Elastic Security Labs documents a wave of recruiting-themed phishing campaigns delivering a new Windows backdoor called WARMCOOKIE, which fingerprints hosts, captures screenshots, and deploys additional payloads. The threat uses RC4/Base64 for C2 communications, heavy string obfuscation, dynamic API loading, and rapidly changing infrastructure to evade detection. #WARMCOOKIE #URSNIF #eSentire #REF6127
Keypoints
- REF6127 campaigns use recruiting-themed phishing to deploy the Windows backdoor WARMCOOKIE.
- WARMCOOKIE fingerprints hosts, captures screenshots, and can deploy additional payloads.
- Threat actors rapidly generate new domains and infrastructure to support campaigns and evade reputation checks.
- Elastic provides an IDAPython string-decryption tool to aid analysis of WARMCOOKIE.
- The infection chain includes a PowerShell/BITS download, DLL loading via rundll32, and a scheduled task for persistence.
MITRE Techniques
- [T1566.001] Phishing – Spearphishing Link – “Since late April 2024, our team has observed new phishing campaigns leveraging lures tied to recruiting firms.”
- [T1105] Ingress Tool Transfer – “The PowerShell script abuses the Background Intelligent Transfer Service (BITS) to download WARMCOOKIE and run the DLL with the Start export.”
- [T1059.001] PowerShell – “The obfuscated script runs PowerShell, kicking off the first task to load WARMCOOKIE.”
- [T1218.011] Rundll32 – “rundll32.exe $p, Start” (Start export) – Duke DLL execution via Rundll32.
- [T1053.005] Scheduled Task – “persistence using COM with the Windows Task Scheduler to configure the DLL to run” and “scheduled to run every 10 minutes every day.”
- [T1113] Screen Capture – “Record screenshots of victim machine” and subsequent use of GDI/GDIPLUS to generate the image.
- [T1082] System Information Discovery – “Stage 1 fingerprints the victim machines by collecting the IP address and CPU information.”
- [T1041] Exfiltration Over C2 Channel – “The POST requests when sending data back to the C2 server” and encrypted payloads.
- [T1071.001] Web Protocols – “communicate over HTTP with a hardcoded IP address” and protected network traffic using RC4/Base64.
- [T1027] Obfuscated/Compressed Files and Information – “The malware protects its strings using a custom string decryption algorithm.”
Indicators of Compromise
- [File name] Update_23_04_2024_5689382.js – initial obfuscated JavaScript downloaded after CAPTCHA landing page
- [File name] RtlUpdRtlUpd.dll – DLL dropped and placed in C:ProgramDataRtlUpdRtlUpd.dll
- [SHA-256] RtlUpd.dll – ccde1ded028948f5cd3277d2d4af6b22fa33f53abde84ea2aa01f1872fad1d13
- [Domain] omeindia[.]com – phishing link domain
- [Domain] assets.work-for[.]top – landing page domain
- [IPv4] 45.9.74[.]135 – landing pages infrastructure
- [IPv4] 80.66.88[.]146 – WARMCOOKIE C2 server
- [IPv4] 185.49.69[.]41 – WARMCOOKIE C2 server
Read more: https://www.elastic.co/security-labs/dipping-into-danger