sality | 8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22

General

Target

8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe
Size

1.2MB
MD5

8856d1013030cec1e4d098426e7518b2
SHA1

d7b406531ec2062ca0a420af3c5211acb16a8c17
SHA256

8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22
SHA512

6f68777bdce003c56c4839644471263bac35bb61136cf2640b4741d2e99a241834cadce2d09fcb18c1a11917cc2fcdcff22b9a5dd40472a0f291dfbf470a0f50
SSDEEP

24576:7hKR8dU5kwakDzMQ4lav3scRQbKouG7uQZcnZ4u0ZRjSPukz:nHTtQ4M/sqquzCRjS2y

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Signatures

Modifies firewall policy service 2 TTPs 3 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1964-57-0x0000000002670000-0x00000000036FE000-memory.dmp	upx
behavioral1/memory/1964-58-0x0000000002670000-0x00000000036FE000-memory.dmp	upx
behavioral1/memory/1964-63-0x0000000002670000-0x00000000036FE000-memory.dmp	upx

Loads dropped DLL 1 IoCs

Processes:

8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe

pid process

1964 8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe

description	ioc	process
File opened (read-only)	\??\H:	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe
File opened (read-only)	\??\E:	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe
File opened (read-only)	\??\F:	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe
File opened (read-only)	\??\G:	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe

Drops file in Windows directory 6 IoCs

Processes:

8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe

description	ioc	process
File created	C:\Windows\explorer.exe.local	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe
File created	C:\Windows\ws2help.dll	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe
File opened for modification	C:\Windows\ws2help.dll	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe
File opened for modification	C:\Windows\SYSTEM.INI	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe
File created	C:\Windows\Wplugin.dll	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe
File opened for modification	C:\Windows\Wplugin.dll	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe

pid	process
1964	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe
1964	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe
1964	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

Processes:

8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exeAUDIODG.EXE

description	pid	process
Token: SeDebugPrivilege	1964	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe
Token: SeDebugPrivilege	1964	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe
Token: SeDebugPrivilege	1964	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe
Token: SeDebugPrivilege	1964	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe
Token: SeDebugPrivilege	1964	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe
Token: SeDebugPrivilege	1964	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe
Token: SeDebugPrivilege	1964	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe
Token: SeDebugPrivilege	1964	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe
Token: SeDebugPrivilege	1964	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe
Token: SeDebugPrivilege	1964	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe
Token: SeDebugPrivilege	1964	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe
Token: SeDebugPrivilege	1964	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe
Token: SeDebugPrivilege	1964	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe
Token: SeDebugPrivilege	1964	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe
Token: SeDebugPrivilege	1964	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe
Token: SeDebugPrivilege	1964	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe
Token: SeDebugPrivilege	1964	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe
Token: SeDebugPrivilege	1964	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe
Token: SeDebugPrivilege	1964	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe
Token: SeDebugPrivilege	1964	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe
Token: SeDebugPrivilege	1964	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe
Token: 33	1280	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1280	AUDIODG.EXE
Token: 33	1280	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1280	AUDIODG.EXE
Token: SeDebugPrivilege	1964	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe

pid	process
1964	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe
1964	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe
1964	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe

description	pid	process	target process
PID 1964 wrote to memory of 1108	1964	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe	taskhost.exe
PID 1964 wrote to memory of 1176	1964	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe	Dwm.exe
PID 1964 wrote to memory of 1208	1964	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe	Explorer.EXE
PID 1964 wrote to memory of 1108	1964	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe	taskhost.exe
PID 1964 wrote to memory of 1176	1964	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe	Dwm.exe
PID 1964 wrote to memory of 1208	1964	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe	Explorer.EXE

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

Processes:

8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1108

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1176

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1208

C:\Users\Admin\AppData\Local\Temp\8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe
"C:\Users\Admin\AppData\Local\Temp\8c76ecbe30370fb5243132d663ca4e57a5840cdc533cd7d7ace2c9e29044be22.exe"
2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1964

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x56c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1280

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\Wplugin.dll

Filesize
108KB

MD5
8847a8302dacc1d6fca61f125c8fe8e0

SHA1
f399142bbf03660bee1df555ebbf3acc8f658cf0

SHA256
9c2726defa122089f8251fa104f76d66830f448774ab9bd634adbb6e492e3943

SHA512
2b028bb4139c352b80db1509d1a3f479a8ef7e9b3b73ddbf62e2d83d4e59adf4a0bd6b9d68409bc0b6fafb7a5f56844fbfed6d00b824a6b370689801ce1c837f

Download Submit
memory/1964-54-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download
memory/1964-55-0x0000000000400000-0x000000000057F000-memory.dmp

Filesize
1.5MB

Download
memory/1964-57-0x0000000002670000-0x00000000036FE000-memory.dmp

Filesize
16.6MB

Download
memory/1964-58-0x0000000002670000-0x00000000036FE000-memory.dmp

Filesize
16.6MB

Download
memory/1964-59-0x00000000003F0000-0x00000000003F2000-memory.dmp

Filesize
8KB

Download
memory/1964-60-0x0000000002070000-0x000000000207A000-memory.dmp

Filesize
40KB

Download
memory/1964-61-0x00000000082F0000-0x00000000082F2000-memory.dmp

Filesize
8KB

Download
memory/1964-62-0x0000000000400000-0x000000000057F000-memory.dmp

Filesize
1.5MB

Download
memory/1964-63-0x0000000002670000-0x00000000036FE000-memory.dmp

Filesize
16.6MB

Download
memory/1964-64-0x0000000002070000-0x0000000002076000-memory.dmp

Filesize
24KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads