Overview

overview

10

Static

static

99dd8186e3...56.exe

windows7_x64

10

99dd8186e3...56.exe

windows10-2004_x64

Analysis

  • max time kernel
    1802s
  • max time network
    1803s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    05-06-2022 02:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    99dd8186e3424ce6aa19ef2251a463f2c271f83919ac67adc288a68e6bcbf356.exe

  • Size

    1.1MB

  • MD5

    e96a060c227925a0271d5c1c03de25b1

  • SHA1

    e3271ae92fd5933353959dcbe280c9095718b137

  • SHA256

    99dd8186e3424ce6aa19ef2251a463f2c271f83919ac67adc288a68e6bcbf356

  • SHA512

    450d440db6ee2a3029f06b192c52a841f481d14f699585658fd5db318af92ae7eccd70e52beac5dd270c9931d0f0b12816e2cf0045ed20dade6367fb5631f8d8

Score
10/10
salitybackdoorevasiontrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Signatures

  • Modifies firewall policy service 2 TTPs 6 IoCs
    evasion
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality
  • UAC bypass 3 TTPs 2 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 12 IoCs
    evasiontrojan
  • Executes dropped EXE 2 IoCs
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Loads dropped DLL 5 IoCs
  • Windows security modification 2 TTPs 14 IoCs
    evasiontrojan
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 1 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 6 IoCs
  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 22 IoCs
  • Suspicious use of AdjustPrivilegeToken 35 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Windows\system32\lsass.exe
    C:\Windows\system32\lsass.exe
    1⤵
      PID:476
    • C:\Windows\system32\services.exe
      C:\Windows\system32\services.exe
      1⤵
        PID:468
        • C:\Windows\System32\svchost.exe
          C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
          2⤵
            PID:752
          • C:\Windows\system32\taskhost.exe
            "taskhost.exe"
            2⤵
              PID:1232
            • C:\Windows\system32\sppsvc.exe
              C:\Windows\system32\sppsvc.exe
              2⤵
                PID:1744
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
                2⤵
                  PID:1648
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
                  2⤵
                    PID:532
                  • C:\Windows\System32\spoolsv.exe
                    C:\Windows\System32\spoolsv.exe
                    2⤵
                      PID:280
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k NetworkService
                      2⤵
                        PID:300
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k netsvcs
                        2⤵
                          PID:864
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k LocalService
                          2⤵
                            PID:840
                          • C:\Windows\System32\svchost.exe
                            C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
                            2⤵
                              PID:796
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k RPCSS
                              2⤵
                                PID:668
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k DcomLaunch
                                2⤵
                                  PID:592
                                  • C:\Windows\system32\DllHost.exe
                                    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                    3⤵
                                      PID:2120
                                    • C:\Windows\system32\DllHost.exe
                                      C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
                                      3⤵
                                        PID:3964
                                  • C:\Windows\system32\winlogon.exe
                                    winlogon.exe
                                    1⤵
                                      PID:420
                                    • C:\Windows\system32\csrss.exe
                                      %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
                                      1⤵
                                        PID:384
                                      • \\?\C:\Windows\system32\wbem\WMIADAP.EXE
                                        wmiadap.exe /F /T /R
                                        1⤵
                                          PID:1664
                                        • C:\Windows\Explorer.EXE
                                          C:\Windows\Explorer.EXE
                                          1⤵
                                            PID:1412
                                            • C:\Users\Admin\AppData\Local\Temp\99dd8186e3424ce6aa19ef2251a463f2c271f83919ac67adc288a68e6bcbf356.exe
                                              "C:\Users\Admin\AppData\Local\Temp\99dd8186e3424ce6aa19ef2251a463f2c271f83919ac67adc288a68e6bcbf356.exe"
                                              2⤵
                                              • Modifies firewall policy service
                                              • UAC bypass
                                              • Windows security bypass
                                              • Loads dropped DLL
                                              • Windows security modification
                                              • Checks whether UAC is enabled
                                              • Enumerates connected drives
                                              • Drops autorun.inf file
                                              • Drops file in Program Files directory
                                              • Drops file in Windows directory
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious behavior: MapViewOfSection
                                              • Suspicious use of AdjustPrivilegeToken
                                              • Suspicious use of WriteProcessMemory
                                              • System policy modification
                                              PID:892
                                              • C:\Users\Admin\AppData\Local\Temp\99dd8186e3424ce6aa19ef2251a463f2c271f83919ac67adc288a68e6bcbf356mgr.exe
                                                C:\Users\Admin\AppData\Local\Temp\99dd8186e3424ce6aa19ef2251a463f2c271f83919ac67adc288a68e6bcbf356mgr.exe
                                                3⤵
                                                • Modifies firewall policy service
                                                • UAC bypass
                                                • Windows security bypass
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • Windows security modification
                                                • Checks whether UAC is enabled
                                                • Drops file in Windows directory
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                • Suspicious use of UnmapMainImage
                                                • System policy modification
                                                PID:620
                                                • C:\Users\Admin\AppData\Local\Temp\99dd8186e3424ce6aa19ef2251a463f2c271f83919ac67adc288a68e6bcbf356mgrmgr.exe
                                                  C:\Users\Admin\AppData\Local\Temp\99dd8186e3424ce6aa19ef2251a463f2c271f83919ac67adc288a68e6bcbf356mgrmgr.exe
                                                  4⤵
                                                  • Executes dropped EXE
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  • Suspicious use of UnmapMainImage
                                                  PID:1956
                                                  • C:\Program Files\Internet Explorer\iexplore.exe
                                                    "C:\Program Files\Internet Explorer\iexplore.exe"
                                                    5⤵
                                                    • Modifies Internet Explorer settings
                                                    • Suspicious behavior: GetForegroundWindowSpam
                                                    • Suspicious use of FindShellTrayWindow
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:1952
                                                    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1952 CREDAT:275457 /prefetch:2
                                                      6⤵
                                                      • Modifies Internet Explorer settings
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:2176
                                          • C:\Windows\system32\Dwm.exe
                                            "C:\Windows\system32\Dwm.exe"
                                            1⤵
                                              PID:1320
                                            • C:\Windows\system32\lsm.exe
                                              C:\Windows\system32\lsm.exe
                                              1⤵
                                                PID:484
                                              • C:\Windows\system32\wininit.exe
                                                wininit.exe
                                                1⤵
                                                  PID:360

