sality | 36abbdbedf80a4c1e55cb15d4fae6e1fd21ca45af2a3ecbec3ed4c25b2b95924

Analysis

max time kernel
92s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 18:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

36abbdbedf80a4c1e55cb15d4fae6e1fd21ca45af2a3ecbec3ed4c25b2b95924.exe
Size

165KB
MD5

05ab2c4a4e60791caa8606e6afef5230
SHA1

55bb3b1021c4ebf55626247e93d93d5d6665a8c1
SHA256

36abbdbedf80a4c1e55cb15d4fae6e1fd21ca45af2a3ecbec3ed4c25b2b95924
SHA512

0ec0e9c0886f772fc0a5bb52ff30d8493e99995342c874a765304ad77769085ef86b2801d179a633243f156cbcbcfd43497158ec30e5b439bacc951653246c87
SSDEEP

3072:hQgFZGhxKAGZXLTBff/xI+Slg/Di+EkkCP9cA99GlmDiyZqlawK8B:aqZmUAGdLTBXpSq7zkCP6A+loO/K8B

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Signatures

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	36abbdbedf80a4c1e55cb15d4fae6e1fd21ca45af2a3ecbec3ed4c25b2b95924.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	36abbdbedf80a4c1e55cb15d4fae6e1fd21ca45af2a3ecbec3ed4c25b2b95924.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	36abbdbedf80a4c1e55cb15d4fae6e1fd21ca45af2a3ecbec3ed4c25b2b95924.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	36abbdbedf80a4c1e55cb15d4fae6e1fd21ca45af2a3ecbec3ed4c25b2b95924.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	36abbdbedf80a4c1e55cb15d4fae6e1fd21ca45af2a3ecbec3ed4c25b2b95924.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	36abbdbedf80a4c1e55cb15d4fae6e1fd21ca45af2a3ecbec3ed4c25b2b95924.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3144-133-0x0000000002390000-0x000000000341E000-memory.dmp	upx
behavioral2/memory/3144-135-0x0000000002390000-0x000000000341E000-memory.dmp	upx

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	36abbdbedf80a4c1e55cb15d4fae6e1fd21ca45af2a3ecbec3ed4c25b2b95924.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	36abbdbedf80a4c1e55cb15d4fae6e1fd21ca45af2a3ecbec3ed4c25b2b95924.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	36abbdbedf80a4c1e55cb15d4fae6e1fd21ca45af2a3ecbec3ed4c25b2b95924.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	36abbdbedf80a4c1e55cb15d4fae6e1fd21ca45af2a3ecbec3ed4c25b2b95924.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	36abbdbedf80a4c1e55cb15d4fae6e1fd21ca45af2a3ecbec3ed4c25b2b95924.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	36abbdbedf80a4c1e55cb15d4fae6e1fd21ca45af2a3ecbec3ed4c25b2b95924.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	36abbdbedf80a4c1e55cb15d4fae6e1fd21ca45af2a3ecbec3ed4c25b2b95924.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3144	36abbdbedf80a4c1e55cb15d4fae6e1fd21ca45af2a3ecbec3ed4c25b2b95924.exe

C:\Users\Admin\AppData\Local\Temp\36abbdbedf80a4c1e55cb15d4fae6e1fd21ca45af2a3ecbec3ed4c25b2b95924.exe
"C:\Users\Admin\AppData\Local\Temp\36abbdbedf80a4c1e55cb15d4fae6e1fd21ca45af2a3ecbec3ed4c25b2b95924.exe"
1⤵
- Windows security bypass
- Windows security modification
- Suspicious use of SetWindowsHookEx
PID:3144

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3144-132-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3144-133-0x0000000002390000-0x000000000341E000-memory.dmp

Filesize
16.6MB

Download
memory/3144-134-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3144-135-0x0000000002390000-0x000000000341E000-memory.dmp

Filesize
16.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads