warmcookie | 0b26abc692b7a2877b6b6fce6aa99b29af125b063f1c41b507362def59f8dfce

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
04/08/2024, 01:04 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b26abc692b7a2877b6b6fce6aa99b29af125b063f1c41b507362def59f8dfce.dll
Size

141KB
MD5

2492aca399dfaf75e761586844734980
SHA1

c7d147e588fe5ec6101bf69ec0dbc5d2252fbad6
SHA256

0b26abc692b7a2877b6b6fce6aa99b29af125b063f1c41b507362def59f8dfce
SHA512

1ce1a434b2cc5498b5547720d4eaf14a907b359492a1694847bb3119ca4b0b6ba8bfad02e2a39c71111aacd637db224a6b44c77c7469d19b9cbea4deab4b15fd
SSDEEP

3072:HACxLpcTIhjZM3VhHSkYl8CagwurZvE9vV1ZQ6R:HTtpcPlJSTl4Pu8

Score

10^/10

warmcookie backdoor discovery

Malware Config

Extracted

Family

warmcookie

185.49.69.41

Attributes

mutex
0b664cde-8833-4945-8aff-b301b3bfebe8
user_agent
Mozilla / 4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1;.NET CLR 1.0.3705)

Signatures

Warmcookie, Badspace
Warmcookie aka Badspace is a backdoor written in C++.
backdoor warmcookie

Blocklisted process makes network request 26 IoCs

flow	pid	Process
4	2768	rundll32.exe
5	2768	rundll32.exe
6	2768	rundll32.exe
7	2768	rundll32.exe
8	2768	rundll32.exe
9	2768	rundll32.exe
11	2768	rundll32.exe
12	2768	rundll32.exe
13	2768	rundll32.exe
14	2768	rundll32.exe
15	2768	rundll32.exe
16	2768	rundll32.exe
18	2768	rundll32.exe
19	2768	rundll32.exe
20	2768	rundll32.exe
21	2768	rundll32.exe
22	2768	rundll32.exe
23	2768	rundll32.exe
25	2768	rundll32.exe
26	2768	rundll32.exe
27	2768	rundll32.exe
28	2768	rundll32.exe
29	2768	rundll32.exe
30	2768	rundll32.exe
32	2768	rundll32.exe
33	2768	rundll32.exe

Loads dropped DLL 4 IoCs

pid	Process
2768	rundll32.exe
2768	rundll32.exe
2768	rundll32.exe
2768	rundll32.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	rundll32.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\RtlUpd.job	regsvr32.exe

Modifies data under HKEY_USERS 31 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BBD0D08E-59BB-491E-9D6D-2F2AB26DC82E}\WpadDecisionTime = d0df419b0ae6da01	rundll32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\2a-63-03-c1-04-68\WpadDetectedUrl	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000006000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0088000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000007000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0088000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\2a-63-03-c1-04-68\WpadDecisionTime = d0ae555e0ae6da01	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\2a-63-03-c1-04-68\WpadDecisionTime = d08bf26b0ae6da01	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BBD0D08E-59BB-491E-9D6D-2F2AB26DC82E}\WpadDecisionTime = 30742e7e0ae6da01	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	rundll32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BBD0D08E-59BB-491E-9D6D-2F2AB26DC82E}\WpadNetworkName = "Network 3"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BBD0D08E-59BB-491E-9D6D-2F2AB26DC82E}\2a-63-03-c1-04-68	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0088000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\2a-63-03-c1-04-68\WpadDecisionTime = d0df419b0ae6da01	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BBD0D08E-59BB-491E-9D6D-2F2AB26DC82E}\WpadDecisionReason = "1"	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\2a-63-03-c1-04-68\WpadDecisionReason = "1"	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BBD0D08E-59BB-491E-9D6D-2F2AB26DC82E}	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\2a-63-03-c1-04-68\WpadDecisionTime = 30742e7e0ae6da01	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000005000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0088000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BBD0D08E-59BB-491E-9D6D-2F2AB26DC82E}\WpadDecisionTime = 90b2cd8b0ae6da01	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BBD0D08E-59BB-491E-9D6D-2F2AB26DC82E}\WpadDecision = "0"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\2a-63-03-c1-04-68	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BBD0D08E-59BB-491E-9D6D-2F2AB26DC82E}\WpadDecisionTime = d0ae555e0ae6da01	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\2a-63-03-c1-04-68\WpadDecisionTime = 90b2cd8b0ae6da01	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0088000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\2a-63-03-c1-04-68\WpadDecision = "0"	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{BBD0D08E-59BB-491E-9D6D-2F2AB26DC82E}\WpadDecisionTime = d08bf26b0ae6da01	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2768	2180	taskeng.exe	31
PID 2180 wrote to memory of 2768	2180	taskeng.exe	31
PID 2180 wrote to memory of 2768	2180	taskeng.exe	31

