SentinelOne's DFIR team documented in a report published on SentinelOne a LockBit affiliate technique using the legitimate, signed VMware command-line utility VMwareXferlogs.exe to side-load a malicious glib-2.0.dll that decrypts and executes a Cobalt Strike Beacon Reflective Loader — bypassing EDR/EPP userland hooks, Event Tracing for Windows (ETW), and AMSI in the process. Attribution indicators suggest the technique was implemented by the affiliate Microsoft tracks as DEV-0401 rather than LockBit core developers.
Attack Chain: PowerShell Download to VMware DLL Side-Loading
The threat actor executes three PowerShell Invoke-WebRequest commands to download from a C2 at hxxp://45.32.108[.]54:443: a malicious glib-2.0.dll, the legitimate signed VMwareXferlogs.exe, and an RC4-encrypted Cobalt Strike payload stored as c0000015.log — all to C:\Windows\debug\. VMwareXferlogs.exe is then executed via cmd.exe with STDOUT redirected to a UNC admin share path. Because VMwareXferlogs.exe ships with VMware installations and legitimately imports from glib-2.0.dll, placing the malicious DLL alongside the executable causes Windows' DLL search order to load the weaponized version instead.
Weaponized glib-2.0.dll: Single Active Export, All Others Exit
The malicious DLL exports all functions imported by VMwareXferlogs.exe, but with a deliberate design: every export except g_path_get_basename() simply calls ExitProcess() — they share the same virtual address (0x1800020d0). Only g_path_get_basename() (at 0x180002420) contains the malicious payload logic, invoked from VMwareXferlogs.exe's main function as its first DLL call, immediately transferring control flow to the attacker. The DLL first checks the BeingDebugged flag and NtGlobalFlag in the Process Environment Block (PEB), entering an infinite loop if a debugger is detected.
Three-Layer Defense Bypass: EDR Hooks, ETW, and AMSI
The DLL performs three sequential bypass operations. First, it removes EDR/EPP userland hooks by manually mapping itself into memory and performing byte-to-byte inspection across all loaded modules — overwriting any in-memory discrepancies with clean code from disk images, effectively restoring hooked SYSCALL stubs to their original unpatched state. Second, it patches EtwEventWrite with a RET instruction (0xC3) to suppress ETW telemetry. Third, it patches AmsiScanBuffer the same way, preventing AMSI from inspecting suspicious in-process buffers.
RC4 Decryption and APC-Based Cobalt Strike Execution
With defenses neutralized, the DLL decrypts c0000015.log using RC4 with a hardcoded 136-byte key. The decrypted payload is Cobalt Strike Beacon's Reflective Loader, identifiable by its familiar magic bytes and hardcoded strings. The memory region is marked PAGE_EXECUTE_READWRITE, a new suspended thread is created, and a user-mode Asynchronous Procedure Call (APC) pointing to the decrypted payload is queued to the thread's APC queue before resuming — executing Cobalt Strike via APC injection. Variant samples differ only in RC4 key and payload filename (some load vmtools.ini rather than c0000015.log); one variant is additionally packed with a custom UPX stub.