MalwareUsed by 1 actor

WinorDLL64

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Lazarus

We named this payload WinorDLL64 based on its filename WinorDLL64.dll ... The WinorDLL64 payload serves as a backdoor that most notably acquires extensive system information, provides means for file manipulation, such as exfiltrating, overwriting, and removing files, and executes additional commands.

via eset welivesecurity blogwelivesecurity.com

MITRE ATT&CK

Techniques & procedures

20 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1587.001MalwareEvidence1

T1587.001 Develop Capabilities: Malware WinorDLL64 is a custom tool.

Execution

2 techniques

T1059.001PowerShellEvidence1

T1059.001 Command and Scripting Interpreter: PowerShell WinorDLL64 can execute arbitrary PowerShell commands.

T1106Native APIEvidence1

T1106 Native API WinorDLL64 can execute further processes using the CreateProcessW and CreateProcessAsUserW APIs.

Privilege Escalation

1 technique

T1134.002Create Process with TokenEvidence1

T1134.002 Access Token Manipulation: Create Process with Token WinorDLL64 can call APIs WTSQueryUserToken and CreateProcessAsUserW to create a process under an impersonated user.

Stealth

2 techniques

T1070.004File DeletionEvidence1

T1070.004 Indicator Removal: File Deletion WinorDLL64 can securely remove arbitrary files.

T1134.002Create Process with TokenEvidence1

T1134.002 Access Token Manipulation: Create Process with Token WinorDLL64 can call APIs WTSQueryUserToken and CreateProcessAsUserW to create a process under an impersonated user.

Discovery

12 techniques

T1012Query RegistryEvidence1

T1012 Query Registry WinorDLL64 can query the Windows registry to gather system information.

T1016System Network Configuration DiscoveryEvidence1

T1016 System Network Configuration Discovery WinorDLL64 can enumerate network adapter information.

T1033System Owner/User DiscoveryEvidence1

T1033 System Owner/User Discovery WinorDLL64 can enumerate sessions and list associated user, domain, and client names –among other details.

T1049System Network Connections DiscoveryEvidence1

T1049 System Network Connections Discovery WinorDLL64 can collect a list of listening ports.

T1057Process DiscoveryEvidence1

T1057 Process Discovery WinorDLL64 can collect information about running processes.

T1082System Information DiscoveryEvidence1

T1082 System Information Discovery WinorDLL64 can obtain information such as computer name, OS and latest service pack version, processor architecture, processor name, and amount of space on fixed drives.

T1083File and Directory DiscoveryEvidence1

T1083 File and Directory Discovery WinorDLL64 can obtain file and directory listings.

T1087.001Local AccountEvidence1

T1087.001 Account Discovery: Local Account WinorDLL64 can enumerate sessions and list associated user, and client names, among other details.

T1087.002Domain AccountEvidence1

T1087.002 Account Discovery: Domain Account WinorDLL64 can enumerate sessions and list associated domain names –among other details.

T1135Network Share DiscoveryEvidence1

T1135 Network Share Discovery WinorDLL64 can discover shared network drives.

T1614System Location DiscoveryEvidence1

T1614 System Location Discovery WinorDLL64 can obtain the victim’s default country name using the GetLocaleInfoW API.

T1614.001System Language DiscoveryEvidence1

T1614.001 System Location Discovery: System Language Discovery WinorDLL64 can obtain the victim’s default language using the GetLocaleInfoW API.

Collection

2 techniques

T1005Data from Local SystemEvidence1

T1005 Data from Local System WinorDLL64 can collect data on the victim’s device.

T1560.002Archive via LibraryEvidence1

T1560.002 Archive Collected Data: Archive via Library WinorDLL64 can compress and exfiltrate directories using the quicklz library.

Impact

1 technique

T1531Account Access RemovalEvidence1

T1531 Account Access Removal WinorDLL64 can disconnect a logged-on user from specified sessions.

INDICATORS OF COMPROMISE

IOCs tracked for this family

4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

4 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha1●●●●●●●●●●●●View more in app4 years ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

eset welivesecurity blogNews

Feb 23, 2023

WinorDLL64: A backdoor from the vast Lazarus arsenal?

A DLL backdoor payload delivered by Wslink that gathers extensive system information, manipulates and exfiltrates files, executes additional commands including PowerShell, enumerates sessions/processes/network information, and communicates over an already established encrypted TCP connection provided by its loader.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching4

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping20

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actor

WinorDLL64

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Lazarus

via eset welivesecurity blogwelivesecurity.com

MITRE ATT&CK

Techniques & procedures

20 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1587.001MalwareEvidence1

T1587.001 Develop Capabilities: Malware WinorDLL64 is a custom tool.

Execution

2 techniques

T1059.001PowerShellEvidence1

T1059.001 Command and Scripting Interpreter: PowerShell WinorDLL64 can execute arbitrary PowerShell commands.

T1106Native APIEvidence1

T1106 Native API WinorDLL64 can execute further processes using the CreateProcessW and CreateProcessAsUserW APIs.

Privilege Escalation

1 technique

T1134.002Create Process with TokenEvidence1

T1134.002 Access Token Manipulation: Create Process with Token WinorDLL64 can call APIs WTSQueryUserToken and CreateProcessAsUserW to create a process under an impersonated user.

Stealth

2 techniques

T1070.004File DeletionEvidence1

T1070.004 Indicator Removal: File Deletion WinorDLL64 can securely remove arbitrary files.

T1134.002Create Process with TokenEvidence1

T1134.002 Access Token Manipulation: Create Process with Token WinorDLL64 can call APIs WTSQueryUserToken and CreateProcessAsUserW to create a process under an impersonated user.

Discovery

12 techniques

T1012Query RegistryEvidence1

T1012 Query Registry WinorDLL64 can query the Windows registry to gather system information.

T1016System Network Configuration DiscoveryEvidence1

T1016 System Network Configuration Discovery WinorDLL64 can enumerate network adapter information.

T1033System Owner/User DiscoveryEvidence1

T1033 System Owner/User Discovery WinorDLL64 can enumerate sessions and list associated user, domain, and client names –among other details.

T1049System Network Connections DiscoveryEvidence1

T1049 System Network Connections Discovery WinorDLL64 can collect a list of listening ports.

T1057Process DiscoveryEvidence1

T1057 Process Discovery WinorDLL64 can collect information about running processes.

T1082System Information DiscoveryEvidence1

T1083File and Directory DiscoveryEvidence1

T1083 File and Directory Discovery WinorDLL64 can obtain file and directory listings.

T1087.001Local AccountEvidence1

T1087.001 Account Discovery: Local Account WinorDLL64 can enumerate sessions and list associated user, and client names, among other details.

T1087.002Domain AccountEvidence1

T1087.002 Account Discovery: Domain Account WinorDLL64 can enumerate sessions and list associated domain names –among other details.

T1135Network Share DiscoveryEvidence1

T1135 Network Share Discovery WinorDLL64 can discover shared network drives.

T1614System Location DiscoveryEvidence1

T1614 System Location Discovery WinorDLL64 can obtain the victim’s default country name using the GetLocaleInfoW API.

T1614.001System Language DiscoveryEvidence1

T1614.001 System Location Discovery: System Language Discovery WinorDLL64 can obtain the victim’s default language using the GetLocaleInfoW API.

Collection

2 techniques

T1005Data from Local SystemEvidence1

T1005 Data from Local System WinorDLL64 can collect data on the victim’s device.

T1560.002Archive via LibraryEvidence1

T1560.002 Archive Collected Data: Archive via Library WinorDLL64 can compress and exfiltrate directories using the quicklz library.

Impact

1 technique

T1531Account Access RemovalEvidence1

T1531 Account Access Removal WinorDLL64 can disconnect a logged-on user from specified sessions.

INDICATORS OF COMPROMISE

IOCs tracked for this family

4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

4 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha1●●●●●●●●●●●●View more in app4 years ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

eset welivesecurity blogNews

Feb 23, 2023

WinorDLL64: A backdoor from the vast Lazarus arsenal?

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching4

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping20

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.