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\0b26abc692b7a2877b6b6fce6aa99b29af125b063f1c41b507362def59f8dfce.dll
1⤵
- Drops file in Windows directory
PID:2160

C:\Windows\system32\taskeng.exe
taskeng.exe {975B5237-C4CF-47BF-964C-CF2F575F5A44} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\system32\rundll32.exe
  C:\Windows\system32\rundll32.exe "C:\ProgramData\RtlUpd\RtlUpd.dll",Start /p
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:2768

Network

No results found

185.49.69.41:80

rundll32.exe

152 B
120 B
3
3
185.49.69.41:80

rundll32.exe

152 B
120 B
3
3
185.49.69.41:80

rundll32.exe

152 B
120 B
3
3
185.49.69.41:80

rundll32.exe

152 B
120 B
3
3
185.49.69.41:80

rundll32.exe

152 B
120 B
3
3
185.49.69.41:80

rundll32.exe

152 B
120 B
3
3
185.49.69.41:80

rundll32.exe

152 B
120 B
3
3
185.49.69.41:80

rundll32.exe

152 B
120 B
3
3
185.49.69.41:80

rundll32.exe

152 B
80 B
3
2
185.49.69.41:80

rundll32.exe

152 B
120 B
3
3
185.49.69.41:80

rundll32.exe

152 B
120 B
3
3
185.49.69.41:80

rundll32.exe

152 B
80 B
3
2
185.49.69.41:80

rundll32.exe

152 B
120 B
3
3
185.49.69.41:80

rundll32.exe

152 B
120 B
3
3
185.49.69.41:80

rundll32.exe

152 B
120 B
3
3
185.49.69.41:80

rundll32.exe

152 B
120 B
3
3
185.49.69.41:80

rundll32.exe

152 B
120 B
3
3
185.49.69.41:80

rundll32.exe

152 B
120 B
3
3
185.49.69.41:80

rundll32.exe

152 B
120 B
3
3
185.49.69.41:80

rundll32.exe

152 B
120 B
3
3
185.49.69.41:80

rundll32.exe

152 B
80 B
3
2
185.49.69.41:80

rundll32.exe

152 B
120 B
3
3
185.49.69.41:80

rundll32.exe

152 B
120 B
3
3
185.49.69.41:80

rundll32.exe

152 B
120 B
3
3
185.49.69.41:80

rundll32.exe

152 B
120 B
3
3
185.49.69.41:80

rundll32.exe

152 B
120 B
3
3

No results found

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\RtlUpd\RtlUpd.dll

Filesize
141KB

MD5
2492aca399dfaf75e761586844734980

SHA1
c7d147e588fe5ec6101bf69ec0dbc5d2252fbad6

SHA256
0b26abc692b7a2877b6b6fce6aa99b29af125b063f1c41b507362def59f8dfce

SHA512
1ce1a434b2cc5498b5547720d4eaf14a907b359492a1694847bb3119ca4b0b6ba8bfad02e2a39c71111aacd637db224a6b44c77c7469d19b9cbea4deab4b15fd

Download Submit