sality | a40394e67969d92cf910879064a5d01b9da9015425462db4f057428680dc3e86

General

Target

30fc94fb1f9ab5273746539d316d3399.exe
Size

356KB
MD5

30fc94fb1f9ab5273746539d316d3399
SHA1

031d36dcf4f7fa777cbeda2e13a538c97c075e11
SHA256

a40394e67969d92cf910879064a5d01b9da9015425462db4f057428680dc3e86
SHA512

3ec6cb6bbd336aaad943e4c005b0783d1784e7a8ab660a12a1c4cbb17b9bcfc5c60afb94324c401f4d7b0deb8fd00294a261a8d8e303a1347cac0e7374958325
SSDEEP

6144:EyH7xOc6H5c6HcT66vlml/SI01Jq3ggxDDwCkTTgPS/AOrf5k0pm+6GX3BurgI3U:EagCkDWAOrRk0IS3ErZI5

Score

10^/10

sality backdoor upx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality
Executes dropped EXE 3 IoCs

Processes:

svchost.exe30fc94fb1f9ab5273746539d316d3399.exesvchost.exe

pid process

4572 svchost.exe
4016 30fc94fb1f9ab5273746539d316d3399.exe
1656 svchost.exe

pid	process
4572	svchost.exe
4016	30fc94fb1f9ab5273746539d316d3399.exe
1656	svchost.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4016-139-0x00000000023E0000-0x000000000349A000-memory.dmp	upx

Drops file in Program Files directory 51 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jcmd.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javafxpackager.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jdb.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jdeps.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jjs.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jps.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jstat.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jar.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\java.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jmap.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jmc.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jsadebugd.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome_pwa_launcher.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\notification_helper.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javah.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jconsole.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jrunscript.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javac.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jinfo.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jstack.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\setup.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\extcheck.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jhat.exe	svchost.exe

Drops file in Windows directory 1 IoCs

Processes:

30fc94fb1f9ab5273746539d316d3399.exe

description ioc process

File created C:\Windows\svchost.exe 30fc94fb1f9ab5273746539d316d3399.exe

description	ioc	process
File created	C:\Windows\svchost.exe	30fc94fb1f9ab5273746539d316d3399.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

30fc94fb1f9ab5273746539d316d3399.exesvchost.exe

description	pid	process	target process
PID 3296 wrote to memory of 4572	3296	30fc94fb1f9ab5273746539d316d3399.exe	svchost.exe
PID 3296 wrote to memory of 4572	3296	30fc94fb1f9ab5273746539d316d3399.exe	svchost.exe
PID 3296 wrote to memory of 4572	3296	30fc94fb1f9ab5273746539d316d3399.exe	svchost.exe
PID 4572 wrote to memory of 4016	4572	svchost.exe	30fc94fb1f9ab5273746539d316d3399.exe
PID 4572 wrote to memory of 4016	4572	svchost.exe	30fc94fb1f9ab5273746539d316d3399.exe
PID 4572 wrote to memory of 4016	4572	svchost.exe	30fc94fb1f9ab5273746539d316d3399.exe

C:\Users\Admin\AppData\Local\Temp\30fc94fb1f9ab5273746539d316d3399.exe
"C:\Users\Admin\AppData\Local\Temp\30fc94fb1f9ab5273746539d316d3399.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3296

C:\Windows\svchost.exe
"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\30fc94fb1f9ab5273746539d316d3399.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572

C:\Users\Admin\AppData\Local\Temp\30fc94fb1f9ab5273746539d316d3399.exe
"C:\Users\Admin\AppData\Local\Temp\30fc94fb1f9ab5273746539d316d3399.exe"
3⤵
- Executes dropped EXE
PID:4016

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\30fc94fb1f9ab5273746539d316d3399.exe
Filesize
320KB

MD5
60ada1df2c87416d0a537c525a92168b

SHA1
d6d08774706aafddcbe4d0497f6a64a33029f958

SHA256
6dc79aa4a8c2edefef23e7baca0ec75e4dc9ecc6a69223aa5413cfbda973380b

SHA512
ba59e9cbad1dcc4661004da170610298098df1d69803bcde45200cebdc004cea0fcd4ffa6c48318aeaae85602d1f1d62fd2dc1cb5c78c470d6d90eae2cd290b8

Download Submit
C:\Windows\svchost.exe
Filesize
35KB

MD5
83b4da0c5e91e676c355a34ad0fe73da

SHA1
09322303503ed0a70613110ca72e1bc790348882

SHA256
5ad575dccfe237328de529ea01d57917c5d639ed0d8454a01af98aaea9724110

SHA512
20183c78adbabf88ac8999521cc3e1884215f78c264f06cb017dd8749b995adc96559c5a9a39ecda3d2c34390cc5caf7dbf6b90b975d55e2ed129e1993eb5b08

Download Submit
C:\Windows\svchost.exe
Filesize
35KB

MD5
83b4da0c5e91e676c355a34ad0fe73da

SHA1
09322303503ed0a70613110ca72e1bc790348882

SHA256
5ad575dccfe237328de529ea01d57917c5d639ed0d8454a01af98aaea9724110

SHA512
20183c78adbabf88ac8999521cc3e1884215f78c264f06cb017dd8749b995adc96559c5a9a39ecda3d2c34390cc5caf7dbf6b90b975d55e2ed129e1993eb5b08

Download Submit
C:\Windows\svchost.exe
Filesize
35KB

MD5
83b4da0c5e91e676c355a34ad0fe73da

SHA1
09322303503ed0a70613110ca72e1bc790348882

SHA256
5ad575dccfe237328de529ea01d57917c5d639ed0d8454a01af98aaea9724110

SHA512
20183c78adbabf88ac8999521cc3e1884215f78c264f06cb017dd8749b995adc96559c5a9a39ecda3d2c34390cc5caf7dbf6b90b975d55e2ed129e1993eb5b08

Download Submit
memory/4016-135-0x0000000000000000-mapping.dmp

Download
memory/4016-138-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/4016-139-0x00000000023E0000-0x000000000349A000-memory.dmp

Filesize
16.7MB

Download
memory/4016-140-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/4572-132-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads