warmcookie | 0b26abc692b7a2877b6b6fce6aa99b29af125b063f1c41b507362def59f8dfce | Triage

Analysis

max time kernel
145s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/08/2024, 13:21

Sharing

Report Analysis Logs

General

Target

warmcookie.bin.dll
Size

141KB
MD5

2492aca399dfaf75e761586844734980
SHA1

c7d147e588fe5ec6101bf69ec0dbc5d2252fbad6
SHA256

0b26abc692b7a2877b6b6fce6aa99b29af125b063f1c41b507362def59f8dfce
SHA512

1ce1a434b2cc5498b5547720d4eaf14a907b359492a1694847bb3119ca4b0b6ba8bfad02e2a39c71111aacd637db224a6b44c77c7469d19b9cbea4deab4b15fd
SSDEEP

3072:HACxLpcTIhjZM3VhHSkYl8CagwurZvE9vV1ZQ6R:HTtpcPlJSTl4Pu8

Score

10^/10

warmcookie backdoor

Malware Config

Extracted

Family

warmcookie

C2

185.49.69.41

Attributes

mutex
0b664cde-8833-4945-8aff-b301b3bfebe8
user_agent
Mozilla / 4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1;.NET CLR 1.0.3705)

Signatures

Warmcookie, Badspace
Warmcookie aka Badspace is a backdoor written in C++.
backdoor warmcookie

Blocklisted process makes network request 11 IoCs

flow	pid	Process
33	3960	rundll32.exe
34	3960	rundll32.exe
35	3960	rundll32.exe
36	3960	rundll32.exe
37	3960	rundll32.exe
44	3960	rundll32.exe
45	3960	rundll32.exe
46	3960	rundll32.exe
47	3960	rundll32.exe
48	3960	rundll32.exe
49	3960	rundll32.exe

Loads dropped DLL 1 IoCs

pid	Process
3960	rundll32.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\RtlUpd.job	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\warmcookie.bin.dll
1⤵
- Drops file in Windows directory
PID:3572

C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe "C:\ProgramData\RtlUpd\RtlUpd.dll",Start /p
1⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:3960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\RtlUpd\RtlUpd.dll

Filesize
141KB

MD5
2492aca399dfaf75e761586844734980

SHA1
c7d147e588fe5ec6101bf69ec0dbc5d2252fbad6

SHA256
0b26abc692b7a2877b6b6fce6aa99b29af125b063f1c41b507362def59f8dfce

SHA512
1ce1a434b2cc5498b5547720d4eaf14a907b359492a1694847bb3119ca4b0b6ba8bfad02e2a39c71111aacd637db224a6b44c77c7469d19b9cbea4deab4b15fd

Download Submit