Bitdefender Submission Wizard - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/bitdefender-submission-wizard/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 03 Jan 2024 12:00:00 +0000Rundll32 Execution with Log.DLLhttps://feed.craftedsignal.io/briefs/2024-01-rundll32-logdll/Wed, 03 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-rundll32-logdll/Detects the execution of rundll32 with 'log.dll' as a command-line argument, indicative of Lotus Blossom Chrysalis backdoor activity and DLL sideloading attempts.This threat brief focuses on the abuse of rundll32.exe to execute malicious DLLs, specifically log.dll, a technique associated with the Lotus Blossom group's Chrysalis backdoor. The attacker places a rogue log.dll in a location such as %AppData%\Bluetooth and leverages rundll32.exe to invoke a specific function within the DLL (e.g., LogInit). This execution decrypts and runs shellcode. While some legitimate applications like the Bitdefender Submission Wizard also use log.dll, they are susceptible to DLL sideloading attacks, making this detection crucial for identifying malicious activity that bypasses traditional defenses. This campaign was first reported in 2026 and continues to be a relevant threat.

Attack Chain

  1. The attacker gains initial access, often through social engineering or exploiting software vulnerabilities (not specified in source).
  2. A malicious log.dll is placed in a writable directory, such as %AppData%\Bluetooth, mimicking a legitimate DLL location.
  3. The attacker uses rundll32.exe to execute the malicious log.dll with a specific function call (e.g., rundll32.exe log.dll,LogInit).
  4. Rundll32.exe loads and executes the log.dll.
  5. The LogInit function in log.dll decrypts embedded shellcode.
  6. The shellcode is injected into a legitimate process or executed directly, establishing persistence or escalating privileges.
  7. The injected shellcode connects to a command-and-control (C2) server to download additional payloads or receive instructions.
  8. The attacker performs actions on the compromised system, such as data exfiltration, lateral movement, or installing additional malware.

Impact

Successful exploitation can lead to complete system compromise, data theft, and the installation of persistent backdoors. The Lotus Blossom group has been known to target organizations across various sectors. The ability to bypass traditional security measures through DLL sideloading makes this a high-impact threat. Even legitimate software can become an attack vector.

Recommendation

  • Deploy the Sigma rule Rundll32 Execution with Log.DLL to detect malicious rundll32.exe executions using log.dll (logsource: process_creation).
  • Investigate any rundll32.exe process executions with log.dll as a command-line argument, especially when originating from unusual paths (Sigma rule Rundll32 Execution with Log.DLL).
  • Monitor for suspicious file creations or modifications in %AppData%\Bluetooth or other common DLL sideloading locations (logsource: file_event).
  • Implement application control policies to restrict the execution of rundll32.exe from untrusted locations.
  • Audit systems for DLL sideloading vulnerabilities in legitimate applications.
]]>highthreatrundll32dll-sideloadinglotus-blossomchrysalis-backdoorBitdefender Submission Wizard DLL Sideloadinghttps://feed.craftedsignal.io/briefs/2024-01-02-bitdefender-dll-sideloading/Tue, 02 Jan 2024 10:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-02-bitdefender-dll-sideloading/Detection of potential DLL side-loading of Bitdefender Submission Wizard (BDSubmit.exe, bdsw.exe, or renamed BluetoothService.exe) via loading a malicious log.dll from a non-standard path.This threat brief addresses the potential DLL side-loading attack targeting Bitdefender Submission Wizard (BDSubmit.exe, bdsw.exe, or renamed BluetoothService.exe). The attack involves a malicious actor placing a rogue log.dll in a directory where the legitimate Bitdefender executable will load it, thus executing attacker-controlled code. This technique is associated with the Lotus Blossom group (G0065). The observed activity relies on exploiting the DLL search order to execute arbitrary code. Defenders should monitor for instances of BDSubmit.exe, bdsw.exe, or BluetoothService.exe loading log.dll from unexpected paths outside of standard installation directories such as "Program Files" or "Windows\System32".

Attack Chain

  1. The attacker gains initial access to the system (method unspecified in source).
  2. The attacker identifies a vulnerable executable, such as BDSubmit.exe or bdsw.exe.
  3. The attacker crafts a malicious log.dll.
  4. The attacker places the malicious log.dll in the same directory as the Bitdefender executable, or in a directory that takes precedence in the DLL search order.
  5. A user executes the legitimate Bitdefender Submission Wizard executable (BDSubmit.exe, bdsw.exe, or renamed BluetoothService.exe).
  6. The legitimate application attempts to load log.dll. Due to DLL side-loading, the malicious log.dll is loaded instead of the legitimate one.
  7. The malicious log.dll executes attacker-controlled code within the context of the Bitdefender Submission Wizard process.
  8. The attacker achieves code execution for persistence or privilege escalation.

Impact

Successful exploitation through DLL side-loading allows attackers to execute arbitrary code within a trusted process. This can lead to privilege escalation, persistence, and potentially complete system compromise. Specific impacts include unauthorized access to sensitive data, installation of malware, and lateral movement within the network. The Lotus Blossom group has been known to use similar techniques to deploy backdoors.

Recommendation

  • Enable Sysmon ImageLoad events (EventCode 7) to monitor DLL loading activity and ensure the Splunk Add-on for Sysmon is configured to parse them as described in the "how_to_implement" section.
  • Deploy the Sigma rule "Bitdefender Submission Wizard DLL Sideloading" to detect instances where log.dll is loaded from a non-standard path, and tune for your environment.
  • Investigate any alerts generated by the provided detection rule, focusing on the "dest" and "User" fields as described in the "drilldown_searches" section.
  • Monitor for the execution of BDSubmit.exe, bdsw.exe, or BluetoothService.exe from unusual locations or with unusual command-line arguments.
  • Review and harden DLL search order configurations to prevent side-loading attacks (T1574.002).
]]>highthreatdll-sideloadingpersistenceprivilege-escalationlotus-blossomsysmon