changing the default rotation value (typically ROR13) or the hashing logic, attackers can bypass security products that rely on static signatures of known API hash values to detect shellcode.
## Technical Details
- **Type:** Evasion Technique / Shellcode Modification
- **Platform:** Windows
- **Capabilities:**
- Obfuscates API calls to bypass Import Address Table (IAT) analysis.
- Dynamically resolves function addresses at runtime.
- Evades static signature-based detection (AV/EDR) targeting default "ROR13" hash constants.
- **First Seen:** Historically used by Metasploit/Cobalt Strike; research into randomization published February 2022.
## MITRE ATT&CK Mapping
- **[TA0005 - Defense Evasion]**
- **[T1027 - Obfuscated Files or Information]**
- **[T1027.007 - Dynamic API Resolution]**
## Functionality
### Core Capabilities
- **Dynamic API Resolution:** Instead of importing functions like `CreateFileW` or `VirtualAlloc` directly, the shellcode iterates through the Export Address Table (EAT) of Windows DLLs, hashes each function name, and compares it to a pre-calculated hash.
- **Stealth:** By avoiding the Import Table, the malware makes it difficult for analysts to determine its functionality through static analysis (e.g., using PeStudio).
### Advanced Features
- **Algorithm Randomization:** By changing the standard "Rotate Right 13" (ROR13) bitwise operation to a different value (e.g., ROR15 or ROL7), the attacker generates entirely different hash values for the same API names.
- **FUD (Fully Undetectable) Status:** Because many security vendors alert specifically on the hex strings associated with default Metasploit/Cobalt Strike ROR13 hashes, trivial changes to the rotation constant render those signatures useless.
## Indicators of Compromise
- **File Hashes:** N/A (This is a technique applied to various payloads).
- **Behavioral Indicators:**
- Manual traversal of the Process Environment Block (PEB) and Export Address Tables (EAT) of `kernel32.dll`, `ntdll.dll`, or `wininet.dll`.
- Shellcode containing tight loops with bitwise rotation instructions (`ror`, `rol`) followed by an `add` or `xor` operation.
## Associated Threat Actors
- **Commodity Malware Operators:** Frequently use default Metasploit/Cobalt Strike payloads.
- **Advanced Persistent Threats (APTs):** Known to customize hashing algorithms to maintain long-term persistence and evade EDR.
## Detection Methods
- **Behavioral Detection:** Monitor for processes that programmatically access the PEB to find loaded modules rather than using standard loaders.
- **YARA Rules:** Instead of searching for specific hash values, focus on the **code block** that performs the hashing.
- *Example logic:* Search for the assembly sequence: `lodsb`, `ror/rol [register], [constant]`, `add/xor`, and `loop`.
- **Memory Scanning:** Use tools like Huntress or specialized EDR tasks to scan for unbacked executable memory regions containing these hashing stubs.
## Mitigation Strategies
- **Endpoint Detection & Response (EDR):** Deploy EDR solutions that utilize behavioral triggers (e.g., suspicious API resolution patterns) rather than relying solely on static file signatures.
- **Attack Surface Reduction:** Implement rules to block the execution of unsigned scripts or unauthorized memory allocations (`VirtualAllocEx` with `PAGE_EXECUTE_READWRITE`).
- **Hardening:** Use PowerShell Constrained Language Mode and block common attack tools through AppLocker or Windows Defender Application Control (WDAC).
## Related Tools/Techniques
- **Cobalt Strike / Metasploit:** The primary frameworks utilizing ROR13 by default.
- **HellsGate / HeavensGate:** Advanced techniques for direct system calls that also bypass standard API monitoring.
- **Reflective DLL Injection:** Often utilizes similar hashing techniques to load libraries in memory without using the Windows Loader.