Full Report
New and modified malware detonation capabilities in Group-IB’s Managed XDR and Business Email Protection solutions for precise threat detection and analysis
Analysis Summary
# Tool/Technique: Group-IB Malware Detonation Platform (Updates)
## Overview
The Group-IB Malware Detonation Platform is a sandboxing and analysis engine integrated into Managed XDR and Business Email Protection solutions. Its primary purpose is the safe execution (detonation) of suspicious files and links to identify malicious behavior, bypass evasion techniques, and extract actionable threat intelligence.
## Technical Details
- **Type:** Analysis Tool / Sandbox Framework
- **Platform:** Windows (Cross-platform analysis capabilities)
- **Capabilities:** Automated interaction (button recognition), manual RDP access, artifact extraction, and configuration parsing.
- **First Seen:** N/A (Feature update report)
## MITRE ATT&CK Mapping
- **[TA0002 - Execution]**
- [T1204.002 - User Execution: Malicious File]
- **[TA0005 - Defense Evasion]**
- [T1497.001 - Virtualization/Sandbox Evasion: System Checks]
- [T1497.002 - Virtualization/Sandbox Evasion: User Activity Replication]
- **[TA0007 - Discovery]**
- [T1082 - System Information Discovery]
- **[TA0011 - Command and Control]**
- [T1071 - Application Layer Protocol]
## Functionality
### Core Capabilities
- **Automated Button Recognition:** The platform identifies and clicks buttons within application installers or document prompts (e.g., "Install," "Next," "Enable Content") to trigger malicious payloads that require human interaction.
- **Artifact Extraction:** Automatically gathers files created during runtime, modified registry keys, mutexes, and memory fragments.
- **Network Traffic Analysis:** Captures and logs all network requests initiated by the malware during detonation.
### Advanced Features
- **Interactive Analysis (Embedded RDP):** Analysts can manually connect to the virtual machine via an embedded RDP client to bypass specific anti-analysis checks that require non-standard user input.
- **Automated Config Extraction:** The platform decodes and extracts internal malware configurations, including hardcoded C2 servers and command sets.
- **API Integration:** Analysis results and extracted artifacts can be exported via API for use in external SIEM/SOAR systems for automated threat hunting.
## Indicators of Compromise
*Note: The article provides a specific example of a detonated sample.*
### Malware Sample (Loki PWS)
- **SHA1:** `8247a571f464aadfc1ccbed4c3221316246a1fcc`
- **Behavioral Indicators:**
- Attempts to evade detection by remaining dormant until specific UI buttons are clicked.
- Creation of specific mutexes and registry keys (accessible via the platform's artifact report).
### Network Indicators
- **C2 Servers:** Automatically extracted from the malware configuration during detonation (specific domains defanged in reports).
## Associated Threat Actors
- **Loki PWS Users:** Various cybercrime actors focusing on credential theft and information stealing.
## Detection Methods
- **Behavioral Detection:** Identifying malware that waits for user interaction (e.g., specific mouse clicks or button presses) before executing malicious code.
- **Heuristic Analysis:** Monitoring for automated extraction of encrypted configurations from memory fragments during the detonation process.
- **Memory Forensics:** Detection of malicious payloads injected into memory during the execution phase.
## Mitigation Strategies
- **Sandbox Detonation:** Always execute suspicious email attachments and web links in a managed detonation environment before allowing them into the production network.
- **Interaction Replication:** Use security solutions that can simulate human behavior to "trick" evasion-aware malware into revealing its payload.
- **Endpoint Monitoring:** Deploy XDR solutions to monitor for the specific artifacts (registry changes, mutexes) identified during the detonation stage.
## Related Tools/Techniques
- **Loki PWS:** An information stealer often used to demonstrate detonation capabilities.
- **Anti-Sandboxing Techniques:** Techniques used by malware to detect virtualized environments or lack of user interaction.