warmcookie | 0b26abc692b7a2877b6b6fce6aa99b29af125b063f1c41b507362def59f8dfce

General

Target

0b26abc692b7a2877b6b6fce6aa99b29af125b063f1c41b507362def59f8dfce.dll
Size

141KB
MD5

2492aca399dfaf75e761586844734980
SHA1

c7d147e588fe5ec6101bf69ec0dbc5d2252fbad6
SHA256

0b26abc692b7a2877b6b6fce6aa99b29af125b063f1c41b507362def59f8dfce
SHA512

1ce1a434b2cc5498b5547720d4eaf14a907b359492a1694847bb3119ca4b0b6ba8bfad02e2a39c71111aacd637db224a6b44c77c7469d19b9cbea4deab4b15fd
SSDEEP

3072:HACxLpcTIhjZM3VhHSkYl8CagwurZvE9vV1ZQ6R:HTtpcPlJSTl4Pu8

Score

10^/10

warmcookie backdoor discovery

Malware Config

Extracted

Family

warmcookie

C2

185.49.69.41

Attributes

mutex
0b664cde-8833-4945-8aff-b301b3bfebe8
user_agent
Mozilla / 4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1;.NET CLR 1.0.3705)

Signatures

Warmcookie, Badspace
Warmcookie aka Badspace is a backdoor written in C++.
backdoor warmcookie

Blocklisted process makes network request 15 IoCs

flow	pid	Process
4	2740	rundll32.exe
5	2740	rundll32.exe
6	2740	rundll32.exe
7	2740	rundll32.exe
8	2740	rundll32.exe
9	2740	rundll32.exe
11	2740	rundll32.exe
12	2740	rundll32.exe
13	2740	rundll32.exe
14	2740	rundll32.exe
15	2740	rundll32.exe
16	2740	rundll32.exe
18	2740	rundll32.exe
19	2740	rundll32.exe
20	2740	rundll32.exe

Loads dropped DLL 4 IoCs

pid	Process
2740	rundll32.exe
2740	rundll32.exe
2740	rundll32.exe
2740	rundll32.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	rundll32.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\RtlUpd.job	regsvr32.exe

Modifies data under HKEY_USERS 25 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{353879F2-CEFB-457D-814F-FD0D1F336EDD}\WpadDecisionTime = c062e4f37ce2da01	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{353879F2-CEFB-457D-814F-FD0D1F336EDD}\WpadDecisionReason = "1"	rundll32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{353879F2-CEFB-457D-814F-FD0D1F336EDD}\WpadNetworkName = "Network 3"	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\86-b5-a0-c5-84-ec\WpadDecisionTime = 007013c37ce2da01	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0025000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	rundll32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\86-b5-a0-c5-84-ec\WpadDetectedUrl	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\86-b5-a0-c5-84-ec\WpadDecisionTime = c062e4f37ce2da01	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\86-b5-a0-c5-84-ec\WpadDecisionReason = "1"	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{353879F2-CEFB-457D-814F-FD0D1F336EDD}\WpadDecisionTime = 603c95d87ce2da01	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0025000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{353879F2-CEFB-457D-814F-FD0D1F336EDD}\WpadDecisionTime = 007013c37ce2da01	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{353879F2-CEFB-457D-814F-FD0D1F336EDD}\86-b5-a0-c5-84-ec	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{353879F2-CEFB-457D-814F-FD0D1F336EDD}	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{353879F2-CEFB-457D-814F-FD0D1F336EDD}\WpadDecision = "0"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\86-b5-a0-c5-84-ec	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\86-b5-a0-c5-84-ec\WpadDecision = "0"	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\86-b5-a0-c5-84-ec\WpadDecisionTime = 603c95d87ce2da01	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000005000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0025000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 984 wrote to memory of 2740	984	taskeng.exe	32
PID 984 wrote to memory of 2740	984	taskeng.exe	32
PID 984 wrote to memory of 2740	984	taskeng.exe	32

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0b26abc692b7a2877b6b6fce6aa99b29af125b063f1c41b507362def59f8dfce.dll
1⤵
- Drops file in Windows directory
PID:2984

C:\Windows\system32\taskeng.exe
taskeng.exe {9325A8A1-2120-4A2C-A9EB-FEDBCB8B4B6C} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:984
- C:\Windows\system32\rundll32.exe
  C:\Windows\system32\rundll32.exe "C:\ProgramData\RtlUpd\RtlUpd.dll",Start /p
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\ProgramData\RtlUpd\RtlUpd.dll

Filesize
141KB

MD5
2492aca399dfaf75e761586844734980

SHA1
c7d147e588fe5ec6101bf69ec0dbc5d2252fbad6

SHA256
0b26abc692b7a2877b6b6fce6aa99b29af125b063f1c41b507362def59f8dfce

SHA512
1ce1a434b2cc5498b5547720d4eaf14a907b359492a1694847bb3119ca4b0b6ba8bfad02e2a39c71111aacd637db224a6b44c77c7469d19b9cbea4deab4b15fd

Download Submit

Analysis

Sharing