Skip to content

Latest commit

 

History

History
65 lines (54 loc) · 1.98 KB

set-thread-local-storage-value.md

File metadata and controls

65 lines (54 loc) · 1.98 KB
Raw
ID C0041
Objective(s) Process
Related ATT&CK Techniques None
Version 2.1
Created 4 December 2020
Last Modified 30 April 2024

Set Thread Local Storage Value

Malware allocates thread local storage.

Use in Malware

Name Date Method Description
Dark Comet 2008 -- Dark Comet sets thread local storage values. [1]
Gamut 2014 -- Gamut sets thread local storage values. [1]
Hupigon 2013 -- Hupigon sets thread local storage values. [1]
Kovter 2016 -- Kovter sets thread local storage values. [1]
Redhip 2011 -- Redhip sets thread local storage values. [1]
Rombertik 2015 -- Rombertik sets thread local storage values. [1]

Detection

Tool: capa Mapping APIs
set thread local storage value Set Thread Local Storage Value (C0041) kernel32.TlsSetValue

C0041 Snippet

Process::Set Thread Local Storage Value SHA256: 3ac8c22eb7c59d35fe49c20f2a0eca06765543dfb15f455a5557af4428066641 Location: 0x180005B08 
mov     param_2, rbx    ; Value to be stored in TLS index
mov     param_1, edi    ; TLS index
call    qword ptr [->KERNEL32.DLL::TlsSetValue] ; Call Windows API function to store value in thread's thread local storage (TLS) at the specified index

References

[1] capa v4.0, analyzed at MITRE on 10/12/2022