Analysis
-
max time kernel
42s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
30/10/2022, 23:19
Static task
static1
Behavioral task
behavioral1
Sample
173774379c0d5346e0190fcdf79d9b7e3d0d48c5b7144c5a7c9d705fa2b33de8.dll
Resource
win7-20220901-en
windows7-x64
19 signatures
150 seconds
General
-
Target
173774379c0d5346e0190fcdf79d9b7e3d0d48c5b7144c5a7c9d705fa2b33de8.dll
-
Size
260KB
-
MD5
a18b2ef764c34e590a0ff3a217794419
-
SHA1
4789f6baa4ea41b281caf90c35f6c73ae97d6fc4
-
SHA256
173774379c0d5346e0190fcdf79d9b7e3d0d48c5b7144c5a7c9d705fa2b33de8
-
SHA512
dff144a60f244990f2345ff38c55c019ee6c15b904b7c36a228ea43695a53c7d032555cff3fbca0df29bc156fbf8350a9900d1040b29b2bcb60d36fc5b8a316b
-
SSDEEP
6144:CFfLbt7jhOqOhvV64JQhhapDVcxJY8qeh:KfLbtRO9thDVcwrM
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
http://klkjwre77638dfqwieuoi888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" rundll32mgr.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" rundll32mgr.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" rundll32mgr.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" rundll32mgr.exe -
Disables Task Manager via registry modification
-
Executes dropped EXE 1 IoCs
pid Process 1316 rundll32mgr.exe -
resource yara_rule behavioral1/files/0x000500000000b2d2-56.dat upx behavioral1/files/0x000500000000b2d2-57.dat upx behavioral1/files/0x000500000000b2d2-59.dat upx behavioral1/memory/1316-61-0x00000000006E0000-0x000000000176E000-memory.dmp upx behavioral1/memory/1316-64-0x0000000000400000-0x0000000000473000-memory.dmp upx behavioral1/memory/1316-66-0x00000000006E0000-0x000000000176E000-memory.dmp upx behavioral1/memory/1316-65-0x0000000000400000-0x0000000000473000-memory.dmp upx -
Loads dropped DLL 2 IoCs
pid Process 1284 rundll32.exe 1284 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" rundll32mgr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" rundll32mgr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc rundll32mgr.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" rundll32mgr.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\setupact.log rundll32.exe File opened for modification C:\Windows\setuperr.log rundll32.exe File opened for modification C:\Windows\SYSTEM.INI rundll32mgr.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1316 rundll32mgr.exe 1316 rundll32mgr.exe 1316 rundll32mgr.exe 1316 rundll32mgr.exe -
Suspicious behavior: MapViewOfSection 21 IoCs
pid Process 1316 rundll32mgr.exe 1316 rundll32mgr.exe 1316 rundll32mgr.exe 1316 rundll32mgr.exe 1316 rundll32mgr.exe 1316 rundll32mgr.exe 1316 rundll32mgr.exe 1316 rundll32mgr.exe 1316 rundll32mgr.exe 1316 rundll32mgr.exe 1316 rundll32mgr.exe 1316 rundll32mgr.exe 1316 rundll32mgr.exe 1316 rundll32mgr.exe 1316 rundll32mgr.exe 1316 rundll32mgr.exe 1316 rundll32mgr.exe 1316 rundll32mgr.exe 1316 rundll32mgr.exe 1316 rundll32mgr.exe 1316 rundll32mgr.exe -
Suspicious use of AdjustPrivilegeToken 22 IoCs
description pid Process Token: SeDebugPrivilege 1316 rundll32mgr.exe Token: SeDebugPrivilege 1316 rundll32mgr.exe Token: SeDebugPrivilege 1316 rundll32mgr.exe Token: SeDebugPrivilege 1316 rundll32mgr.exe Token: SeDebugPrivilege 1316 rundll32mgr.exe Token: SeDebugPrivilege 1316 rundll32mgr.exe Token: SeDebugPrivilege 1316 rundll32mgr.exe Token: SeDebugPrivilege 1316 rundll32mgr.exe Token: SeDebugPrivilege 1316 rundll32mgr.exe Token: SeDebugPrivilege 1316 rundll32mgr.exe Token: SeDebugPrivilege 1316 rundll32mgr.exe Token: SeDebugPrivilege 1316 rundll32mgr.exe Token: SeDebugPrivilege 1316 rundll32mgr.exe Token: SeDebugPrivilege 1316 rundll32mgr.exe Token: SeDebugPrivilege 1316 rundll32mgr.exe Token: SeDebugPrivilege 1316 rundll32mgr.exe Token: SeDebugPrivilege 1316 rundll32mgr.exe Token: SeDebugPrivilege 1316 rundll32mgr.exe Token: SeDebugPrivilege 1316 rundll32mgr.exe Token: SeDebugPrivilege 1316 rundll32mgr.exe Token: SeDebugPrivilege 1316 rundll32mgr.exe Token: SeDebugPrivilege 1316 rundll32mgr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1768 wrote to memory of 1284 1768 rundll32.exe 27 PID 1768 wrote to memory of 1284 1768 rundll32.exe 27 PID 1768 wrote to memory of 1284 1768 rundll32.exe 27 PID 1768 wrote to memory of 1284 1768 rundll32.exe 27 PID 1768 wrote to memory of 1284 1768 rundll32.exe 27 PID 1768 wrote to memory of 1284 1768 rundll32.exe 27 PID 1768 wrote to memory of 1284 1768 rundll32.exe 27 PID 1284 wrote to memory of 1316 1284 rundll32.exe 28 PID 1284 wrote to memory of 1316 1284 rundll32.exe 28 PID 1284 wrote to memory of 1316 1284 rundll32.exe 28 PID 1284 wrote to memory of 1316 1284 rundll32.exe 28 PID 1316 wrote to memory of 1112 1316 rundll32mgr.exe 18 PID 1316 wrote to memory of 1176 1316 rundll32mgr.exe 17 PID 1316 wrote to memory of 1204 1316 rundll32mgr.exe 16 PID 1316 wrote to memory of 1768 1316 rundll32mgr.exe 21 PID 1316 wrote to memory of 1284 1316 rundll32mgr.exe 27 PID 1316 wrote to memory of 1284 1316 rundll32mgr.exe 27 PID 1316 wrote to memory of 368 1316 rundll32mgr.exe 5 PID 1316 wrote to memory of 368 1316 rundll32mgr.exe 5 PID 1316 wrote to memory of 368 1316 rundll32mgr.exe 5 PID 1316 wrote to memory of 368 1316 rundll32mgr.exe 5 PID 1316 wrote to memory of 368 1316 rundll32mgr.exe 5 PID 1316 wrote to memory of 368 1316 rundll32mgr.exe 5 PID 1316 wrote to memory of 368 1316 rundll32mgr.exe 5 PID 1316 wrote to memory of 376 1316 rundll32mgr.exe 4 PID 1316 wrote to memory of 376 1316 rundll32mgr.exe 4 PID 1316 wrote to memory of 376 1316 rundll32mgr.exe 4 PID 1316 wrote to memory of 376 1316 rundll32mgr.exe 4 PID 1316 wrote to memory of 376 1316 rundll32mgr.exe 4 PID 1316 wrote to memory of 376 1316 rundll32mgr.exe 4 PID 1316 wrote to memory of 376 1316 rundll32mgr.exe 4 PID 1316 wrote to memory of 416 1316 rundll32mgr.exe 3 PID 1316 wrote to memory of 416 1316 rundll32mgr.exe 3 PID 1316 wrote to memory of 416 1316 rundll32mgr.exe 3 PID 1316 wrote to memory of 416 1316 rundll32mgr.exe 3 PID 1316 wrote to memory of 416 1316 rundll32mgr.exe 3 PID 1316 wrote to memory of 416 1316 rundll32mgr.exe 3 PID 1316 wrote to memory of 416 1316 rundll32mgr.exe 3 PID 1316 wrote to memory of 464 1316 rundll32mgr.exe 2 PID 1316 wrote to memory of 464 1316 rundll32mgr.exe 2 PID 1316 wrote to memory of 464 1316 rundll32mgr.exe 2 PID 1316 wrote to memory of 464 1316 rundll32mgr.exe 2 PID 1316 wrote to memory of 464 1316 rundll32mgr.exe 2 PID 1316 wrote to memory of 464 1316 rundll32mgr.exe 2 PID 1316 wrote to memory of 464 1316 rundll32mgr.exe 2 PID 1316 wrote to memory of 472 1316 rundll32mgr.exe 1 PID 1316 wrote to memory of 472 1316 rundll32mgr.exe 1 PID 1316 wrote to memory of 472 1316 rundll32mgr.exe 1 PID 1316 wrote to memory of 472 1316 rundll32mgr.exe 1 PID 1316 wrote to memory of 472 1316 rundll32mgr.exe 1 PID 1316 wrote to memory of 472 1316 rundll32mgr.exe 1 PID 1316 wrote to memory of 472 1316 rundll32mgr.exe 1 PID 1316 wrote to memory of 480 1316 rundll32mgr.exe 8 PID 1316 wrote to memory of 480 1316 rundll32mgr.exe 8 PID 1316 wrote to memory of 480 1316 rundll32mgr.exe 8 PID 1316 wrote to memory of 480 1316 rundll32mgr.exe 8 PID 1316 wrote to memory of 480 1316 rundll32mgr.exe 8 PID 1316 wrote to memory of 480 1316 rundll32mgr.exe 8 PID 1316 wrote to memory of 480 1316 rundll32mgr.exe 8 PID 1316 wrote to memory of 592 1316 rundll32mgr.exe 26 PID 1316 wrote to memory of 592 1316 rundll32mgr.exe 26 PID 1316 wrote to memory of 592 1316 rundll32mgr.exe 26 PID 1316 wrote to memory of 592 1316 rundll32mgr.exe 26 PID 1316 wrote to memory of 592 1316 rundll32mgr.exe 26 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" rundll32mgr.exe
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:472
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵PID:464
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted2⤵PID:748
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork2⤵PID:1072
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe2⤵PID:744
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation2⤵PID:1708
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"2⤵PID:1112
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe2⤵PID:684
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService2⤵PID:340
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵PID:868
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService2⤵PID:828
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted2⤵PID:796
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS2⤵PID:668
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch2⤵PID:592
-
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:416
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:376
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:368
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:480
-
-
\\?\C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R1⤵PID:1816
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1204
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\173774379c0d5346e0190fcdf79d9b7e3d0d48c5b7144c5a7c9d705fa2b33de8.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\173774379c0d5346e0190fcdf79d9b7e3d0d48c5b7144c5a7c9d705fa2b33de8.dll,#13⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1316
-
-
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1176
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
228KB
MD5e6db1399084ff1837fee00ca81e92673
SHA17ffc755a095ccfd16749fc7b546f7fde1a834d1e
SHA25654e4331df3e5fb1b721849f0b1b4a518a7fce3efcf74086bf888e5f86110857c
SHA512814da3edd2fd5fd3e0685a72451aac3c476d88c00004f1c086fd73c32ac928fbca203f4c4910e418a48853bd58145db1e472aaf21bd07ba9468ec581add2c813
-
Filesize
228KB
MD5e6db1399084ff1837fee00ca81e92673
SHA17ffc755a095ccfd16749fc7b546f7fde1a834d1e
SHA25654e4331df3e5fb1b721849f0b1b4a518a7fce3efcf74086bf888e5f86110857c
SHA512814da3edd2fd5fd3e0685a72451aac3c476d88c00004f1c086fd73c32ac928fbca203f4c4910e418a48853bd58145db1e472aaf21bd07ba9468ec581add2c813
-
Filesize
228KB
MD5e6db1399084ff1837fee00ca81e92673
SHA17ffc755a095ccfd16749fc7b546f7fde1a834d1e
SHA25654e4331df3e5fb1b721849f0b1b4a518a7fce3efcf74086bf888e5f86110857c
SHA512814da3edd2fd5fd3e0685a72451aac3c476d88c00004f1c086fd73c32ac928fbca203f4c4910e418a48853bd58145db1e472aaf21bd07ba9468ec581add2c813