Overview

overview

10

Static

static

06fc2a1a5b...28.exe

windows7_x64

10

06fc2a1a5b...28.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    1798s
  • max time network
    1609s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    05-06-2022 15:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    06fc2a1a5b0e282508bbf99ddb356cd8cde51ec3ef5327fa482197a4bc01d928.exe

  • Size

    2.3MB

  • MD5

    f7c557fc2403c86746f2f45a25b98920

  • SHA1

    fe7761f978e3d956cbe1c16a2ac4146b6ede54a9

  • SHA256

    06fc2a1a5b0e282508bbf99ddb356cd8cde51ec3ef5327fa482197a4bc01d928

  • SHA512

    a52ca721f7f17380bb26cf80e7515c53f39cab9453e21f6515c39975fa3c0cbc05d3e15efa4cf0c23035e9ee42c778f3cb0930c1f299fbd4c34b020f6af6fdbf

Score
10/10
salityaspackv2backdoorevasionsuricatatrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Signatures

  • Modifies firewall policy service 2 TTPs 3 IoCs
    evasion
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality
  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 6 IoCs
    evasiontrojan
  • suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

    suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz

    suricata
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • ASPack v2.12-2.42 5 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 2 IoCs
  • Windows security modification 2 TTPs 7 IoCs
    evasiontrojan
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 1 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 21 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1132
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
        PID:1252
        • C:\Users\Admin\AppData\Local\Temp\06fc2a1a5b0e282508bbf99ddb356cd8cde51ec3ef5327fa482197a4bc01d928.exe
          "C:\Users\Admin\AppData\Local\Temp\06fc2a1a5b0e282508bbf99ddb356cd8cde51ec3ef5327fa482197a4bc01d928.exe"
          2⤵
          • Modifies firewall policy service
          • UAC bypass
          • Windows security bypass
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Identifies Wine through registry keys
          • Loads dropped DLL
          • Windows security modification
          • Checks whether UAC is enabled
          • Enumerates connected drives
          • Drops autorun.inf file
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Modifies Internet Explorer settings
          • Modifies system certificate store
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:1680
          • C:\Users\Admin\AppData\Local\Temp\sdWuUB.exe
            C:\Users\Admin\AppData\Local\Temp\sdWuUB.exe
            3⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious use of WriteProcessMemory
            PID:1160
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c ""C:\Users\Admin\AppData\Local\Temp\48e40a79.bat" "
              4⤵
                PID:1596
        • C:\Windows\system32\Dwm.exe
          "C:\Windows\system32\Dwm.exe"
          1⤵
            PID:1204
          • C:\Windows\system32\DllHost.exe
            C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
            1⤵
              PID:1180
            • C:\Windows\system32\DllHost.exe
              C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
              1⤵
                PID:1148
              • C:\Windows\system32\DllHost.exe
                C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
                1⤵
                  PID:1672
                • C:\Windows\system32\DllHost.exe
                  C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
                  1⤵
                    PID:628
                  • C:\Windows\system32\DllHost.exe
                    C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
                    1⤵
                      PID:2044
                    • C:\Windows\system32\DllHost.exe
                      C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
                      1⤵
                        PID:628
                      • C:\Windows\system32\DllHost.exe
                        C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
                        1⤵
                          PID:1672
                        • C:\Windows\system32\DllHost.exe
                          C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
                          1⤵
                            PID:1596
                          • C:\Windows\system32\DllHost.exe
                            C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
                            1⤵
                              PID:968
                            • C:\Windows\system32\DllHost.exe
                              C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
                              1⤵
                                PID:1920
                              • C:\Windows\system32\DllHost.exe
                                C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
                                1⤵
                                  PID:1616
                                • C:\Windows\system32\DllHost.exe
                                  C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
                                  1⤵
                                    PID:1240

                                  Network

                                  MITRE ATT&CK Enterprise v6

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\PROGRAM FILES\7-ZIP\Uninstall.exe
                                    Filesize

