# [Malware] Lazarus group's Brambul worm of the former Wannacry - 1 | Swan's Lab

**[swanleesec.github.io/posts/Malware-Lazarus-group's-Brambul-worm-of-the-former-Wannacry-1](https://swanleesec.github.io/posts/Malware-Lazarus-group's-Brambul-worm-of-the-former-Wannacry-1)**

## [Malware] Lazarus group's Brambul worm of the former Wannacry - 1

25 Feb 2020 | | [악성코드,](https://swanleesec.github.io/tags/%23%EC%95%85%EC%84%B1%EC%BD%94%EB%93%9C%20) [라자루스,](https://swanleesec.github.io/tags/%23%EB%9D%BC%EC%9E%90%EB%A3%A8%EC%8A%A4%20) [북한,](https://swanleesec.github.io/tags/%23%EB%B6%81%ED%95%9C%20) [워너크라이,](https://swanleesec.github.io/tags/%23%EC%9B%8C%EB%84%88%ED%81%AC%EB%9D%BC%EC%9D%B4%20) [웜,](https://swanleesec.github.io/tags/%23%EC%9B%9C%20) [malware,](http://10.10.0.46/tags/#malware%20) [wannacry,](http://10.10.0.46/tags/#wannacry%20) [lazarus,](http://10.10.0.46/tags/#lazarus%20)
[worm,](http://10.10.0.46/tags/#worm%20) [north korea,](http://10.10.0.46/tags/#north%20korea%20) [english](http://10.10.0.46/tags/#english%20)

## Relationship with WannaCry and Brambul

WannaCry is a ransomware of the North Korean Lazarus Group that hit the pandemic in May
2017. Attackers earned about $ 150,000 through this ransomware, and the damage from the
attack is estimated at about billions of dollars. One of the features of WannaCry is that it
replicates itself and distributes it to an accessible network, similar to a worm, and is
distributed primarily through SMB vulnerabilities and email.

Prior to WannaCry, the Lazarus group deployed a worm that behaved in a similar way, one of
which is the worm named Brambul. WannaCry is a mutation of the ransomware form of this
worm called Brambul.

[Edit from Intezer tech report](http://www.intezer.com/wp-content/uploads/2017/07/Intezer-WannaCry.pdf)

Brambul was created in 2009 and began to be distributed. After 10 years, it’s not dangerous
compared to other malware, but it can still harm computers with vulnerable versions and
settings.

## Analysis


-----

MD5 : [f024ff4176f0036f97ebc95decfd1d5e](https://www.hybrid-analysis.com/sample/7b2f8c43b4c92fb2add9fce264e92668dac2530493c51c5d6b45dcb764e208ed/?environmentId=100)

Running the file does not seem to have any effect on your screen. There is no packing or
obfuscation, so it is easy to analyze. Thanks to this, you can roughly predict behavior with
just the strings contained within the file.

## Strings in file

Based on the above information, you can infer emails, IP addresses, registry changes,
shared folder access, and related processes.

## Start of behavior


-----

-----

When the program starts up, it calls the WSAStartup function to check if a network
connection is available. Get the user’s name (the name of the PC). For my PC, I got the
value “swan”. Then push the string “gmail.com” onto the stack and call dnsquery as follows:

After that, the user’s name is verified as “System”, and the behavior is divided into two
routine to the result.


-----

-----

## First routine

In this case, we call the sub_402900 subroutine, which generates IP addresses randomly
after a few GetTickCounts. It will try to connect to 445 port (SMB port) with randomly
generated IP.


-----

-----

If the connection to the SMB port is successful, the connection to the IPC is attempted.

If the connection to IPC succeeds, the administrator account accesses the SCM database
and performs malicious actions.


-----

-----

1. Send mail using the SMTP protocol to the specified subject at

whiat1001@gmail.com
2. Access shared folder with admin
3. Create a Windows Genuine Logon Manager (wglmgr) Service
4. Create a Microsoft Windows Genuine Updater (wgudtr) Service
5. Generate crss.exe executable


-----

These generated services and executables seem to cause the routine to self-replicate and
propagate, after which the first routine is terminated.

[(Continued on Part 2)](https://metaswan.github.io/posts/Malware-Lazarus-group's-Brambul-worm-of-the-former-Wannacry-2)

## [악성코드] WannaCry 이전 북한 Lazarus 그룹의 웜 Brambul - 1

 WannaCry와 Brambul의 관계

WannaCry는 2017년 5월에 대유행한 북한 Lazarus 그룹의 랜섬웨어입니다. 이 랜섬웨어를
통해 공격자들은 약 15만 달러를 벌었고, 이 공격에 따른 피해는 약 수십억 달러로 추정되고
있습니다. WannaCry의 특징 중 하나는 웜과 유사하게 자기 자신을 복제하여 접근가능한 네
트워크에 배포하며 SMB 취약점과 이메일을 통해 주로 배포됩니다.


-----