x64dbg: Analyze a malware dll's exported function with cmdline arguments
Channel: Prof. Chris Dietrich
Date: 2021-02-12

You want to debug a malware that arrives as a DLL file and has an exported function called with command line arguments? Here is one way to do it: Open rundll32.exe, change the command line in x64dbg and have the DLL invoked using rundll32.exe.

This trick turned out to be helpful while looking at a malware sample (SHA256 a75886b016d84c3eaacaf01a3c61e04953a7a3adf38acf77a4a2e3a8f544f855) which was used as part of a targeted attack against security researchers as documented by Google TAG at https://blog.google/threat-analysis-group/new-campaign-targeting-security-researchers/. According to Google, the actors behind the attack are attributed to a government-backed entity based in the DPRK.

The malicious DLL is invoked as follows by the preceding stage:
rundll32.exe mal.dll,OCSP_resp_find lxUi5CZ0IV45j89Y 4901