                                    103KB

                                    MD5

                                    6754c5774a5658adbedc131fb64b772c

                                    SHA1

                                    814ccaeba97b70f7de11f0db284d50e4fea7bda0

                                    SHA256

                                    ae41a8fc68fe0b4647b2eddaa4d71785d22873a8b8949f34cde7b3e8e778a500

                                    SHA512

                                    70471b7d72c5aa60cec8a6e70ea384df608a0db230d1e0718c170e9c34cada27457c29df514faaea8ab036eea0e70ea66e5049d983dd6f7e03fe2d30c962cd07

                                    Download Submit
                                  • C:\Users\Admin\AppData\Local\Temp\1EAC7144.exe
                                    Filesize

                                    4B

                                    MD5

                                    20879c987e2f9a916e578386d499f629

                                    SHA1

                                    c7b33ddcc42361fdb847036fc07e880b81935d5d

                                    SHA256

                                    9f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31

                                    SHA512

                                    bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f

                                    Download Submit
                                  • C:\Users\Admin\AppData\Local\Temp\27B769F0.exe
                                    Filesize

                                    4B

                                    MD5

                                    20879c987e2f9a916e578386d499f629

                                    SHA1

                                    c7b33ddcc42361fdb847036fc07e880b81935d5d

                                    SHA256

                                    9f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31

                                    SHA512

                                    bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f

                                    Download Submit
                                  • C:\Users\Admin\AppData\Local\Temp\302A2FD2.exe
                                    Filesize

                                    4B

                                    MD5

                                    20879c987e2f9a916e578386d499f629

                                    SHA1

                                    c7b33ddcc42361fdb847036fc07e880b81935d5d

                                    SHA256

                                    9f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31

                                    SHA512

                                    bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f

                                    Download Submit
                                  • C:\Users\Admin\AppData\Local\Temp\46354ECE.exe
                                    Filesize

                                    4B

                                    MD5

                                    20879c987e2f9a916e578386d499f629

                                    SHA1

                                    c7b33ddcc42361fdb847036fc07e880b81935d5d

                                    SHA256

                                    9f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31

                                    SHA512

                                    bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f

                                    Download Submit
                                  • C:\Users\Admin\AppData\Local\Temp\48e40a79.bat
                                    Filesize

                                    187B

                                    MD5

                                    aa1a5fc52390740a381e6fc2dd072364

                                    SHA1

                                    042faa104078153f2a09f1659f4c28744ea85201

                                    SHA256

                                    419f7ae7abf0c00fca12775ebad57d1f520359cf953fafb9f841a87d6f9f81be

                                    SHA512

                                    d48425c9b9a8d34126610233a1de0f7ee5bbf3fbfa345bfeba159fd6b3e01538b3e2d1e9af203b75681df557ce2054be3c959660cf6d36670802dcafaf724da3

                                    Download Submit
                                  • C:\Users\Admin\AppData\Local\Temp\640261A8.exe
                                    Filesize

                                    4B

                                    MD5

                                    20879c987e2f9a916e578386d499f629

                                    SHA1

                                    c7b33ddcc42361fdb847036fc07e880b81935d5d

                                    SHA256

                                    9f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31

                                    SHA512

                                    bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f

                                    Download Submit
                                  • C:\Users\Admin\AppData\Local\Temp\sdWuUB.exe
                                    Filesize

                                    15KB

                                    MD5

                                    56b2c3810dba2e939a8bb9fa36d3cf96

                                    SHA1

                                    99ee31cd4b0d6a4b62779da36e0eeecdd80589fc

                                    SHA256

                                    4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07

                                    SHA512

                                    27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e

                                    Download Submit
                                  • C:\Users\Admin\AppData\Local\Temp\sdWuUB.exe
                                    Filesize

                                    15KB

                                    MD5

                                    56b2c3810dba2e939a8bb9fa36d3cf96

                                    SHA1

                                    99ee31cd4b0d6a4b62779da36e0eeecdd80589fc

                                    SHA256

                                    4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07

                                    SHA512

                                    27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e

                                    Download Submit
                                  • \Users\Admin\AppData\Local\Temp\sdWuUB.exe
                                    Filesize

                                    15KB

                                    MD5

                                    56b2c3810dba2e939a8bb9fa36d3cf96

                                    SHA1

                                    99ee31cd4b0d6a4b62779da36e0eeecdd80589fc

                                    SHA256

                                    4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07

                                    SHA512

                                    27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e

                                    Download Submit
                                  • \Users\Admin\AppData\Local\Temp\sdWuUB.exe
                                    Filesize

                                    15KB

                                    MD5

                                    56b2c3810dba2e939a8bb9fa36d3cf96

                                    SHA1

                                    99ee31cd4b0d6a4b62779da36e0eeecdd80589fc

                                    SHA256

                                    4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07

                                    SHA512

                                    27812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e

                                    Download Submit
                                  • memory/1160-88-0x0000000000E40000-0x0000000000E49000-memory.dmp
                                    Filesize

                                    36KB

                                    Download
                                  • memory/1160-84-0x0000000000170000-0x0000000000172000-memory.dmp
                                    Filesize

                                    8KB

                                    Download
                                  • memory/1160-58-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/1160-66-0x0000000000E40000-0x0000000000E49000-memory.dmp
                                    Filesize

                                    36KB

                                    Download
                                  • memory/1160-71-0x0000000000170000-0x0000000000172000-memory.dmp
                                    Filesize

                                    8KB

                                    Download
                                  • memory/1596-87-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/1680-72-0x0000000000400000-0x00000000009C1000-memory.dmp
                                    Filesize

                                    5.8MB

                                    Download
                                  • memory/1680-69-0x0000000000400000-0x00000000009C1000-memory.dmp
                                    Filesize

                                    5.8MB

                                    Download
                                  • memory/1680-74-0x0000000076F70000-0x00000000770F0000-memory.dmp
                                    Filesize

                                    1.5MB

                                    Download
                                  • memory/1680-75-0x0000000000400000-0x00000000009C1000-memory.dmp
                                    Filesize

                                    5.8MB

                                    Download
                                  • memory/1680-83-0x00000000072A0000-0x00000000072A2000-memory.dmp
                                    Filesize

                                    8KB

                                    Download
                                  • memory/1680-67-0x0000000000B10000-0x0000000000B19000-memory.dmp
                                    Filesize

                                    36KB

                                    Download
                                  • memory/1680-70-0x00000000072A0000-0x00000000072A2000-memory.dmp
                                    Filesize

                                    8KB

                                    Download
                                  • memory/1680-54-0x00000000752B1000-0x00000000752B3000-memory.dmp
                                    Filesize

                                    8KB

                                    Download
                                  • memory/1680-64-0x0000000000B10000-0x0000000000B19000-memory.dmp
                                    Filesize

                                    36KB

                                    Download
                                  • memory/1680-73-0x00000000023A0000-0x000000000342E000-memory.dmp
                                    Filesize

                                    16.6MB

                                    Download
                                  • memory/1680-91-0x0000000000B10000-0x0000000000B19000-memory.dmp
                                    Filesize

                                    36KB

                                    Download
                                  • memory/1680-92-0x0000000000B10000-0x0000000000B19000-memory.dmp
                                    Filesize

                                    36KB

                                    Download
                                  • memory/1680-65-0x0000000000B10000-0x0000000000B19000-memory.dmp
                                    Filesize

                                    36KB

                                    Download
                                  • memory/1680-63-0x00000000023A0000-0x000000000342E000-memory.dmp
                                    Filesize

                                    16.6MB

                                    Download
                                  • memory/1680-62-0x0000000000400000-0x00000000009C1000-memory.dmp
                                    Filesize

                                    5.8MB

                                    Download
                                  • memory/1680-68-0x0000000076F70000-0x00000000770F0000-memory.dmp
                                    Filesize

                                    1.5MB

                                    Download
                                  • memory/1680-55-0x00000000023A0000-0x000000000342E000-memory.dmp
                                    Filesize

                                    16.6MB

                                    Download