sality | 361d661eddf275abdfe5f48f204cc6317156ca4575a36b1904a915c743dc97c8

General

Target

e4aff308bfc1759e22bd0b9b90f058fd.exe
Size

364KB
MD5

e4aff308bfc1759e22bd0b9b90f058fd
SHA1

25c4b6b7bde128de2d34069736d8209485470cb0
SHA256

361d661eddf275abdfe5f48f204cc6317156ca4575a36b1904a915c743dc97c8
SHA512

a92161e3a97783bc595898d121fd9962d485fbf76176a41310024cb15e9a95f910597e80621e21005d001a5b3dff36538fa18d123327669e828fd9c36f8e37e6
SSDEEP

6144:EyH7xOc6H5c6HcT66vlml/SI01Jq3ggxDDwCkTTgPMOXY+Dfkf5kV5WxHbCNCBuf:EagCkDLXNcRk7WF1Er5cI5

Score

10^/10

sality backdoor upx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality
Executes dropped EXE 3 IoCs

Processes:

svchost.exee4aff308bfc1759e22bd0b9b90f058fd.exesvchost.exe

pid process

1124 svchost.exe
1624 e4aff308bfc1759e22bd0b9b90f058fd.exe
2644 svchost.exe

pid	process
1124	svchost.exe
1624	e4aff308bfc1759e22bd0b9b90f058fd.exe
2644	svchost.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1624-138-0x0000000002350000-0x000000000340A000-memory.dmp	upx

Drops file in Program Files directory 25 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\setup.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\extcheck.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome_pwa_launcher.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\notification_helper.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	svchost.exe

Drops file in Windows directory 1 IoCs

Processes:

e4aff308bfc1759e22bd0b9b90f058fd.exe

description ioc process

File created C:\Windows\svchost.exe e4aff308bfc1759e22bd0b9b90f058fd.exe

description	ioc	process
File created	C:\Windows\svchost.exe	e4aff308bfc1759e22bd0b9b90f058fd.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

e4aff308bfc1759e22bd0b9b90f058fd.exesvchost.exe

description	pid	process	target process
PID 3744 wrote to memory of 1124	3744	e4aff308bfc1759e22bd0b9b90f058fd.exe	svchost.exe
PID 3744 wrote to memory of 1124	3744	e4aff308bfc1759e22bd0b9b90f058fd.exe	svchost.exe
PID 3744 wrote to memory of 1124	3744	e4aff308bfc1759e22bd0b9b90f058fd.exe	svchost.exe
PID 1124 wrote to memory of 1624	1124	svchost.exe	e4aff308bfc1759e22bd0b9b90f058fd.exe
PID 1124 wrote to memory of 1624	1124	svchost.exe	e4aff308bfc1759e22bd0b9b90f058fd.exe
PID 1124 wrote to memory of 1624	1124	svchost.exe	e4aff308bfc1759e22bd0b9b90f058fd.exe

C:\Users\Admin\AppData\Local\Temp\e4aff308bfc1759e22bd0b9b90f058fd.exe
"C:\Users\Admin\AppData\Local\Temp\e4aff308bfc1759e22bd0b9b90f058fd.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3744

C:\Windows\svchost.exe
"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\e4aff308bfc1759e22bd0b9b90f058fd.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124

C:\Users\Admin\AppData\Local\Temp\e4aff308bfc1759e22bd0b9b90f058fd.exe
"C:\Users\Admin\AppData\Local\Temp\e4aff308bfc1759e22bd0b9b90f058fd.exe"
3⤵
- Executes dropped EXE
PID:1624

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\e4aff308bfc1759e22bd0b9b90f058fd.exe
Filesize
328KB

MD5
7aad1ac5c0270bb5f4ac13f679c4a7c2

SHA1
bec09207b0434c911ff73ce52393a36618de8479

SHA256
ea2b99be940956b52f19ae66b8b570e51eb9c1c7252d4e082c0ae38d1f49d5d7

SHA512
2a243c822ecbd28a5407adc8f8bc2ece448ebb116352b9aac1bd88478b778ecd402380fffd10875bfe71a18e72508e84122b4e26b8d8f7ffcc79abeb039760fb

Download Submit
C:\Windows\svchost.exe
Filesize
35KB

MD5
83b4da0c5e91e676c355a34ad0fe73da

SHA1
09322303503ed0a70613110ca72e1bc790348882

SHA256
5ad575dccfe237328de529ea01d57917c5d639ed0d8454a01af98aaea9724110

SHA512
20183c78adbabf88ac8999521cc3e1884215f78c264f06cb017dd8749b995adc96559c5a9a39ecda3d2c34390cc5caf7dbf6b90b975d55e2ed129e1993eb5b08

Download Submit
C:\Windows\svchost.exe
Filesize
35KB

MD5
83b4da0c5e91e676c355a34ad0fe73da

SHA1
09322303503ed0a70613110ca72e1bc790348882

SHA256
5ad575dccfe237328de529ea01d57917c5d639ed0d8454a01af98aaea9724110

SHA512
20183c78adbabf88ac8999521cc3e1884215f78c264f06cb017dd8749b995adc96559c5a9a39ecda3d2c34390cc5caf7dbf6b90b975d55e2ed129e1993eb5b08

Download Submit
C:\Windows\svchost.exe
Filesize
35KB

MD5
83b4da0c5e91e676c355a34ad0fe73da

SHA1
09322303503ed0a70613110ca72e1bc790348882

SHA256
5ad575dccfe237328de529ea01d57917c5d639ed0d8454a01af98aaea9724110

SHA512
20183c78adbabf88ac8999521cc3e1884215f78c264f06cb017dd8749b995adc96559c5a9a39ecda3d2c34390cc5caf7dbf6b90b975d55e2ed129e1993eb5b08

Download Submit
memory/1124-132-0x0000000000000000-mapping.dmp

Download
memory/1624-135-0x0000000000000000-mapping.dmp

Download
memory/1624-138-0x0000000002350000-0x000000000340A000-memory.dmp

Filesize
16.7MB

Download
memory/1624-139-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads