sality | 7d558c9741933cd53bc746c8398f83b0aa608d4ce49577a1979f7fd25c9f93a9

General

Target

virussign.exe
Size

72KB
MD5

1086558ccdfa2a85b6438d5417901d50
SHA1

5fcac23e230f2b7697440b207af8e37bd0fc5db0
SHA256

7d558c9741933cd53bc746c8398f83b0aa608d4ce49577a1979f7fd25c9f93a9
SHA512

8d7401d0229d5db86351eb8a0bfb05353424d691d6fa7d31950bb01087555ed933e647b70d1963b60b3b2a0a1f0b332feb70578edb62c26840c7d04a16e135fa

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Modifies firewall policy service 2 TTPs 3 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

virussign.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	virussign.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	virussign.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	virussign.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality
UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

virussign.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" virussign.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	virussign.exe

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

virussign.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	virussign.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	virussign.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	virussign.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	virussign.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	virussign.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	virussign.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1892-56-0x0000000001ED0000-0x0000000002F8A000-memory.dmp	upx
behavioral1/memory/1892-58-0x0000000001ED0000-0x0000000002F8A000-memory.dmp	upx

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

virussign.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	virussign.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	virussign.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	virussign.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	virussign.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	virussign.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	virussign.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	virussign.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

virussign.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" virussign.exe
Drops file in Windows directory 2 IoCs

Processes:

virussign.exe

description ioc process

File created C:\Windows\6c3fdf virussign.exe
File opened for modification C:\Windows\SYSTEM.INI virussign.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

virussign.exe

pid process

1892 virussign.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	virussign.exe

description	ioc	process
File created	C:\Windows\6c3fdf	virussign.exe
File opened for modification	C:\Windows\SYSTEM.INI	virussign.exe

pid	process
1892	virussign.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

virussign.exe

description	pid	process
Token: SeDebugPrivilege	1892	virussign.exe
Token: SeDebugPrivilege	1892	virussign.exe
Token: SeDebugPrivilege	1892	virussign.exe
Token: SeDebugPrivilege	1892	virussign.exe
Token: SeDebugPrivilege	1892	virussign.exe
Token: SeDebugPrivilege	1892	virussign.exe
Token: SeDebugPrivilege	1892	virussign.exe
Token: SeDebugPrivilege	1892	virussign.exe
Token: SeDebugPrivilege	1892	virussign.exe
Token: SeDebugPrivilege	1892	virussign.exe
Token: SeDebugPrivilege	1892	virussign.exe
Token: SeDebugPrivilege	1892	virussign.exe
Token: SeDebugPrivilege	1892	virussign.exe
Token: SeDebugPrivilege	1892	virussign.exe
Token: SeDebugPrivilege	1892	virussign.exe
Token: SeDebugPrivilege	1892	virussign.exe
Token: SeDebugPrivilege	1892	virussign.exe
Token: SeDebugPrivilege	1892	virussign.exe
Token: SeDebugPrivilege	1892	virussign.exe
Token: SeDebugPrivilege	1892	virussign.exe
Token: SeDebugPrivilege	1892	virussign.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

virussign.exe

description	pid	process	target process
PID 1892 wrote to memory of 1120	1892	virussign.exe	taskhost.exe
PID 1892 wrote to memory of 1184	1892	virussign.exe	Dwm.exe
PID 1892 wrote to memory of 1212	1892	virussign.exe	Explorer.EXE

System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

virussign.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" virussign.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	virussign.exe

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1184

C:\Users\Admin\AppData\Local\Temp\virussign.exe
"C:\Users\Admin\AppData\Local\Temp\virussign.exe"
1⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1892

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1212

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1120

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Modify Registry

5

T1112

Bypass User Account Control

1

T1088

Disabling Security Tools

3

T1089

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1892-54-0x0000000075AE1000-0x0000000075AE3000-memory.dmp

Filesize
8KB

Download
memory/1892-55-0x0000000036BB0000-0x0000000036BC5000-memory.dmp

Filesize
84KB

Download
memory/1892-56-0x0000000001ED0000-0x0000000002F8A000-memory.dmp

Filesize
16.7MB

Download
memory/1892-57-0x0000000036BB0000-0x0000000036BC5000-memory.dmp

Filesize
84KB

Download
memory/1892-58-0x0000000001ED0000-0x0000000002F8A000-memory.dmp

Filesize
16.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads