mandiant-capa-rules/load-code/shellcode/execute-shellcode-via-copyfile2.yml

rule:
  meta:
    name: execute shellcode via CopyFile2
    namespace: load-code/shellcode
    authors:
      - jakub.jozwiak@mandiant.com
    scope: function
    references:
      - https://github.com/S4R1N/AlternativeShellcodeExec/blob/master/CopyFile2/CopyFile2.cpp
    examples:
      - c2bb17c12975ea61ff43a71afd9c3ff111d018af161859abae0bdb0b3dae98f9:0x140001010
  features:
    - and:
      - or:
        - match: allocate RWX memory
        - basic block:
          - and:
            # xor     ecx, ecx        ; lpAddress
            # mov     edx, 31Fh       ; dwSize
            # mov     r8d, 1000h      ; flAllocationType
            # lea     r9d, [rcx+40h]  ; flProtect
            # call    cs:VirtualAlloc
            - match: allocate memory
            - or:
              - number: 0x40
              - instruction:
                - mnemonic: lea
                - offset: 0x40
      - api: CopyFile2
      - api: DeleteFileW
      - number: 0x00000001 = COPY_FILE_FAIL_IF_EXISTS
      - number: 0x20 = sizeof(COPYFILE2_EXTENDED_PARAMETERS)