CoreWarrior Malware Attacking Windows Machines From Dozens Of IP Address

Researchers recently analyzed a CoreWarrior malware sample, which spreads aggressively by creating numerous copies and connecting to various IP addresses.

It establishes multiple backdoor connections and monitors user activity through Windows UI element hooks, which poses a significant security risk as it can compromise system integrity and steal sensitive data.

The malware is a UPX-packed executable that has been modified to prevent standard unpackers from functioning. When executed, it generates a temporary copy with a random name and uses this copy to send data to a remote server via HTTP POST.

After each successful transmission, the original copy is deleted and a new one is created, resulting in rapid file turnover. This process was observed to create and delete over a hundred copies within ten minutes during testing.

Analyse Any Suspicious Files With ANY.RUN: Intergarte With You Security Team -> Try for Free

A listener is then established on ports 49730-49777 and 50334-50679 after the program has begun the process of message transmission.

While no TCP/UDP traffic was observed, a single connection was detected on the secondary IP address 172.67.183.40, which suggests that the program’s network activity is focused on outgoing message transmission, with potential inbound connections remaining dormant.

The malware parent process will gather information about the system drives and monitor the command prompt window for changes by implementing several anti-analysis techniques, including using rdtsc to detect debugging and exiting if the times exceed a threshold.

To evade detection, the malware employs a randomized sleep timer that adjusts based on connection attempts, while it can also detect VM environments by searching for specific strings related to HyperV containers.

It potentially utilizes FTP, SMTP, and POP3 protocols for data exfiltration, where FTP (File Transfer Protocol) can be used to transfer files between systems, enabling unauthorized data transfer, and SMTP (Simple Mail Transfer Protocol) allows sending emails, potentially facilitating covert data transmission.POP3 (Post Office Protocol version 3) is used to retrieve emails from a server, potentially exposing sensitive information.

These protocols, when exploited, can compromise data confidentiality and integrity, leading to potential breaches.

The IOCs provided by Sonicwall represent malicious software artifacts, where the packed IOC, 85A6E921E4D5107D13C1EB8647B130A1D54BA2B6409118BE7945FD71C6C8235F, is a compressed or obfuscated version of the malware.

While the unpacked IOC, 8C97329CF7E48BB1464AC5132B6A02488B5F0358752B71E3135D9D0E4501B48D, is the decompressed or decrypted form of the malware, revealing its actual functionality and components.

There is a high probability that both indicators of compromise serve as indicators of compromise in a cyber security incident, which enables analysts to identify and stop the threat.

How to Choose an ultimate Managed SIEM solution for Your Security Team -> Download Free Guide(PDF)