# [Malware] Lazarus group's Brambul worm of the former Wannacry - 2 | Swan's Lab

**[swanleesec.github.io/posts/Malware-Lazarus-group's-Brambul-worm-of-the-former-Wannacry-2](https://swanleesec.github.io/posts/Malware-Lazarus-group's-Brambul-worm-of-the-former-Wannacry-2)**

## [Malware] Lazarus group's Brambul worm of the former Wannacry - 2

26 Feb 2020 | | [악성코드,](https://swanleesec.github.io/tags/%23%EC%95%85%EC%84%B1%EC%BD%94%EB%93%9C%20) [라자루스,](https://swanleesec.github.io/tags/%23%EB%9D%BC%EC%9E%90%EB%A3%A8%EC%8A%A4%20) [북한,](https://swanleesec.github.io/tags/%23%EB%B6%81%ED%95%9C%20) [워너크라이,](https://swanleesec.github.io/tags/%23%EC%9B%8C%EB%84%88%ED%81%AC%EB%9D%BC%EC%9D%B4%20) [웜,](https://swanleesec.github.io/tags/%23%EC%9B%9C%20) [malware,](http://10.10.0.46/tags/#malware%20) [wannacry,](http://10.10.0.46/tags/#wannacry%20) [lazarus,](http://10.10.0.46/tags/#lazarus%20)
[worm,](http://10.10.0.46/tags/#worm%20) [north korea,](http://10.10.0.46/tags/#north%20korea%20) [english](http://10.10.0.46/tags/#english%20)

## Analysis

[Continued from [Malware] Lazarus group’s Brambul worm of the former Wannacry - 1](https://metaswan.github.io/posts/Malware-Lazarus-group's-Brambul-worm-of-the-former-Wannacry-1)

## Second routine

As soon as the second routine starts, three subroutines are called: sub_401ba0,
sub_401b30, and sub_401040.


-----

-----

### sub_401ba0

Create the lsasvc.exe file and run the process. Afterwards, access the shared folder as
admin like the first routine.


-----

-----

### sub_401b30

By adding a value named “WindowsUpdate” to the registry “Software \ Microsoft \ Windows \
CurrentVersion \ Run” path, the process will automatically run each time the computer is
turned on.


-----

### sub_401040

Similar to what it did at the beginning of the program run, the gethostname function gets the
user’s name.


-----

After the three subroutines are executed, the GetVersion function is used to get the version
of the operating system. I could see that it was classified as “WinNt”, “Win2000”, “WinVista”,
“Win2003”, “WinXp”, and “Unkonwn”.


-----

After that, it push the string whiat1001@gmail.com onto the stack and call the sub_401430
subroutine to send the data using the SMTP protocol. The sending account and mail server
are the same as whiat1001 and gmail.com, but after pretending the sender account to
johnS203@yahoo.com, the process ends. In sub_401430 we could see the strings related to
SMTP and mail headers.

## Behavior result


-----

1. SMB, IPC,SCM Database access attempt with random IPs for self-copy and

distribution
2. Send mail using the SMTP protocol, pretending whiat1001@gmail.com as

johnS203@yahoo.com
3. Access shared folder as admin
4. Create the Windows Genuine Logon Manager (wglmgr) service
5. Create the Microsoft Windows Genuine Updater (wgudtr) service
6. Create crss.exe executable
7. Create and run lsasvc.exe
8. Add “WindowsUpdate” Value to the registry “Software \ Microsoft \ Windows \

CurrentVersion \ Run” path

## [악성코드] WannaCry 이전 북한 Lazarus 그룹의 웜 Brambul - 1

 WannaCry와 Brambul의 관계

WannaCry는 2017년 5월에 대유행한 북한 Lazarus 그룹의 랜섬웨어입니다. 이 랜섬웨어를
통해 공격자들은 약 15만 달러를 벌었고, 이 공격에 따른 피해는 약 수십억 달러로 추정되고
있습니다. WannaCry의 특징 중 하나는 웜과 유사하게 자기 자신을 복제하여 접근가능한 네
트워크에 배포하며 SMB 취약점과 이메일을 통해 주로 배포됩니다.

## [악성코드] WannaCry 이전 북한 Lazarus 그룹의 웜 Brambul - 2

 분석


-----