Follow
Detection stack
- AIDR
- Alert
- ETL
- Query
Summary
HardBit 4.0 is a ransomware variant that leverages the Neshta file infector as its dropper and is delivered in both CLI and GUI builds. Unlike many modern crews, it is not tied to a double-extortion leak portal and may include an optional “Wiper” capability designed to irreversibly damage data. Execution is gated by a runtime authorization ID and an encryption key, effectively adding a passphrase-style control before encryption begins.
Investigation
The assessment suggests initial access commonly occurs through brute-force RDP activity using the NLBrute tool, followed by credential harvesting via Mimikatz. Lateral movement is then carried out over RDP with the stolen credentials, supported by discovery and scanning utilities such as KPortScan 3.0 and Advanced Port Scanner. Neshta is used to drop the ransomware into the %TEMP% directory and persist by altering the registry so the malware is invoked whenever any .exe is launched.
Mitigation
Require strong, unique passwords for RDP-enabled accounts and reduce external RDP exposure wherever possible. Watch for registry changes associated with Windows Defender tampering and the svchost.com persistence mechanism. Implement application allowlisting and behavioral controls to detect or block unauthorized use of Mimikatz and network scanning tools.
Response
If suspected activity is found, isolate the host, capture volatile evidence, and stop the ransomware process. Recover affected data from trusted backups only after confirming the threat actor has been fully removed. Complete forensic validation by reviewing registry modifications, scheduled tasks, and any credential-dump artifacts.
"graph TB %% Class definitions classDef action fill:#99ccff classDef tool fill:#ffcc99 classDef malware fill:#ff9999 classDef process fill:#ccffcc classDef operator fill:#ff9900 %% Technique nodes tech_bruteforce["<b>Technique</b> – <b>T1110 Brute Force</b><br/>Attempts to guess passwords by repeatedly trying credentials."] class tech_bruteforce action tech_exploit_remote["<b>Technique</b> – <b>T1210 Exploitation of Remote Services</b><br/>Uses valid credentials to access systems via RDP or SMB."] class tech_exploit_remote action tech_cred_dump["<b>Technique</b> – <b>T1003 OS Credential Dumping</b><br/>Extracts credentials from memory or registry."] class tech_cred_dump action tech_discovery["<b>Technique</b> – <b>T1018 Remote System Discovery</b><br/>Enumerates hosts, shares and open ports."] class tech_discovery action tech_rdp_lateral["<b>Technique</b> – <b>T1021.001 Remote Services: RDP</b><br/>Establishes RDP sessions for lateral movement."] class tech_rdp_lateral action tech_powershell["<b>Technique</b> – <b>T1059.001 PowerShell</b><br/>Runs PowerShell commands to modify Defender settings."] class tech_powershell action tech_obfuscation["<b>Technique</b> – <b>T1027 Obfuscated Files or Information</b><br/>Ransomware binary is .NETu2011obfuscated with ConfuserEx."] class tech_obfuscation action tech_proxy_exec["<b>Technique</b> – <b>T1218 System Binary Proxy Execution</b><br/>Uses ShellExecuteA to launch payload from dropper."] class tech_proxy_exec action tech_persistence["<b>Technique</b> – <b>T1547.014 Boot or Logon Autostart Execution: Active Setup</b><br/>Modifies HKLM registry for persistence."] class tech_persistence action tech_event_trigger["<b>Technique</b> – <b>T1546.002 Event Triggered Execution: Screensaver</b><br/>Runs dropper when screensaver activates."] class tech_event_trigger action tech_encryption["<b>Technique</b> – <b>T1486 Data Encrypted for Impact</b><br/>Encrypts files and displays ransom note."] class tech_encryption action tech_inhibit_recovery["<b>Technique</b> – <b>T1490 Inhibit System Recovery</b><br/>Deletes shadow copies and disables backup services."] class tech_inhibit_recovery action tech_service_stop["<b>Technique</b> – <b>T1489 Service Stop</b><br/>Stops security and backup services."] class tech_service_stop action tech_disk_wipe["<b>Technique</b> – <b>T1561 Disk Wipe</b><br/>Stops services and may activate wiper mode to destroy data."] class tech_disk_wipe action %% Tool nodes tool_nlbrute["<b>Tool</b> – <b>Name</b>: NLBrute<br/><b>Description</b>: Bruteu2011forces RDP and SMB services."] class tool_nlbrute tool tool_mimikatz["<b>Tool</b> – <b>Name</b>: Mimikatz<br/><b>Description</b>: Dumps credentials from memory and SAM."] class tool_mimikatz tool tool_kportscan["<b>Tool</b> – <b>Name</b>: KPortScan<br/><b>Description</b>: Scans ports on remote hosts."] class tool_kportscan tool tool_adv_port_scanner["<b>Tool</b> – <b>Name</b>: Advanced Port Scanner<br/><b>Description</b>: Enumerates open ports and services."] class tool_adv_port_scanner tool tool_new_exe["<b>Tool</b> – <b>Name</b>: 5u2011NS new.exe<br/><b>Description</b>: Custom scanner for host enumeration."] class tool_new_exe tool tool_powershell_cmd["<b>Tool</b> – <b>Name</b>: PowerShell Setu2011MpPreference<br/><b>Description</b>: Disables Windows Defender features."] class tool_powershell_cmd tool tool_confuserex["<b>Tool</b> – <b>Name</b>: ConfuserEx<br/><b>Description</b>: .NET obfuscator used on ransomware binary."] class tool_confuserex tool tool_shellexecute["<b>Tool</b> – <b>Name</b>: ShellExecuteA API<br/><b>Description</b>: Executes files via system binaries."] class tool_shellexecute tool tool_vssadmin["<b>Tool</b> – <b>Name</b>: vssadmin<br/><b>Description</b>: Deletes Volume Shadow Copies."] class tool_vssadmin tool tool_wbadmin["<b>Tool</b> – <b>Name</b>: wbadmin<br/><b>Description</b>: Disables backup services."] class tool_wbadmin tool tool_bcdedit["<b>Tool</b> – <b>Name</b>: bcdedit<br/><b>Description</b>: Modifies boot configuration data."] class tool_bcdedit tool %% Connections between techniques tech_bruteforce –>|leads_to| tech_exploit_remote tech_exploit_remote –>|leads_to| tech_cred_dump tech_cred_dump –>|leads_to| tech_discovery tech_discovery –>|leads_to| tech_rdp_lateral tech_rdp_lateral –>|leads_to| tech_powershell tech_powershell –>|leads_to| tech_obfuscation tech_obfuscation –>|leads_to| tech_proxy_exec tech_proxy_exec –>|leads_to| tech_persistence tech_persistence –>|leads_to| tech_event_trigger tech_event_trigger –>|leads_to| tech_encryption tech_encryption –>|leads_to| tech_inhibit_recovery tech_inhibit_recovery –>|leads_to| tech_service_stop tech_service_stop –>|leads_to| tech_disk_wipe %% Technique to tool usage tech_bruteforce –>|uses| tool_nlbrute tech_cred_dump –>|uses| tool_mimikatz tech_discovery –>|uses| tool_kportscan tech_discovery –>|uses| tool_adv_port_scanner tech_discovery –>|uses| tool_new_exe tech_powershell –>|uses| tool_powershell_cmd tech_obfuscation –>|uses| tool_confuserex tech_proxy_exec –>|uses| tool_shellexecute tech_inhibit_recovery –>|uses| tool_vssadmin tech_inhibit_recovery –>|uses| tool_wbadmin tech_inhibit_recovery –>|uses| tool_bcdedit "
Attack Flow
Detections
Suspicious Wbadmin Tool Activity (via cmdline)
View
LOLBAS WScript / CScript (via process_creation)
View
Disabling Windows Defender Protections (via registry_event)
View
Suspicious Bcdedit Execution (via cmdline)
View
Create or Delete Shadow Copy via Powershell, CMD or WMI (via cmdline)
View
Suspicious VSSADMIN Activity (via cmdline)
View
IOCs (Emails) to detect: HardBit 4.0 Ransomware Analysis
View
Detection of Windows Defender Security Features Tampering by HardBit 4.0 [Windows Registry Event]
View
Detection of Mimikatz Execution via Custom Batch Script [Windows Process Creation]
View
Simulation Execution
Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.
Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.
-
Attack Narrative & Commands:
The adversary has obtained local administrative privileges on a compromised workstation. To harvest credentials, they drop a custom batch file named!start.batinto the same directory asmimikatz.exe. The batch file simply launches mimikatz with theprivilege::debugandsekurlsa::logonpasswordscommands. By invoking the batch file from a PowerShell prompt, the command line recorded by Event 4688 will contain the literal string!start.bat, satisfying the detection condition. -
Regression Test Script:
# --------------------------------------------------------- # Setup: create a temporary directory and place mimikatz # --------------------------------------------------------- $tempDir = "$env:TEMPmimikatz_test" New-Item -ItemType Directory -Force -Path $tempDir | Out-Null # Assume mimikatz.exe is available at C:Toolsmimikatz.exe Copy-Item -Path "C:Toolsmimikatz.exe" -Destination $tempDir -Force # --------------------------------------------------------- # Create the custom batch script !start.bat # --------------------------------------------------------- $batPath = Join-Path $tempDir "!start.bat" @' @echo off "mimikatz.exe" "privilege::debug" "sekurlsa::logonpasswords" exit '@ | Set-Content -Path $batPath -Encoding ASCII # --------------------------------------------------------- # Execute the batch script (this is the step that should fire) # --------------------------------------------------------- $cmd = "cmd.exe /c `"$batPath`"" Start-Process -FilePath "cmd.exe" -ArgumentList "/c `"$batPath`"" -WorkingDirectory $tempDir -NoNewWindow # --------------------------------------------------------- # Wait a short period to ensure the event is logged # --------------------------------------------------------- Start-Sleep -Seconds 5 -
Cleanup Commands:
# Remove the temporary directory and all artifacts Remove-Item -Path $tempDir -Recurse -Force