sality | 47b3817091fe9396c6bc021d6b277cbcc68d671f1c090e169ce4690c4ff485c3

General

Target

15dc24479d7702bcfad920152777d902.exe
Size

356KB
MD5

15dc24479d7702bcfad920152777d902
SHA1

651533cbf31eb1b36f9594e4ad75d4c3c7b0ecd3
SHA256

47b3817091fe9396c6bc021d6b277cbcc68d671f1c090e169ce4690c4ff485c3
SHA512

a2543b0ce3579b0f9abbbc23aa8e257028b0f903a5af824ea51df7a02de0f709620aedec6d2ecb57e1824b3508ae0e2530ef96c3bdc6fab4175399181e03a8b2
SSDEEP

6144:EyH7xOc6H5c6HcT66vlml/SI01Jq3ggxDDwCkTTgPnpTjf5ku3mlZiBurgIu7wrF:EagCkDJpTjRkugiErwI5

Score

10^/10

sality backdoor upx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality
Executes dropped EXE 3 IoCs

Processes:

svchost.exe15dc24479d7702bcfad920152777d902.exesvchost.exe

pid process

4152 svchost.exe
4192 15dc24479d7702bcfad920152777d902.exe
1372 svchost.exe

pid	process
4152	svchost.exe
4192	15dc24479d7702bcfad920152777d902.exe
1372	svchost.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4192-139-0x0000000002380000-0x000000000343A000-memory.dmp	upx

Drops file in Program Files directory 38 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Program Files\7-Zip\7z.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome_pwa_launcher.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javap.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\extcheck.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\java.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\idlj.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\notification_helper.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\setup.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jar.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javadoc.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jabswitch.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\java-rmi.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javafxpackager.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jcmd.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javac.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javah.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe	svchost.exe

Drops file in Windows directory 1 IoCs

Processes:

15dc24479d7702bcfad920152777d902.exe

description ioc process

File created C:\Windows\svchost.exe 15dc24479d7702bcfad920152777d902.exe

description	ioc	process
File created	C:\Windows\svchost.exe	15dc24479d7702bcfad920152777d902.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

15dc24479d7702bcfad920152777d902.exesvchost.exe

description	pid	process	target process
PID 1060 wrote to memory of 4152	1060	15dc24479d7702bcfad920152777d902.exe	svchost.exe
PID 1060 wrote to memory of 4152	1060	15dc24479d7702bcfad920152777d902.exe	svchost.exe
PID 1060 wrote to memory of 4152	1060	15dc24479d7702bcfad920152777d902.exe	svchost.exe
PID 4152 wrote to memory of 4192	4152	svchost.exe	15dc24479d7702bcfad920152777d902.exe
PID 4152 wrote to memory of 4192	4152	svchost.exe	15dc24479d7702bcfad920152777d902.exe
PID 4152 wrote to memory of 4192	4152	svchost.exe	15dc24479d7702bcfad920152777d902.exe

C:\Users\Admin\AppData\Local\Temp\15dc24479d7702bcfad920152777d902.exe
"C:\Users\Admin\AppData\Local\Temp\15dc24479d7702bcfad920152777d902.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1060

C:\Windows\svchost.exe
"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\15dc24479d7702bcfad920152777d902.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152

C:\Users\Admin\AppData\Local\Temp\15dc24479d7702bcfad920152777d902.exe
"C:\Users\Admin\AppData\Local\Temp\15dc24479d7702bcfad920152777d902.exe"
3⤵
- Executes dropped EXE
PID:4192

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1372

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\15dc24479d7702bcfad920152777d902.exe
Filesize
320KB

MD5
90fcb8d817c93eb0e8cf9f04832fec71

SHA1
10856992d853f5769fadadec4006e0cb0378c67b

SHA256
732d9c295e5c1053c390899726253d1aabac30b16b8c4a90d7ef0ba77cb60aed

SHA512
2ae5f0fc1eee52303f951f306f203eaabec84d0f6bf32f08a4a5703ab0f1ca98a487e1275dc44723fe2362ae2c2e681e892e97b28b19b9c46de24a3f4c787766

Download Submit
C:\Windows\svchost.exe
Filesize
35KB

MD5
83b4da0c5e91e676c355a34ad0fe73da

SHA1
09322303503ed0a70613110ca72e1bc790348882

SHA256
5ad575dccfe237328de529ea01d57917c5d639ed0d8454a01af98aaea9724110

SHA512
20183c78adbabf88ac8999521cc3e1884215f78c264f06cb017dd8749b995adc96559c5a9a39ecda3d2c34390cc5caf7dbf6b90b975d55e2ed129e1993eb5b08

Download Submit
C:\Windows\svchost.exe
Filesize
35KB

MD5
83b4da0c5e91e676c355a34ad0fe73da

SHA1
09322303503ed0a70613110ca72e1bc790348882

SHA256
5ad575dccfe237328de529ea01d57917c5d639ed0d8454a01af98aaea9724110

SHA512
20183c78adbabf88ac8999521cc3e1884215f78c264f06cb017dd8749b995adc96559c5a9a39ecda3d2c34390cc5caf7dbf6b90b975d55e2ed129e1993eb5b08

Download Submit
C:\Windows\svchost.exe
Filesize
35KB

MD5
83b4da0c5e91e676c355a34ad0fe73da

SHA1
09322303503ed0a70613110ca72e1bc790348882

SHA256
5ad575dccfe237328de529ea01d57917c5d639ed0d8454a01af98aaea9724110

SHA512
20183c78adbabf88ac8999521cc3e1884215f78c264f06cb017dd8749b995adc96559c5a9a39ecda3d2c34390cc5caf7dbf6b90b975d55e2ed129e1993eb5b08

Download Submit
memory/4152-132-0x0000000000000000-mapping.dmp

Download
memory/4192-135-0x0000000000000000-mapping.dmp

Download
memory/4192-138-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/4192-139-0x0000000002380000-0x000000000343A000-memory.dmp

Filesize
16.7MB

Download
memory/4192-140-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads