sality | a2d4c9c768c7f0005f5934d1352d564c176ee682c7153b09be596cb246d48465

Analysis

max time kernel
74s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 11:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a2d4c9c768c7f0005f5934d1352d564c176ee682c7153b09be596cb246d48465.exe
Size

675KB
MD5

4149d332eb793e22318acda3cf7f7f90
SHA1

7be1917b0b59cce3f0524d271c1ea1e3943f09cc
SHA256

a2d4c9c768c7f0005f5934d1352d564c176ee682c7153b09be596cb246d48465
SHA512

6c8eb1df97b17e1bfb2e81dfd996e5f1aca6ab86701f9b2afccb11a33601e8e95ff1faacf469f007b3f573f4c8021e35df06fd3f966bb554b9c4e4a83e4b7ed5
SSDEEP

12288:gXWM2fQNWzrcVe/O+/k71oqE2B/Bq2lIfLnrxVVj7J7aMd08wMTRPQmSabPzp+vd:ep2fXzrF2+/k71oqE2B/Bq2InrxVVj7g

Score

10^/10

sality backdoor upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4468-132-0x0000000002320000-0x00000000033DA000-memory.dmp	upx

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2588	PING.EXE

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4468 wrote to memory of 1676	4468	a2d4c9c768c7f0005f5934d1352d564c176ee682c7153b09be596cb246d48465.exe	84
PID 4468 wrote to memory of 1676	4468	a2d4c9c768c7f0005f5934d1352d564c176ee682c7153b09be596cb246d48465.exe	84
PID 4468 wrote to memory of 1676	4468	a2d4c9c768c7f0005f5934d1352d564c176ee682c7153b09be596cb246d48465.exe	84
PID 1676 wrote to memory of 2588	1676	cmd.exe	86
PID 1676 wrote to memory of 2588	1676	cmd.exe	86
PID 1676 wrote to memory of 2588	1676	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\a2d4c9c768c7f0005f5934d1352d564c176ee682c7153b09be596cb246d48465.exe
"C:\Users\Admin\AppData\Local\Temp\a2d4c9c768c7f0005f5934d1352d564c176ee682c7153b09be596cb246d48465.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4468
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ping 127.0.0.1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\a2d4c9c768c7f0005f5934d1352d564c176ee682c7153b09be596cb246d48465.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1676
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2588

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4468-132-0x0000000002320000-0x00000000033DA000-memory.dmp

Filesize
16.7MB

Download
memory/4468-134-0x0000000000400000-0x00000000004AF000-memory.dmp

Filesize
700KB

Download