                                                Network

                                                MITRE ATT&CK Enterprise v6

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                • C:\USERS\ADMIN\APPDATA\LOCAL\TEMP\99DD8186E3424CE6AA19EF2251A463F2C271F83919AC67ADC288A68E6BCBF356MGRMGR.EXE
                                                  Filesize

                                                  219KB

                                                  MD5

                                                  97cd3d9a98ca2fe86fbb20a82e09450f

                                                  SHA1

                                                  d5f1e44a7496aebd9d2ae0dc3711bfbca4133c2e

                                                  SHA256

                                                  de37738fb7e0cf919e92d4d58034d0fd44cdc04b50cc5a908484a36aca786794

                                                  SHA512

                                                  519480f214eb1d7dded581b10a53ed862c8a446a0d6ed232b23538a6f37388cac2154618765257e98af0df6d4f8fc0c142a0126aa2326eb202b7e7b5af165f37

                                                  Download Submit
                                                • C:\Users\Admin\AppData\Local\Temp\99dd8186e3424ce6aa19ef2251a463f2c271f83919ac67adc288a68e6bcbf356mgr.exe
                                                  Filesize

                                                  415KB

                                                  MD5

                                                  6f75ec4ac3149ec7468e545ea0974911

                                                  SHA1

                                                  a620749aa20321713cd808a8b48890e2348c67a9

                                                  SHA256

                                                  15c1c4e6d060f5b9a94a59d8c02bac5b468958a876d1f134ef6f9b426f6f5d0f

                                                  SHA512

                                                  2f3d9d1891aca41bfaedba81f4ed60500a92147db3c7ad5b42050c855f2e3af9dc8c24c84d3e9c85f8fbbce942b0285bc6c251801594a86f23c9881dd4934346

                                                  Download Submit
                                                • C:\Users\Admin\AppData\Local\Temp\99dd8186e3424ce6aa19ef2251a463f2c271f83919ac67adc288a68e6bcbf356mgrmgr.exe
                                                  Filesize

                                                  192KB

                                                  MD5

                                                  50c3eb11f951c669f1826faaa284a108

                                                  SHA1

                                                  d5f50d02dca2efc2966cb9c601c38e4f91eef7ef

                                                  SHA256

                                                  b6990dbc29b2ee8243a1d2171c4036e735df3dc225949e1446e76d87de601cad

                                                  SHA512

                                                  e74678aedd42faedcfc9470808ee7c9825f25787542678baabe6e74c0b4bc77aff0018ab30a1b18134ccb54dc7608d7de91cf76aa6438bdade361c7b3f4d56fa

                                                  Download Submit
                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\BGNSJM9S.txt
                                                  Filesize

                                                  601B

                                                  MD5

                                                  89296d28c25783879bb1458f84c8a655

                                                  SHA1

                                                  b20195a7328ac972216b37654b6ba9dfd617f19d

                                                  SHA256

                                                  92dcf660f184abc639cb0ea181077a3539801e900dae880cc18b21e10886d8b5

                                                  SHA512

                                                  7b5b298d6447bc063ab8ad223b219b9965d5a1cab822301ac3aa5a303e0cc1cbc3668aa3478ed9f34b1b38cce32c251a568ea4a5e8637d042280d835e8a10f31

                                                  Download Submit
                                                • C:\Windows\SYSTEM.INI
                                                  Filesize

                                                  255B

                                                  MD5

                                                  45af5c6290368d3dc256daf5394304e7

                                                  SHA1

                                                  0a85b859f367e83e03a2c2d8b0912c57953d94c6

                                                  SHA256

                                                  49d13694a6a54b61c56b623d41d97b605e9099a7fe686f0c9ef29b9ab23e1fe3

                                                  SHA512

                                                  df2929f8dce5821b0403fc9796c4ddf08ee0f4e0fa0773568ef90566ee47eb1f94e9fea5ddbfacf4f359b60c4a1b0c406f64051956d454af8c1ebef3347edcd3

                                                  Download Submit
                                                • \Users\Admin\AppData\Local\Temp\99dd8186e3424ce6aa19ef2251a463f2c271f83919ac67adc288a68e6bcbf356mgr.exe
                                                  Filesize

                                                  415KB

                                                  MD5

                                                  6f75ec4ac3149ec7468e545ea0974911

                                                  SHA1

                                                  a620749aa20321713cd808a8b48890e2348c67a9

                                                  SHA256

                                                  15c1c4e6d060f5b9a94a59d8c02bac5b468958a876d1f134ef6f9b426f6f5d0f

                                                  SHA512

                                                  2f3d9d1891aca41bfaedba81f4ed60500a92147db3c7ad5b42050c855f2e3af9dc8c24c84d3e9c85f8fbbce942b0285bc6c251801594a86f23c9881dd4934346

                                                  Download Submit
                                                • \Users\Admin\AppData\Local\Temp\99dd8186e3424ce6aa19ef2251a463f2c271f83919ac67adc288a68e6bcbf356mgr.exe
                                                  Filesize

                                                  415KB

                                                  MD5

                                                  6f75ec4ac3149ec7468e545ea0974911

                                                  SHA1

                                                  a620749aa20321713cd808a8b48890e2348c67a9

                                                  SHA256

                                                  15c1c4e6d060f5b9a94a59d8c02bac5b468958a876d1f134ef6f9b426f6f5d0f

                                                  SHA512

                                                  2f3d9d1891aca41bfaedba81f4ed60500a92147db3c7ad5b42050c855f2e3af9dc8c24c84d3e9c85f8fbbce942b0285bc6c251801594a86f23c9881dd4934346

                                                  Download Submit
                                                • \Users\Admin\AppData\Local\Temp\99dd8186e3424ce6aa19ef2251a463f2c271f83919ac67adc288a68e6bcbf356mgrmgr.exe
                                                  Filesize

                                                  192KB

                                                  MD5

                                                  50c3eb11f951c669f1826faaa284a108

                                                  SHA1

                                                  d5f50d02dca2efc2966cb9c601c38e4f91eef7ef

                                                  SHA256

                                                  b6990dbc29b2ee8243a1d2171c4036e735df3dc225949e1446e76d87de601cad

                                                  SHA512

                                                  e74678aedd42faedcfc9470808ee7c9825f25787542678baabe6e74c0b4bc77aff0018ab30a1b18134ccb54dc7608d7de91cf76aa6438bdade361c7b3f4d56fa

                                                  Download Submit
                                                • \Users\Admin\AppData\Local\Temp\99dd8186e3424ce6aa19ef2251a463f2c271f83919ac67adc288a68e6bcbf356mgrmgr.exe
                                                  Filesize

                                                  192KB

                                                  MD5

                                                  50c3eb11f951c669f1826faaa284a108

                                                  SHA1

                                                  d5f50d02dca2efc2966cb9c601c38e4f91eef7ef

                                                  SHA256

                                                  b6990dbc29b2ee8243a1d2171c4036e735df3dc225949e1446e76d87de601cad

                                                  SHA512

                                                  e74678aedd42faedcfc9470808ee7c9825f25787542678baabe6e74c0b4bc77aff0018ab30a1b18134ccb54dc7608d7de91cf76aa6438bdade361c7b3f4d56fa

                                                  Download Submit
                                                • \Users\Admin\AppData\Roaming\Wplugin.dll
                                                  Filesize

                                                  108KB

                                                  MD5

                                                  8847a8302dacc1d6fca61f125c8fe8e0

                                                  SHA1

                                                  f399142bbf03660bee1df555ebbf3acc8f658cf0

                                                  SHA256

                                                  9c2726defa122089f8251fa104f76d66830f448774ab9bd634adbb6e492e3943

                                                  SHA512

                                                  2b028bb4139c352b80db1509d1a3f479a8ef7e9b3b73ddbf62e2d83d4e59adf4a0bd6b9d68409bc0b6fafb7a5f56844fbfed6d00b824a6b370689801ce1c837f

                                                  Download Submit
                                                • memory/620-74-0x0000000000400000-0x000000000041A000-memory.dmp
                                                  Filesize

                                                  104KB

                                                  Download
                                                • memory/620-79-0x0000000002590000-0x000000000361E000-memory.dmp
                                                  Filesize

                                                  16.6MB

                                                  Download
                                                • memory/620-67-0x0000000002590000-0x000000000361E000-memory.dmp
                                                  Filesize

                                                  16.6MB

                                                  Download
                                                • memory/620-72-0x0000000000400000-0x000000000041A000-memory.dmp
                                                  Filesize

                                                  104KB

                                                  Download
                                                • memory/620-59-0x0000000000000000-mapping.dmp
                                                  Download
                                                • memory/620-77-0x000000007EFA0000-0x000000007EFAC000-memory.dmp
                                                  Filesize

                                                  48KB

                                                  Download
                                                • memory/620-76-0x0000000000400000-0x000000000041A000-memory.dmp
                                                  Filesize

                                                  104KB

                                                  Download
                                                • memory/892-82-0x000000002A9A0000-0x000000002BA2E000-memory.dmp
                                                  Filesize

                                                  16.6MB

                                                  Download
                                                • memory/892-56-0x0000000000400000-0x000000000050F000-memory.dmp
                                                  Filesize

                                                  1.1MB

                                                  Download
                                                • memory/892-80-0x0000000000300000-0x000000000036C000-memory.dmp
                                                  Filesize

                                                  432KB

                                                  Download
                                                • memory/892-81-0x00000000002C0000-0x00000000002C2000-memory.dmp
                                                  Filesize

                                                  8KB

                                                  Download
                                                • memory/892-91-0x0000000000300000-0x000000000036C000-memory.dmp
                                                  Filesize

                                                  432KB

                                                  Download
                                                • memory/892-54-0x00000000763B1000-0x00000000763B3000-memory.dmp
                                                  Filesize

                                                  8KB

                                                  Download
                                                • memory/892-84-0x000000002A9A0000-0x000000002BA2E000-memory.dmp
                                                  Filesize

                                                  16.6MB

                                                  Download
                                                • memory/892-85-0x00000000002C0000-0x00000000002C2000-memory.dmp
                                                  Filesize

                                                  8KB

                                                  Download
                                                • memory/892-60-0x0000000000300000-0x000000000036C000-memory.dmp
                                                  Filesize

                                                  432KB

                                                  Download
                                                • memory/892-87-0x000000002A9A0000-0x000000002BA2E000-memory.dmp
                                                  Filesize

                                                  16.6MB

                                                  Download
                                                • memory/892-90-0x0000000000300000-0x000000000036C000-memory.dmp
                                                  Filesize

                                                  432KB

                                                  Download
                                                • memory/892-89-0x0000000000400000-0x000000000050F000-memory.dmp
                                                  Filesize

                                                  1.1MB

                                                  Download
                                                • memory/1956-78-0x0000000000400000-0x000000000041A000-memory.dmp
                                                  Filesize

                                                  104KB

                                                  Download
                                                • memory/1956-64-0x0000000000000000-mapping.dmp
                                                  Download