DLL Side-Loading for Fun (and Profit?)

As I wanted to blog more this year I’ll start a mini-series of blog post detailing various signed executables that can be used for side-loading arbitrary code. Some of them I used in engagements, some I discovered and saved for later.

But let me start by quoting the excellent MITRE ATT&CK matrix regarding this technique (ID: T1073):

DLL Side-Loading Programs may specify DLLs that are loaded at runtime. Programs that improperly or vaguely specify a required DLL may be open to a vulnerability in which an unintended DLL is loaded. Side-loading vulnerabilities specifically occur when Windows Side-by-Side (WinSxS) manifests are not explicit enough about characteristics of the DLL to be loaded. Adversaries may take advantage of a legitimate program that is vulnerable to side-loading to load a malicious DLL.

Adversaries likely use this technique as a means of masking actions they perform under a legitimate, trusted system or software process.

Well-known examples are mcoemcpy.exe or RasTlsc.exe used by the OceanLotus APT:

• Executable: mcoemcpy.exe
• SHA256: 3124fcb79da0bdf9d0d1995e37b06f7929d83c1c4b60e38c104743be71170efe
• SHA1: d201b130232e0ea411daa23c1ba2892fe6468712
• MD5: 884d46c01c762ad6ddd2759fd921bf71

• Certificate: McAfee, Inc./VeriSign Class 3 Code Signing 2004 CA/Class 3 Public Primary Certification Authority

• Executable: RasTlsc.exe
• SHA256: f9ebf6aeb3f0fb0c29bd8f3d652476cd1fe8bd9a0c11cb15c43de33bbce0bf68
• SHA1: 2616da1697f7c764ee7fb558887a6a3279861fac
• MD5: 62944e26b36b1dcace429ae26ba66164
• Certificate: Symantec Corporation/VeriSign Class 3 Code Signing 2004 CA/Class 3 Public Primary Certification Authority

Before disclosing the first entry in this series, let me introduce a skeleton DLL that I’ll be using for demonstrating the code execution. The DLL is written in PureBasic, as most of my code for automatically detecting these side-loading issues is written in PureBasic.

; ***************************************************************************
; *                                                                         *
; * Author:      marpie (marpie@a12d404.net)                                *
; * License:     BSD 2-clause                                               *
; * Copyright:   (c) 2019, a12d404.net                                      *
; * Status:      Prototype                                                  *
; * Created:     20190101                                                   *
; * Last Update: 20190101                                                   *
; *                                                                         *
; ***************************************************************************
EnableExplicit

; ---------------------------------------------------------------------------
;- Prototypes
Macro LoopForever()
  Sleep_(-1)
EndMacro

; ---------------------------------------------------------------------------
;- Exports: goopdate.dll - GoogleUpdate.exe - 32bit

ProcedureDLL.l DllEntry()
  OutputDebugString_("DllEntry()")
  ;LoopForever()
EndProcedure

; ---------------------------------------------------------------------------

ProcedureDLL AttachProcess(Instance)
  OutputDebugString_("AttachProcess()")
EndProcedure

ProcedureDLL DetachProcess(Instance)
  OutputDebugString_("DetachProcess()")
EndProcedure

ProcedureDLL AttachThread(Instance)
  OutputDebugString_("AttachThread()")
EndProcedure

ProcedureDLL DetachThread(Instance)
  OutputDebugString_("DetachThread()")
EndProcedure

But now, let’s start of by abusing the Google Chrome Updater (GoogleUpdate.exe):

• Name: Google Update(x86)
• Executable: GoogleUpdate.exe
• SHA256: f1f67830fc3531dfbdaf5315f59422438ab9f243d89491ac75d1818e7ed98b5d
• SHA1: ae73b2e2ea5dca80c5a98907a6786124edaa7623
• MD5: 605ccc9ce1839bc5583017df7cae27a6
• Certificate: Google Inc/Thawte Code Signing CA - G2/thawte Primary Root CA

Google Update imports the DLL goopdate.dll and calls the function DllEntry.

Download: I do not provide the executables in question as they can easily be found on the Internet and I don’t want any eager companies to send me DMCA take-down letters ;-). Hybrid Analysis / reverse.it or VirusTotal are always happy to help with downloads for these files…

A description of all executables will be collected on Github: signed-loaders

Other parts of this series:

• Day 2
• Day 3