sality | 01907045935d069b48d2707a6cf467f0d9d3c1b6bf2e4f7a83f1e83dad3c5490

General

Target

19518d76155fb5fe8ea0606827cf741c.exe
Size

364KB
MD5

19518d76155fb5fe8ea0606827cf741c
SHA1

7e01f8fa4ed081ee15af86015ea18c969be989d0
SHA256

01907045935d069b48d2707a6cf467f0d9d3c1b6bf2e4f7a83f1e83dad3c5490
SHA512

8c36d41435100f1c7153555ab2a30da3aa6a8174d385e7e8d6cb1b72b23343e00db8f12e54ef9891fe01eaafc5a70598f667afb561e0e4a172e717608ecb4764
SSDEEP

6144:EyH7xOc6H5c6HcT66vlml/SI01Jq3ggxDDwCkTTgP8sw8f5kKk9hBurgIh7wrYs5:EagCkDGB8RkK6hErfI5

Score

10^/10

sality backdoor upx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality
Executes dropped EXE 3 IoCs

Processes:

svchost.exe19518d76155fb5fe8ea0606827cf741c.exesvchost.exe

pid process

5092 svchost.exe
32 19518d76155fb5fe8ea0606827cf741c.exe
208 svchost.exe

pid	process
5092	svchost.exe
32	19518d76155fb5fe8ea0606827cf741c.exe
208	svchost.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/32-139-0x00000000021E0000-0x000000000329A000-memory.dmp	upx

Drops file in Program Files directory 51 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jdeps.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jps.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jcmd.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jstat.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javah.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jhat.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jinfo.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jstack.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome_pwa_launcher.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\notification_helper.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\extcheck.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\java.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jconsole.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jmc.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\setup.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jar.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jjs.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jsadebugd.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javac.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javafxpackager.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jdb.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jmap.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jrunscript.exe	svchost.exe

Drops file in Windows directory 1 IoCs

Processes:

19518d76155fb5fe8ea0606827cf741c.exe

description ioc process

File created C:\Windows\svchost.exe 19518d76155fb5fe8ea0606827cf741c.exe

description	ioc	process
File created	C:\Windows\svchost.exe	19518d76155fb5fe8ea0606827cf741c.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

19518d76155fb5fe8ea0606827cf741c.exesvchost.exe

description	pid	process	target process
PID 4796 wrote to memory of 5092	4796	19518d76155fb5fe8ea0606827cf741c.exe	svchost.exe
PID 4796 wrote to memory of 5092	4796	19518d76155fb5fe8ea0606827cf741c.exe	svchost.exe
PID 4796 wrote to memory of 5092	4796	19518d76155fb5fe8ea0606827cf741c.exe	svchost.exe
PID 5092 wrote to memory of 32	5092	svchost.exe	19518d76155fb5fe8ea0606827cf741c.exe
PID 5092 wrote to memory of 32	5092	svchost.exe	19518d76155fb5fe8ea0606827cf741c.exe
PID 5092 wrote to memory of 32	5092	svchost.exe	19518d76155fb5fe8ea0606827cf741c.exe

C:\Users\Admin\AppData\Local\Temp\19518d76155fb5fe8ea0606827cf741c.exe
"C:\Users\Admin\AppData\Local\Temp\19518d76155fb5fe8ea0606827cf741c.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4796

C:\Windows\svchost.exe
"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\19518d76155fb5fe8ea0606827cf741c.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092

C:\Users\Admin\AppData\Local\Temp\19518d76155fb5fe8ea0606827cf741c.exe
"C:\Users\Admin\AppData\Local\Temp\19518d76155fb5fe8ea0606827cf741c.exe"
3⤵
- Executes dropped EXE
PID:32

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:208

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\19518d76155fb5fe8ea0606827cf741c.exe
Filesize
328KB

MD5
3e2d8e688a53071307816568674c9f52

SHA1
2fa6d076950a843c71a0391f19585992f603381b

SHA256
8272e0459816bff609161ead97b9177941eda19909fd75b4521e5a3495f8a5df

SHA512
d1651706f71bd1418cd44f9fe4577887fa12ae4ea75d74566e7d048c700a89ad40714f52a4fbd757e3b470b4668db01bcf6b2e9e5f197ae1a5b6811bceaa57f0

Download Submit
C:\Windows\svchost.exe
Filesize
35KB

MD5
83b4da0c5e91e676c355a34ad0fe73da

SHA1
09322303503ed0a70613110ca72e1bc790348882

SHA256
5ad575dccfe237328de529ea01d57917c5d639ed0d8454a01af98aaea9724110

SHA512
20183c78adbabf88ac8999521cc3e1884215f78c264f06cb017dd8749b995adc96559c5a9a39ecda3d2c34390cc5caf7dbf6b90b975d55e2ed129e1993eb5b08

Download Submit
C:\Windows\svchost.exe
Filesize
35KB

MD5
83b4da0c5e91e676c355a34ad0fe73da

SHA1
09322303503ed0a70613110ca72e1bc790348882

SHA256
5ad575dccfe237328de529ea01d57917c5d639ed0d8454a01af98aaea9724110

SHA512
20183c78adbabf88ac8999521cc3e1884215f78c264f06cb017dd8749b995adc96559c5a9a39ecda3d2c34390cc5caf7dbf6b90b975d55e2ed129e1993eb5b08

Download Submit
C:\Windows\svchost.exe
Filesize
35KB

MD5
83b4da0c5e91e676c355a34ad0fe73da

SHA1
09322303503ed0a70613110ca72e1bc790348882

SHA256
5ad575dccfe237328de529ea01d57917c5d639ed0d8454a01af98aaea9724110

SHA512
20183c78adbabf88ac8999521cc3e1884215f78c264f06cb017dd8749b995adc96559c5a9a39ecda3d2c34390cc5caf7dbf6b90b975d55e2ed129e1993eb5b08

Download Submit
memory/32-135-0x0000000000000000-mapping.dmp

Download
memory/32-137-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/32-139-0x00000000021E0000-0x000000000329A000-memory.dmp

Filesize
16.7MB

Download
memory/32-140-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/5092-132-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads