sality | 3c172f4a0a21bd8ad1fabd66548cd3fffa21e8515809b7f16d6d9d23b50ba9ef

General

Target

2932b77e08e4bedbd61c34b581d69b48.exe
Size

368KB
MD5

2932b77e08e4bedbd61c34b581d69b48
SHA1

e5e9be17066875a1906892d14148d88bd3c9a019
SHA256

3c172f4a0a21bd8ad1fabd66548cd3fffa21e8515809b7f16d6d9d23b50ba9ef
SHA512

a5ec49a09bc97f579747f859f9feb8c5ebf1b4e7b240d2cd62c3a4e919d74e5f331b3a42420868924cf9ddef180e8406c5c01910da9be23e75133d06296e18a5
SSDEEP

6144:EyH7xOc6H5c6HcT66vlml/SI01Jq3ggxDDwCkTTgPyMQqBIf5k+zwd8O3XH/Bura:EagCkDTBIRk1CcvErlI5

Score

10^/10

sality backdoor upx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality
Executes dropped EXE 3 IoCs

Processes:

svchost.exe2932b77e08e4bedbd61c34b581d69b48.exesvchost.exe

pid process

4804 svchost.exe
2648 2932b77e08e4bedbd61c34b581d69b48.exe
1380 svchost.exe

pid	process
4804	svchost.exe
2648	2932b77e08e4bedbd61c34b581d69b48.exe
1380	svchost.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2648-138-0x0000000002400000-0x00000000034BA000-memory.dmp	upx
behavioral2/memory/2648-140-0x0000000002400000-0x00000000034BA000-memory.dmp	upx

Drops file in Program Files directory 38 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\notification_helper.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\java.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jar.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javafxpackager.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jcmd.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javah.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome_pwa_launcher.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\extcheck.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javac.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\setup.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe	svchost.exe

Drops file in Windows directory 1 IoCs

Processes:

2932b77e08e4bedbd61c34b581d69b48.exe

description ioc process

File created C:\Windows\svchost.exe 2932b77e08e4bedbd61c34b581d69b48.exe

description	ioc	process
File created	C:\Windows\svchost.exe	2932b77e08e4bedbd61c34b581d69b48.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

2932b77e08e4bedbd61c34b581d69b48.exesvchost.exe

description	pid	process	target process
PID 4912 wrote to memory of 4804	4912	2932b77e08e4bedbd61c34b581d69b48.exe	svchost.exe
PID 4912 wrote to memory of 4804	4912	2932b77e08e4bedbd61c34b581d69b48.exe	svchost.exe
PID 4912 wrote to memory of 4804	4912	2932b77e08e4bedbd61c34b581d69b48.exe	svchost.exe
PID 4804 wrote to memory of 2648	4804	svchost.exe	2932b77e08e4bedbd61c34b581d69b48.exe
PID 4804 wrote to memory of 2648	4804	svchost.exe	2932b77e08e4bedbd61c34b581d69b48.exe
PID 4804 wrote to memory of 2648	4804	svchost.exe	2932b77e08e4bedbd61c34b581d69b48.exe

C:\Users\Admin\AppData\Local\Temp\2932b77e08e4bedbd61c34b581d69b48.exe
"C:\Users\Admin\AppData\Local\Temp\2932b77e08e4bedbd61c34b581d69b48.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4912

C:\Windows\svchost.exe
"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\2932b77e08e4bedbd61c34b581d69b48.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804

C:\Users\Admin\AppData\Local\Temp\2932b77e08e4bedbd61c34b581d69b48.exe
"C:\Users\Admin\AppData\Local\Temp\2932b77e08e4bedbd61c34b581d69b48.exe"
3⤵
- Executes dropped EXE
PID:2648

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2932b77e08e4bedbd61c34b581d69b48.exe
Filesize
332KB

MD5
7f341d672a927934aec8a3aaeade04f2

SHA1
8d191fe20ba4dc62d38012c2c1253591fea71d6b

SHA256
e44468e51f816a77ba2659484d48bcb4a10b7123be5e575b8189aa124750c6a3

SHA512
bba6a08084b26e0a8ab2e05855ca73f8ac3869cf87fb678c3336182c6647cc582b90fb9720b1a23a777388f6c8bb682ada563940893393d73647895efeb8710f

Download Submit
C:\Windows\svchost.exe
Filesize
35KB

MD5
83b4da0c5e91e676c355a34ad0fe73da

SHA1
09322303503ed0a70613110ca72e1bc790348882

SHA256
5ad575dccfe237328de529ea01d57917c5d639ed0d8454a01af98aaea9724110

SHA512
20183c78adbabf88ac8999521cc3e1884215f78c264f06cb017dd8749b995adc96559c5a9a39ecda3d2c34390cc5caf7dbf6b90b975d55e2ed129e1993eb5b08

Download Submit
C:\Windows\svchost.exe
Filesize
35KB

MD5
83b4da0c5e91e676c355a34ad0fe73da

SHA1
09322303503ed0a70613110ca72e1bc790348882

SHA256
5ad575dccfe237328de529ea01d57917c5d639ed0d8454a01af98aaea9724110

SHA512
20183c78adbabf88ac8999521cc3e1884215f78c264f06cb017dd8749b995adc96559c5a9a39ecda3d2c34390cc5caf7dbf6b90b975d55e2ed129e1993eb5b08

Download Submit
C:\Windows\svchost.exe
Filesize
35KB

MD5
83b4da0c5e91e676c355a34ad0fe73da

SHA1
09322303503ed0a70613110ca72e1bc790348882

SHA256
5ad575dccfe237328de529ea01d57917c5d639ed0d8454a01af98aaea9724110

SHA512
20183c78adbabf88ac8999521cc3e1884215f78c264f06cb017dd8749b995adc96559c5a9a39ecda3d2c34390cc5caf7dbf6b90b975d55e2ed129e1993eb5b08

Download Submit
memory/2648-135-0x0000000000000000-mapping.dmp

Download
memory/2648-138-0x0000000002400000-0x00000000034BA000-memory.dmp

Filesize
16.7MB

Download
memory/2648-139-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/2648-140-0x0000000002400000-0x00000000034BA000-memory.dmp

Filesize
16.7MB

Download
memory/2648-141-0x0000000002400000-0x00000000034BA000-memory.dmp

Filesize
16.7MB

Download
memory/4804-132-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads