sality | b1a5ba0a25000f9ef9796aea25a23f7697501cad3b03db7ad5cf701964d9af4a

General

Target

df4a4e0d9c3a1a259ab41fad6bf45788.exe
Size

364KB
MD5

df4a4e0d9c3a1a259ab41fad6bf45788
SHA1

972ab064c1f8ece604932f9dfb24523ac1f50a68
SHA256

b1a5ba0a25000f9ef9796aea25a23f7697501cad3b03db7ad5cf701964d9af4a
SHA512

88793bf3a0c034411c18000a4764e5bbc28e3a69da024cb08ce508e223ce76db274603cd1a56f6e0a17429b74d2233e860ac94caec17d077ae09c1c3423b2004
SSDEEP

6144:EyH7xOc6H5c6HcT66vlml/SI01Jq3ggxDDwCkTTgPbVShf5kkmERgDBurgIH7wrF:EagCkDpVShRkuyDErFI5

Score

10^/10

sality backdoor upx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality
Executes dropped EXE 3 IoCs

Processes:

svchost.exedf4a4e0d9c3a1a259ab41fad6bf45788.exesvchost.exe

pid process

832 svchost.exe
2036 df4a4e0d9c3a1a259ab41fad6bf45788.exe
1280 svchost.exe

pid	process
832	svchost.exe
2036	df4a4e0d9c3a1a259ab41fad6bf45788.exe
1280	svchost.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2036-61-0x0000000001D00000-0x0000000002DBA000-memory.dmp	upx

Loads dropped DLL 1 IoCs

Processes:

svchost.exe

pid process

832 svchost.exe
Drops file in Windows directory 1 IoCs

Processes:

df4a4e0d9c3a1a259ab41fad6bf45788.exe

description ioc process

File created C:\Windows\svchost.exe df4a4e0d9c3a1a259ab41fad6bf45788.exe

pid	process
832	svchost.exe

description	ioc	process
File created	C:\Windows\svchost.exe	df4a4e0d9c3a1a259ab41fad6bf45788.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

df4a4e0d9c3a1a259ab41fad6bf45788.exesvchost.exe

description	pid	process	target process
PID 576 wrote to memory of 832	576	df4a4e0d9c3a1a259ab41fad6bf45788.exe	svchost.exe
PID 576 wrote to memory of 832	576	df4a4e0d9c3a1a259ab41fad6bf45788.exe	svchost.exe
PID 576 wrote to memory of 832	576	df4a4e0d9c3a1a259ab41fad6bf45788.exe	svchost.exe
PID 576 wrote to memory of 832	576	df4a4e0d9c3a1a259ab41fad6bf45788.exe	svchost.exe
PID 832 wrote to memory of 2036	832	svchost.exe	df4a4e0d9c3a1a259ab41fad6bf45788.exe
PID 832 wrote to memory of 2036	832	svchost.exe	df4a4e0d9c3a1a259ab41fad6bf45788.exe
PID 832 wrote to memory of 2036	832	svchost.exe	df4a4e0d9c3a1a259ab41fad6bf45788.exe
PID 832 wrote to memory of 2036	832	svchost.exe	df4a4e0d9c3a1a259ab41fad6bf45788.exe

C:\Users\Admin\AppData\Local\Temp\df4a4e0d9c3a1a259ab41fad6bf45788.exe
"C:\Users\Admin\AppData\Local\Temp\df4a4e0d9c3a1a259ab41fad6bf45788.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:576

C:\Windows\svchost.exe
"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\df4a4e0d9c3a1a259ab41fad6bf45788.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:832

C:\Users\Admin\AppData\Local\Temp\df4a4e0d9c3a1a259ab41fad6bf45788.exe
"C:\Users\Admin\AppData\Local\Temp\df4a4e0d9c3a1a259ab41fad6bf45788.exe"
3⤵
- Executes dropped EXE
PID:2036

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
PID:1280

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\df4a4e0d9c3a1a259ab41fad6bf45788.exe
Filesize
328KB

MD5
d0d5716fd8445cdc0b3e105455f1700c

SHA1
4473314fa7ada0a7ac19dfa1c8b28bb3dc39bb59

SHA256
6e8bfb4b731126f2062778cc58f7dd41be8440b131e1f06225945cd440e7fe44

SHA512
72b04c821b101c1bb5e724da9801e9af4b31d84fb268115e3b460db52a4d0735aefd2e9be54cf9a7808931586d5acbed42d3acb5bce4e8b603444b21661df4fa

Download Submit
C:\Windows\svchost.exe
Filesize
35KB

MD5
83b4da0c5e91e676c355a34ad0fe73da

SHA1
09322303503ed0a70613110ca72e1bc790348882

SHA256
5ad575dccfe237328de529ea01d57917c5d639ed0d8454a01af98aaea9724110

SHA512
20183c78adbabf88ac8999521cc3e1884215f78c264f06cb017dd8749b995adc96559c5a9a39ecda3d2c34390cc5caf7dbf6b90b975d55e2ed129e1993eb5b08

Download Submit
C:\Windows\svchost.exe
Filesize
35KB

MD5
83b4da0c5e91e676c355a34ad0fe73da

SHA1
09322303503ed0a70613110ca72e1bc790348882

SHA256
5ad575dccfe237328de529ea01d57917c5d639ed0d8454a01af98aaea9724110

SHA512
20183c78adbabf88ac8999521cc3e1884215f78c264f06cb017dd8749b995adc96559c5a9a39ecda3d2c34390cc5caf7dbf6b90b975d55e2ed129e1993eb5b08

Download Submit
C:\Windows\svchost.exe
Filesize
35KB

MD5
83b4da0c5e91e676c355a34ad0fe73da

SHA1
09322303503ed0a70613110ca72e1bc790348882

SHA256
5ad575dccfe237328de529ea01d57917c5d639ed0d8454a01af98aaea9724110

SHA512
20183c78adbabf88ac8999521cc3e1884215f78c264f06cb017dd8749b995adc96559c5a9a39ecda3d2c34390cc5caf7dbf6b90b975d55e2ed129e1993eb5b08

Download Submit
\Users\Admin\AppData\Local\Temp\df4a4e0d9c3a1a259ab41fad6bf45788.exe
Filesize
328KB

MD5
d0d5716fd8445cdc0b3e105455f1700c

SHA1
4473314fa7ada0a7ac19dfa1c8b28bb3dc39bb59

SHA256
6e8bfb4b731126f2062778cc58f7dd41be8440b131e1f06225945cd440e7fe44

SHA512
72b04c821b101c1bb5e724da9801e9af4b31d84fb268115e3b460db52a4d0735aefd2e9be54cf9a7808931586d5acbed42d3acb5bce4e8b603444b21661df4fa

Download Submit
memory/832-54-0x0000000000000000-mapping.dmp

Download
memory/2036-58-0x0000000000000000-mapping.dmp

Download
memory/2036-60-0x0000000075911000-0x0000000075913000-memory.dmp

Filesize
8KB

Download
memory/2036-61-0x0000000001D00000-0x0000000002DBA000-memory.dmp

Filesize
16.7MB

Download
memory/2036-62-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download

Analysis

Sharing