[SANS ISC] New Tool to Add to Your LOLBAS List: cvtres.exe , (Fri, Oct 1st)

LOLBAS (“Living Off the Land Binaries And Scripts”) is a list of tools[1] that are present on any Windows system because they are provided by Microsoft as useful tools to perform system maintenance, updates, etc. This list is maintained and upgraded regularly. This is a good starting point when you need to investigate suspicious processes activity on a system (proactively or in forensics investigation).

I spotted a piece of malicious script (SHA256:d3a85fbecfc581e1113de2ec8c97e8e15f0c06e9a0f8628269221669f5ca9726) with a VT score of 10/57[2]. It launches a PowerShell script nicely obfuscated. The behavior is classic, it performs code injection but it also compiles some code on the fly. csc.exe is used to build a DLL:

csc.exe /noconfig /fullpaths @”C:Usersuser01AppDataLocalTemp8dfrgm9n.cmdline”

The .cmdline file contains:

xfeff/t:library /utf8output /R:”System.dll” /R:”C:WindowsassemblyGAC_MSILSystem.Management.Automation1.0.0.0__31bf3856ad364e35System.Management.Automation.dll” /out:”C:Usersuser01AppDataLocalTemp8dfrgm9n.dll” /debug- /optimize+ “C:Usersuser01AppDataLocalTemp8dfrgm9n.0.cs”

And the .cs file:

xfeff using System; using System.Runtime.InteropServices; namespace pikl { public class jip { [Flags] public enum AllocationType { Commit = 14096-10000, Reserve = 8190+2 } [Flags] public enum MemoryProtection { ExecuteReadWrite = 60+4 } [Flags] public enum Time : uint { Infinite = 4294967294+1 } [DllImport(“ker”+”nel”+”32.d”+”ll”)] public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect); [DllImport(“ke”+”rnel3″+”2.dl”+”l”)] public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId); [DllImport(“k”+”ern”+”el32.dl”+”l”)] public static extern int WaitForSingleObject(IntPtr hHandle, Time dwMilliseconds); } }

Then the script calls another tool from the .Net framework: cvtres.exe:

cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 “/OUT:C:Usersuser01AppDataLocalTempRES4D10.tmp” “c:Usersuser01AppDataLocalTempCSC4D00.tmp”

What’s the purpose of this tool? CvtRes stands for “Convert Resource Files To COFF Objects”. It converts “.res” resource files into Common Object File Format (COFF[3]) “.obj” object files that the linker can link into a finished “.exe” PE application file.

The malware tries to connect to certificates[.]updatecenter[.]icu but it does not resolve at this time.

So, cvtres.exe is a new tool to add to your LOLBAS list!

[1] https://lolbas-project.github.io
[2] https://www.virustotal.com/gui/file/d3a85fbecfc581e1113de2ec8c97e8e15f0c06e9a0f8628269221669f5ca9726/details
[3] https://en.wikipedia.org/wiki/COFF

Xavier Mertens (@xme)
Senior ISC Handler – Freelance Cyber Security Consultant
PGP Key

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Source: Read More (SANS Internet Storm Center, InfoCON: green)

You might be interested in …

[ZDNet] This new password-stealing Windows malware is distributed via adverts for cracked software

All posts, ZDNet

MosaicLoader can be used to steal passwords, install cryptocurrency miners and deliver trojan malware warn researchers, who say those behind it want to sell access to Windows PCs on to other cyber criminals. Source: Read More (Latest topics for ZDNet in Security)

Read More

[ThreatPost] Monumental Supply-Chain Attack on Airlines Traced to State Actor

All posts, ThreatPost

Airlines are warned to scour networks for traces of the campaign, likely the work of APT41, lurking in networks. Source: Read More (Threatpost)

Read More

[SecurityWeek] Elastic to Acquire build.security for Cloud Security Expansion

All posts, Security Week

Search software giant Elastic NV is continuing its march into the cybersecurity business with Monday’s announcement of plans to acquire build.security, a red-hot Israeli startup that helps businesses enforce cloud security authorization policies. Financial terms of the acquisition were not disclosed.  read more Source: Read More (SecurityWeek RSS Feed)

Read More

Leave a Reply

Your email address will not be published.

This site uses Akismet to reduce spam. Learn how your comment data is processed.