warmcookie | 3c71282d1c53a16d7ac1687e0288801a062dde870c07aba9f23f6b962d537f9f

Resubmissions

28/10/2024, 17:19

241028-vv4pvathne 10

17/08/2024, 01:20

240817-bp9jcsyfkd 8

Analysis

max time kernel
30s
max time network
27s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
28/10/2024, 17:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6.dll
Size

155KB
MD5

59b7b8d29252a9128536fbd08d24375f
SHA1

7221b9125608a54f9dd706166f936c16ee23164a
SHA256

b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6
SHA512

70431e0bf3759194cd50f6b567f6de7c908d13a444d14e7b35edf10fd88f16e6fe8bf0899307c7215f1ee80ff8e5909211864f4184053d9fa5bf9ec22b1d9cd4
SSDEEP

3072:0lCt2jrijQEjnMUWzsjhVPbuGHUluQj6vkZD4vP5iZWyPr:QCIrijNMv6XPbr0kulr

Score

10^/10

warmcookie backdoor

Malware Config

Extracted

Family

warmcookie

72.5.43.29

Attributes

mutex
7d0cec31-c3bc-4593-ad4a-8c140904383e
user_agent
Mozilla / 5.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)

Signatures

Warmcookie family
warmcookie
Warmcookie, Badspace
Warmcookie aka Badspace is a backdoor written in C++.
backdoor warmcookie

Blocklisted process makes network request 1 IoCs

flow	pid	Process
7	1748	rundll32.exe

Loads dropped DLL 1 IoCs

pid	Process
1748	rundll32.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\DH0WTCOM.htm	rundll32.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\PCTM5MW3.htm	rundll32.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\AL5GJO5O.htm	rundll32.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Zagaran Software.job	regsvr32.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	rundll32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	rundll32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	rundll32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6.dll
1⤵
- Drops file in Windows directory
PID:2704

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\ProgramData\Zagaran Software\Updater.dll",Start /u
1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Zagaran Software\Updater.dll

Filesize
155KB

MD5
59b7b8d29252a9128536fbd08d24375f

SHA1
7221b9125608a54f9dd706166f936c16ee23164a

SHA256
b7aec5f73d2a6bbd8cd920edb4760e2edadc98c3a45bf4fa994d47ca9cbd02f6

SHA512
70431e0bf3759194cd50f6b567f6de7c908d13a444d14e7b35edf10fd88f16e6fe8bf0899307c7215f1ee80ff8e5909211864f4184053d9fa5bf9ec22b1d9cd4

Download Submit