sality | 964fceb4b1d128fe2c290ab638eac85f8fa83e33d5fe55e44644b9aea42618bd

General

Target

229441a87fc526cd213093982f923e58.exe
Size

368KB
MD5

229441a87fc526cd213093982f923e58
SHA1

629de35848e312bcca189891967142ff9a5bda0d
SHA256

964fceb4b1d128fe2c290ab638eac85f8fa83e33d5fe55e44644b9aea42618bd
SHA512

b4ec3b58db21e5c0e5c1acceb7812beba453a5a9395ed201c96fac8aebff41c5c81ce58d9bdfd4e9b3abe248c5be533689d8a7175bb2739aad87f22417051a0a
SSDEEP

6144:EyH7xOc6H5c6HcT66vlml/SI01Jq3ggxDDwCkTTgPF2lamf5k3Yyl113pa/JBurc:EagCkDoRkK/JErDI5

Score

10^/10

sality backdoor upx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality
Executes dropped EXE 3 IoCs

Processes:

svchost.exe229441a87fc526cd213093982f923e58.exesvchost.exe

pid process

4580 svchost.exe
3696 229441a87fc526cd213093982f923e58.exe
312 svchost.exe

pid	process
4580	svchost.exe
3696	229441a87fc526cd213093982f923e58.exe
312	svchost.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3696-140-0x00000000023A0000-0x000000000345A000-memory.dmp	upx

Drops file in Program Files directory 53 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javah.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jconsole.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jcmd.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jhat.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jvisualvm.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\java.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jdeps.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jstat.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome_pwa_launcher.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\notification_helper.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jjs.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jrunscript.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javac.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jmap.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jstack.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\extcheck.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jinfo.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jsadebugd.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jstatd.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jps.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javafxpackager.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jdb.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\setup.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jar.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jmc.exe	svchost.exe

Drops file in Windows directory 1 IoCs

Processes:

229441a87fc526cd213093982f923e58.exe

description ioc process

File created C:\Windows\svchost.exe 229441a87fc526cd213093982f923e58.exe

description	ioc	process
File created	C:\Windows\svchost.exe	229441a87fc526cd213093982f923e58.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

229441a87fc526cd213093982f923e58.exesvchost.exe

description	pid	process	target process
PID 1896 wrote to memory of 4580	1896	229441a87fc526cd213093982f923e58.exe	svchost.exe
PID 1896 wrote to memory of 4580	1896	229441a87fc526cd213093982f923e58.exe	svchost.exe
PID 1896 wrote to memory of 4580	1896	229441a87fc526cd213093982f923e58.exe	svchost.exe
PID 4580 wrote to memory of 3696	4580	svchost.exe	229441a87fc526cd213093982f923e58.exe
PID 4580 wrote to memory of 3696	4580	svchost.exe	229441a87fc526cd213093982f923e58.exe
PID 4580 wrote to memory of 3696	4580	svchost.exe	229441a87fc526cd213093982f923e58.exe

C:\Users\Admin\AppData\Local\Temp\229441a87fc526cd213093982f923e58.exe
"C:\Users\Admin\AppData\Local\Temp\229441a87fc526cd213093982f923e58.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1896

C:\Windows\svchost.exe
"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\229441a87fc526cd213093982f923e58.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580

C:\Users\Admin\AppData\Local\Temp\229441a87fc526cd213093982f923e58.exe
"C:\Users\Admin\AppData\Local\Temp\229441a87fc526cd213093982f923e58.exe"
3⤵
- Executes dropped EXE
PID:3696

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:312

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\229441a87fc526cd213093982f923e58.exe
Filesize
332KB

MD5
bfcfef6fc78c10ff3cc871a28853f00b

SHA1
29773622ae8b2aff2d9d1e26bb4736fdf23976d0

SHA256
e1515e5c52bb82ca7e5f757e36fe50115e077ba7c191c9af227068898bd37acf

SHA512
6e6e84dd1a067d332a2200b297035711032103a518d4789fe6503dd0a901901518c5f9cec8da62e4b0cc09af906bef6380f7b401873e5bd38df7c3194992cf2a

Download Submit
C:\Windows\svchost.exe
Filesize
35KB

MD5
83b4da0c5e91e676c355a34ad0fe73da

SHA1
09322303503ed0a70613110ca72e1bc790348882

SHA256
5ad575dccfe237328de529ea01d57917c5d639ed0d8454a01af98aaea9724110

SHA512
20183c78adbabf88ac8999521cc3e1884215f78c264f06cb017dd8749b995adc96559c5a9a39ecda3d2c34390cc5caf7dbf6b90b975d55e2ed129e1993eb5b08

Download Submit
C:\Windows\svchost.exe
Filesize
35KB

MD5
83b4da0c5e91e676c355a34ad0fe73da

SHA1
09322303503ed0a70613110ca72e1bc790348882

SHA256
5ad575dccfe237328de529ea01d57917c5d639ed0d8454a01af98aaea9724110

SHA512
20183c78adbabf88ac8999521cc3e1884215f78c264f06cb017dd8749b995adc96559c5a9a39ecda3d2c34390cc5caf7dbf6b90b975d55e2ed129e1993eb5b08

Download Submit
C:\Windows\svchost.exe
Filesize
35KB

MD5
83b4da0c5e91e676c355a34ad0fe73da

SHA1
09322303503ed0a70613110ca72e1bc790348882

SHA256
5ad575dccfe237328de529ea01d57917c5d639ed0d8454a01af98aaea9724110

SHA512
20183c78adbabf88ac8999521cc3e1884215f78c264f06cb017dd8749b995adc96559c5a9a39ecda3d2c34390cc5caf7dbf6b90b975d55e2ed129e1993eb5b08

Download Submit
memory/3696-136-0x0000000000000000-mapping.dmp

Download
memory/3696-138-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/3696-140-0x00000000023A0000-0x000000000345A000-memory.dmp

Filesize
16.7MB

Download
memory/3696-141-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4580-133-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads