sality | 926b31de3b1b605272a70e7e2c21bf746eb8dad96c67beb27c0b43739b6894bf

General

Target

926b31de3b1b605272a70e7e2c21bf746eb8dad96c67beb27c0b43739b6894bf.exe
Size

150KB
MD5

9366cc02735c7d11ccccc4eaca9bb64d
SHA1

da9a2109d364b9f96d4f7c7f9de50e71848e5217
SHA256

926b31de3b1b605272a70e7e2c21bf746eb8dad96c67beb27c0b43739b6894bf
SHA512

87bfac74771c172d40e56e3c89cb7e67042919b88c4463d2127d1eac629ded18af5750475d7d490f1f2d93da87c9a39fa3df0b594856f4fe3b66e198d4a0d02e

Score

10^/10

sality backdoor upx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Signatures

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4764-131-0x0000000002430000-0x00000000034BE000-memory.dmp	upx

Modifies data under HKEY_USERS 15 IoCs

Processes:

LogonUI.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "13"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe

Suspicious behavior: LoadsDriver 64 IoCs

Processes:

pid	process
4732
4844
1984
4928
4976
4412
8
4092
2288
3124
4084
2208
384
952
804
4244
4872
2164
1116
540
2728
4344
4352
4300
1756
1760
1704
1568
872
2596
1200
4800
372
4000
4484
4316
4336
1120
376
4724
812
1392
4460
224
212
3708
204
780
1288
4428
3280
2160
3752
4488
4376
4496
4516
4468
2756
3016
2480
2772
2828
1376

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

LogonUI.exe

pid process

3728 LogonUI.exe

pid	process
3728	LogonUI.exe

C:\Users\Admin\AppData\Local\Temp\926b31de3b1b605272a70e7e2c21bf746eb8dad96c67beb27c0b43739b6894bf.exe
"C:\Users\Admin\AppData\Local\Temp\926b31de3b1b605272a70e7e2c21bf746eb8dad96c67beb27c0b43739b6894bf.exe"
1⤵
PID:4764

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa39ec855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4764-130-0x0000000001000000-0x0000000001018000-memory.dmp

Filesize
96KB

Download
memory/4764-132-0x0000000001000000-0x0000000001018000-memory.dmp

Filesize
96KB

Download
memory/4764-131-0x0000000002430000-0x00000000034BE000-memory.dmp

Filesize
16.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads