26 Feb 2020 | | 악성코드, 라자루스, 북한, 워너크라이, 웜, malware, wannacry, lazarus, worm, north korea, english
Continued from [Malware] Lazarus group’s Brambul worm of the former Wannacry - 1
As soon as the second routine starts, three subroutines are called: sub_401ba0, sub_401b30, and sub_401040.
Create the lsasvc.exe file and run the process. Afterwards, access the shared folder as admin like the first routine.
By adding a value named “WindowsUpdate” to the registry “Software \ Microsoft \ Windows \ CurrentVersion \ Run” path, the process will automatically run each time the computer is turned on.
Similar to what it did at the beginning of the program run, the gethostname function gets the user’s name.
After the three subroutines are executed, the GetVersion function is used to get the version of the operating system. I could see that it was classified as “WinNt”, “Win2000”, “WinVista”, “Win2003”, “WinXp”, and “Unkonwn”.
After that, it push the string whiat1001@gmail.com onto the stack and call the sub_401430 subroutine to send the data using the SMTP protocol. The sending account and mail server are the same as whiat1001 and gmail.com, but after pretending the sender account to johnS203@yahoo.com, the process ends. In sub_401430 we could see the strings related to SMTP and mail headers.
- SMB, IPC ,SCM Database access attempt with random IPs for self-copy and distribution
- Send mail using the SMTP protocol, pretending whiat1001@gmail.com as johnS203@yahoo.com
- Access shared folder as admin
- Create the Windows Genuine Logon Manager (wglmgr) service
- Create the Microsoft Windows Genuine Updater (wgudtr) service
- Create crss.exe executable
- Create and run lsasvc.exe
- Add “WindowsUpdate” Value to the registry “Software \ Microsoft \ Windows \ CurrentVersion \ Run” path