sality | a0bda609a6ecaadcf5c6dced3f6fc53a4aa83fa3feb78bf2e64612ab69e37310

General

Target

7c620f942fa9513eb0d2dcff718be048.exe
Size

364KB
MD5

7c620f942fa9513eb0d2dcff718be048
SHA1

d61531c62747ce614356a3f31e905e774967c3ce
SHA256

a0bda609a6ecaadcf5c6dced3f6fc53a4aa83fa3feb78bf2e64612ab69e37310
SHA512

e319dacbcb1580cc06d7d772138b7e2ce38840cb6bb5832c2ed138c160404af9726bcc3db71d1fac91d51971d2f8fe945d3c4adb16213dc744d757f931477a3b
SSDEEP

6144:EyH7xOc6H5c6HcT66vlml/SI01Jq3ggxDDwCkTTgPdFnYOR/gBbf5k7Yqd0rqxBA:EagCkD3bgBbRk7YYzErSI5

Score

10^/10

sality backdoor upx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality
Executes dropped EXE 3 IoCs

Processes:

svchost.exe7c620f942fa9513eb0d2dcff718be048.exesvchost.exe

pid process

4952 svchost.exe
4936 7c620f942fa9513eb0d2dcff718be048.exe
4840 svchost.exe

pid	process
4952	svchost.exe
4936	7c620f942fa9513eb0d2dcff718be048.exe
4840	svchost.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4936-139-0x00000000022C0000-0x000000000337A000-memory.dmp	upx

Drops file in Program Files directory 51 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome_pwa_launcher.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jinfo.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jmc.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jstat.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\extcheck.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javac.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\java.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jhat.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javah.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jar.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jconsole.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jjs.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jmap.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jcmd.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jps.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jstack.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\setup.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javafxpackager.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jdb.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jrunscript.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jsadebugd.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\notification_helper.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jdeps.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe	svchost.exe

Drops file in Windows directory 1 IoCs

Processes:

7c620f942fa9513eb0d2dcff718be048.exe

description ioc process

File created C:\Windows\svchost.exe 7c620f942fa9513eb0d2dcff718be048.exe

description	ioc	process
File created	C:\Windows\svchost.exe	7c620f942fa9513eb0d2dcff718be048.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

7c620f942fa9513eb0d2dcff718be048.exesvchost.exe

description	pid	process	target process
PID 980 wrote to memory of 4952	980	7c620f942fa9513eb0d2dcff718be048.exe	svchost.exe
PID 980 wrote to memory of 4952	980	7c620f942fa9513eb0d2dcff718be048.exe	svchost.exe
PID 980 wrote to memory of 4952	980	7c620f942fa9513eb0d2dcff718be048.exe	svchost.exe
PID 4952 wrote to memory of 4936	4952	svchost.exe	7c620f942fa9513eb0d2dcff718be048.exe
PID 4952 wrote to memory of 4936	4952	svchost.exe	7c620f942fa9513eb0d2dcff718be048.exe
PID 4952 wrote to memory of 4936	4952	svchost.exe	7c620f942fa9513eb0d2dcff718be048.exe

C:\Users\Admin\AppData\Local\Temp\7c620f942fa9513eb0d2dcff718be048.exe
"C:\Users\Admin\AppData\Local\Temp\7c620f942fa9513eb0d2dcff718be048.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:980

C:\Windows\svchost.exe
"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\7c620f942fa9513eb0d2dcff718be048.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952

C:\Users\Admin\AppData\Local\Temp\7c620f942fa9513eb0d2dcff718be048.exe
"C:\Users\Admin\AppData\Local\Temp\7c620f942fa9513eb0d2dcff718be048.exe"
3⤵
- Executes dropped EXE
PID:4936

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7c620f942fa9513eb0d2dcff718be048.exe
Filesize
328KB

MD5
f82b25a6b47998d41c01b2c64a0a23b5

SHA1
768de94586036b697132ed8cc4d9259d65a55aed

SHA256
7b6273496be769c03c3d9201f289c51ad815ef95a70e1b1f6ff583fdbb40faf5

SHA512
c1e2a14203279232fad8a7414aab7b1e83262ad4c875271f6c9aedaadcfdeee36b57d52f280ddaabb9d09b7ddb0cf2b262aa49870ac63574468f118ff729218b

Download Submit
C:\Windows\svchost.exe
Filesize
35KB

MD5
83b4da0c5e91e676c355a34ad0fe73da

SHA1
09322303503ed0a70613110ca72e1bc790348882

SHA256
5ad575dccfe237328de529ea01d57917c5d639ed0d8454a01af98aaea9724110

SHA512
20183c78adbabf88ac8999521cc3e1884215f78c264f06cb017dd8749b995adc96559c5a9a39ecda3d2c34390cc5caf7dbf6b90b975d55e2ed129e1993eb5b08

Download Submit
C:\Windows\svchost.exe
Filesize
35KB

MD5
83b4da0c5e91e676c355a34ad0fe73da

SHA1
09322303503ed0a70613110ca72e1bc790348882

SHA256
5ad575dccfe237328de529ea01d57917c5d639ed0d8454a01af98aaea9724110

SHA512
20183c78adbabf88ac8999521cc3e1884215f78c264f06cb017dd8749b995adc96559c5a9a39ecda3d2c34390cc5caf7dbf6b90b975d55e2ed129e1993eb5b08

Download Submit
C:\Windows\svchost.exe
Filesize
35KB

MD5
83b4da0c5e91e676c355a34ad0fe73da

SHA1
09322303503ed0a70613110ca72e1bc790348882

SHA256
5ad575dccfe237328de529ea01d57917c5d639ed0d8454a01af98aaea9724110

SHA512
20183c78adbabf88ac8999521cc3e1884215f78c264f06cb017dd8749b995adc96559c5a9a39ecda3d2c34390cc5caf7dbf6b90b975d55e2ed129e1993eb5b08

Download Submit
memory/4936-135-0x0000000000000000-mapping.dmp

Download
memory/4936-137-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4936-139-0x00000000022C0000-0x000000000337A000-memory.dmp

Filesize
16.7MB

Download
memory/4936-140-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4952-132-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads