Thread Info
  • State Not Answered
  • +2 person also asked this people also asked this
  • Replies 9 replies
  • Subscribers 9 subscribers
  • Views 6772 views
  • Users 0 members are here
Options
Suggested

Automate (Labtech) Issues

Matthew Cole

So I started testing the new EDR beta functions on my local machine and have been having the following false positives. It go so bad it even prevented me from starting the Automate Control Center on my machine, and I had to uninstall and roll back to normal.

'DynamicShellcode' exploit prevented in LTClient

'DynamicShellcode' exploit prevented in LTTray

No ammount of exceptions fixes this, as the PID and Detection ID change every time. I've included the raw data for the LT Client issue, but wasn't sure who to give this too.

 

itigation   DynamicShellcode
Timestamp    2020-06-03T15:01:10

Platform     10.0.18362/x64 v321 6f_02
PID          34160
Application  C:\Program Files (x86)\LabTech Client\LTClient.exe
Created      2020-05-13T22:43:46
Modified     2020-05-13T22:43:46
Description  LTClient 3.0

Shellcode (HHA) (0x00060000 bytes)
Owner of CALLER: (anonymous; clr.dll)

OwnerModule
Name         clr.dll
Thumbprint   7a33ad00e22a53d91dd1a6f097fd37d9c8a9cd3bd512070eb7ce988aaf722733
SHA-256      8c9899bf565c54bc2ee2fa11edf9b6840f44de77f1ecb050623f7560c7bfa807
SHA-1        1fb0ebc06f188e57f410cb2961d891ddbb314880
MD5          4853b707346cfb69b2052b9a00ae55b6

09AE44F8  ffd2                     CALL         EDX
09AE44FA  c6460801                 MOV          BYTE [ESI+0x8], 0x1
09AE44FE  833d4820da7300           CMP          DWORD [0x73da2048], 0x0
09AE4505  7407                     JZ           0x9ae450e
09AE4507  50                       PUSH         EAX
09AE4508  e8737dc369               CALL         0x7371c280
09AE450D  58                       POP          EAX
09AE450E  c745e800000000           MOV          DWORD [EBP-0x18], 0x0
09AE4515  8bf8                     MOV          EDI, EAX
09AE4517  e8a49cb969               CALL         0x7367e1c0
09AE451C  8bc7                     MOV          EAX, EDI
09AE451E  8b7ddc                   MOV          EDI, [EBP-0x24]
09AE4521  897e0c                   MOV          [ESI+0xc], EDI
09AE4524  8d65f4                   LEA          ESP, [EBP-0xc]
09AE4527  5b                       POP          EBX
09AE4528  5e                       POP          ESI

----- SNIP HERE -----
AAMFAQBArgn4RK4JAACuCQBQAADkBQQAi/DotKG5aYvGi3XYiXcMjWX0W15fXcMFBACQIpoHBQQAiCKaB9CWpwdXVovxuTiWpwfoivB4+I14BIPGGLk4BQMA86VeX8MFAgCoIpoHBQQAoCKaBwCWpweLQTjDBRgAAgUDAOi7sLhpXgUCAAydpwcFBAD0AwUAAAUAAAUAAAX2ALAimgcMnacHVYvsV1ZTg+wgiUXwZIs1KA4FAgDHRdik/WZzx0XUSED3+YtGDIlF3Ilt7MdF6AUEAI1F2IlGDIvZi/qLTfDoLfXEaYtF8ItAFIsQ/3UI/3UMV1PHReAQBQMAiWXkx0Xo+kSuCcZGCAD/0sZGCAGDPUgg2nMAdAdQ6HN9w2lYx0XoBQQAi/jopJy5aYvHi33ciX4MjWX0W15fXcIIBQAABQAABQAABQAABQAABQAABQAABQAABQAABQAABdMA
----- END SNIP -----

Loaded Modules
-----------------------------------------------------------------------------
003F0000-01DDE000 LTClient.exe (), 
                  version: 
75310000-75410000 hmpalert.dll (SurfRight B.V.), 
                  version: 3.7.17.317
75110000-7514E000 SOPHOS~1.DLL (Sophos Limited), 
                  version: 10.8.7.1000
6FF60000-709B5000 System.ni.dll (Microsoft Corporation), 
                  version: 4.8.4001.0 built by: NET48REL1LAST_C
5D3E0000-5D583000 System.Drawing.ni.dll (Microsoft Corporation), 
                  version: 4.8.3752.0 built by: NET48REL1
5A9A0000-5B806000 System.Windows.Forms.ni.dll (Microsoft Corporation), 
                  version: 4.8.4150.0 built by: NET48REL1LAST_C
6F1E0000-6F9F8000 System.Core.ni.dll (Microsoft Corporation), 
                  version: 4.8.4180.0 built by: NET48REL1LAST_B
5BED0000-5C2EB000 WindowsBase.ni.dll (Microsoft Corporation), 
                  version: 4.8.4180.0 built by: NET48REL1LAST_B
60130000-6025F000 CefSharp.Core.dll (), 
                  version: 57.0.0
0FC60000-13D73000 libcef.dll (), 
                  version: 3.2987.1601.gf035232
76E70000-76E7D000 UMPDC.dll (), 
                  version: 
600B0000-60124000 chrome_elf.dll (The Chromium Authors), 
                  version: 57.0.2987.133
70BF0000-70CF5000 System.Configuration.ni.dll (Microsoft Corporation), 
                  version: 4.8.3752.0 built by: NET48REL1
6EA60000-6F1D4000 System.Xml.ni.dll (Microsoft Corporation), 
                  version: 4.8.3752.0 built by: NET48REL1
59C10000-5A84C000 PresentationCore.ni.dll (Microsoft Corporation), 
                  version: 4.8.4180.0 built by: NET48REL1LAST_B
57940000-58D25000 PresentationFramework.ni.dll (), 
                  version: 
575F0000-577F3000 System.Xaml.ni.dll (Microsoft Corporation), 
                  version: 4.8.4180.0 built by: NET48REL1LAST_B
60060000-600A7000 System.Numerics.ni.dll (Microsoft Corporation), 
                  version: 4.8.3752.0 built by: NET48REL1
70DF0000-70F68000 SophosAmsiProvider.dll (Sophos Limited), 
                  version: 1.3.237.0

Process Trace
1  C:\Program Files (x86)\LabTech Client\LTClient.exe [34160]
2  C:\Windows\explorer.exe [10504]
3  C:\Windows\System32\userinit.exe [10316]
4  C:\Windows\System32\winlogon.exe [104]
winlogon.exe
5  C:\Windows\System32\smss.exe [920]
\SystemRoot\System32\smss.exe 000000e8 00000084 
6  C:\Windows\System32\smss.exe [608]
\SystemRoot\System32\smss.exe

Thumbprint
54ce4109bfd09310394331cd311a82ceb4b7b83e540307f4289f3cda924688a1
Module based thumbprint
7a33ad00e22a53d91dd1a6f097fd37d9c8a9cd3bd512070eb7ce988aaf722733