warmcookie | c437e5caa4f644024014d40e62a5436c59046efc76c666ea3f83ab61df615314 | Triage

Submit
Reports

Overview

overview

Static

static

c437e5caa4...14.dll

windows7-x64

c437e5caa4...14.dll

windows10-2004-x64

Sharing

General

Target

c437e5caa4f644024014d40e62a5436c59046efc76c666ea3f83ab61df615314
Size

141KB
Sample

240701-ht9s9asbrp
MD5

5fa10a64b7e1cfc3d8b8d45cefb6f837
SHA1

5f69a841cd4533ba671c1e6f73bd3b65d903f272
SHA256

c437e5caa4f644024014d40e62a5436c59046efc76c666ea3f83ab61df615314
SHA512

98f49ed14fe9fb14c6f0147ff53bb00969be5576f3e8a25ed1b35639390fbb7e88c440a51d451df644e72d2595ebe9748af01230b22400bd5b42ec87685b1306
SSDEEP

3072:HACxLpcTIhjZM3VhHSkYl8CagwurZvE9vV1ZQcR:HTtpcPlJSTl4PuG

Score

10^/10

warmcookie backdoor discovery

Static task

static1

backdoor warmcookie

2 signatures

Behavioral task

behavioral1

Sample

c437e5caa4f644024014d40e62a5436c59046efc76c666ea3f83ab61df615314.dll

Resource

win7-20240419-en

warmcookie backdoor discovery

windows7-x64

8 signatures

300 seconds

Behavioral task

behavioral2

Sample

c437e5caa4f644024014d40e62a5436c59046efc76c666ea3f83ab61df615314.dll

Resource

win10v2004-20240226-en

warmcookie backdoor

windows10-2004-x64

3 signatures

300 seconds

Malware Config

Extracted

Family

warmcookie

C2

185.49.69.41

Attributes

mutex
5628919c-ac3f-4c57-89c9-7c71740b3c8e
user_agent
Mozilla / 4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1;.NET CLR 1.0.3705)

Targets

- Target
  
  c437e5caa4f644024014d40e62a5436c59046efc76c666ea3f83ab61df615314
- Size
  
  141KB
- MD5
  
  5fa10a64b7e1cfc3d8b8d45cefb6f837
- SHA1
  
  5f69a841cd4533ba671c1e6f73bd3b65d903f272
- SHA256
  
  c437e5caa4f644024014d40e62a5436c59046efc76c666ea3f83ab61df615314
- SHA512
  
  98f49ed14fe9fb14c6f0147ff53bb00969be5576f3e8a25ed1b35639390fbb7e88c440a51d451df644e72d2595ebe9748af01230b22400bd5b42ec87685b1306
- SSDEEP
  
  3072:HACxLpcTIhjZM3VhHSkYl8CagwurZvE9vV1ZQcR:HTtpcPlJSTl4PuG
Score

10^/10

warmcookie backdoor discovery
- Warmcookie
  Warmcookie is a backdoor written in C++.
  backdoor warmcookie
- Blocklisted process makes network request
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

backdoorwarmcookie

behavioral1

warmcookiebackdoordiscovery

behavioral2

warmcookiebackdoor

© 2018-2024

Terms | Privacy