#WHAT IS A DLL FILE? .DLL#
#WHAT IS A DLL FILE? FULL#

Due to the default search order built into Windows, the signed binary will load the malicious DLL and continue the malicious execution flow. X-Force has observed DLL side-loading used by the Metamorfo banking Trojan, which drops malicious MSI files that extract a signed binary and a malicious DLL to execute a second-stage malware loader.

#WHAT IS A DLL FILE? .DLL#

DLL Side-Loading Threat LandscapeДLL side-loading is not a new technique, as the search-order hijacking vulnerability within Windows has existed since Windows XP. The first location that Windows will search is the directory from which the application is loaded.ДЄ DLL side-loading attack is an adversarial technique that aims to take advantage of weak library references and the default Windows search order by placing a malicious DLL file masquerading as a legitimate DLL on a system, which will be automatically loaded by a legitimate program.ДЇor more information regarding DLL side-loading, reference MITRE ATT&CK Technique T1574.002. If a weak reference is made to a library, Windows attempts to locate the DLL through a pre-defined search order. If a manifest refers to only a library filename, it is considered a weak reference and is vulnerable to a DLL side-loading attack.

#WHAT IS A DLL FILE? FULL#

A program manifest can include DLL redirections, filenames or full paths. A program manifest is an external file or embedded resource within an application used to manage the names and versions of shared side-by-side assemblies to which the application should load upon execution.

In Microsoft Windows, programs can define which libraries are loaded at runtime by specifying a full path or using another mechanism such as a manifest.

This post will talk about why IBM X-Force thinks the tool is needed, describe its functions and analyze some use cases.

To provide a defensive counter-measure perspective for DLL side-loading, X-Force Incident Response has released SideLoaderHunter, which is a system profiling script and Sysmon configuration designed to identify evidence of side-loading on Windows systems. Recently, X-Force Red released a tool called Windows Feature Hunter, which identifies targets for dynamic link library (DLL) side-loading on a Windows system using Frida.

What is a dll file?