Kapeka Backdoor Loaded Via Rundll32.EXE

Detects the Kapeka Backdoor binary being loaded by rundll32.exe. The Kapeka loader drops a backdoor, which is a DLL with the '.wll' extension masquerading as a Microsoft Word Add-In.

View on GitHub Open raw file

Detection logic

selection

Image|endswith: \rundll32.exe
ImageLoaded|contains:
  - :\ProgramData
  - \AppData\Local\
ImageLoaded|re: "[a-zA-Z]{5,6}\\.wll"

Condition

selection

Raw YAML

title: Kapeka Backdoor Loaded Via Rundll32.EXE
id: a7e6b1f9-8d2c-4f1e-9a7d-63e4c8a2bf4c
status: test
description: |
    Detects the Kapeka Backdoor binary being loaded by rundll32.exe.
    The Kapeka loader drops a backdoor, which is a DLL with the '.wll' extension masquerading as a Microsoft Word Add-In.
references:
    - https://labs.withsecure.com/publications/kapeka
    - https://app.any.run/tasks/1efb3ed4-cc0f-4690-a0ed-24516809bc72/
author: Swachchhanda Shrawan Poudel
date: 2024-07-03
tags:
    - attack.execution
    - attack.stealth
    - attack.t1204.002
    - attack.t1218.011
    - detection.emerging-threats
logsource:
    category: image_load
    product: windows
detection:
    selection:
        Image|endswith: '\rundll32.exe'
        ImageLoaded|contains:
            - ':\ProgramData'
            - '\AppData\Local\'
        ImageLoaded|re: '[a-zA-Z]{5,6}\.wll'
    condition: selection
falsepositives:
    - Unknown
level: high

False positives

Unknown

References

Similar rules

MMC Executing Files with Reversed Extensions Using RTLO Abuse

high

windows · Shares T1204, T1218

Suspicious Microsoft Office Child Process

high

windows · Shares T1204, T1218

Suspicious WMIC Execution Via Office Process

high

windows · Shares T1204, T1218

Suspicious WmiPrvSE Child Process

high

windows · Shares T1204, T1218