Analysis
-
max time kernel
122s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
04-11-2023 12:06
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.f1d3022082240f48b73e3e3d3b134720.dll
Resource
win7-20231023-en
General
-
Target
NEAS.f1d3022082240f48b73e3e3d3b134720.dll
-
Size
120KB
-
MD5
f1d3022082240f48b73e3e3d3b134720
-
SHA1
dd144baccd8c78242d0ac594c99c3f64a25fcff0
-
SHA256
b3aaa4d82297fbd56e015c01bff60a9f8706fda2fe08bceeb462f13588ade4ef
-
SHA512
7e86f459386d087cfd72c1d86777f4bf533176c9e8248e8c1b0847b4bb3424f293e00c67fe2050be640cbd555eeafcb103227c458fcbf5b13fa9e8a3495ff043
-
SSDEEP
1536:IaWnc/C+Z66j4k/Dj54fLihewNPMH7yVYS5Md9HTZhYtke6IrZTPHtpP77eFzGM2:I+8k5gihe5GyS5INix6IJ11AaMby
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f768aa3.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f768aa3.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f768aa3.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f768aa3.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f768aa3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f768aa3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f768aa3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f768aa3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f768aa3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f768aa3.exe -
Executes dropped EXE 3 IoCs
pid Process 3016 f768aa3.exe 2444 f769270.exe 2864 f76a499.exe -
Loads dropped DLL 6 IoCs
pid Process 3012 rundll32.exe 3012 rundll32.exe 3012 rundll32.exe 3012 rundll32.exe 3012 rundll32.exe 3012 rundll32.exe -
resource yara_rule behavioral1/memory/3016-11-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/3016-13-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/3016-14-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/3016-18-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/3016-23-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/3016-30-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/3016-47-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/3016-56-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/3016-57-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/3016-58-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/3016-59-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/3016-60-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/3016-61-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/3016-62-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/3016-76-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/3016-79-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/3016-80-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/3016-81-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/3016-84-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/3016-104-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/3016-107-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/3016-143-0x0000000000710000-0x00000000017CA000-memory.dmp upx behavioral1/memory/2864-149-0x0000000000980000-0x0000000001A3A000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f768aa3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f768aa3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f768aa3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f768aa3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f768aa3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f768aa3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f768aa3.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f768aa3.exe -
Enumerates connected drives 3 TTPs 9 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: f768aa3.exe File opened (read-only) \??\I: f768aa3.exe File opened (read-only) \??\K: f768aa3.exe File opened (read-only) \??\L: f768aa3.exe File opened (read-only) \??\M: f768aa3.exe File opened (read-only) \??\E: f768aa3.exe File opened (read-only) \??\H: f768aa3.exe File opened (read-only) \??\J: f768aa3.exe File opened (read-only) \??\N: f768aa3.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\f768c19 f768aa3.exe File opened for modification C:\Windows\SYSTEM.INI f768aa3.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3016 f768aa3.exe 3016 f768aa3.exe -
Suspicious use of AdjustPrivilegeToken 21 IoCs
description pid Process Token: SeDebugPrivilege 3016 f768aa3.exe Token: SeDebugPrivilege 3016 f768aa3.exe Token: SeDebugPrivilege 3016 f768aa3.exe Token: SeDebugPrivilege 3016 f768aa3.exe Token: SeDebugPrivilege 3016 f768aa3.exe Token: SeDebugPrivilege 3016 f768aa3.exe Token: SeDebugPrivilege 3016 f768aa3.exe Token: SeDebugPrivilege 3016 f768aa3.exe Token: SeDebugPrivilege 3016 f768aa3.exe Token: SeDebugPrivilege 3016 f768aa3.exe Token: SeDebugPrivilege 3016 f768aa3.exe Token: SeDebugPrivilege 3016 f768aa3.exe Token: SeDebugPrivilege 3016 f768aa3.exe Token: SeDebugPrivilege 3016 f768aa3.exe Token: SeDebugPrivilege 3016 f768aa3.exe Token: SeDebugPrivilege 3016 f768aa3.exe Token: SeDebugPrivilege 3016 f768aa3.exe Token: SeDebugPrivilege 3016 f768aa3.exe Token: SeDebugPrivilege 3016 f768aa3.exe Token: SeDebugPrivilege 3016 f768aa3.exe Token: SeDebugPrivilege 3016 f768aa3.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 2924 wrote to memory of 3012 2924 rundll32.exe 28 PID 2924 wrote to memory of 3012 2924 rundll32.exe 28 PID 2924 wrote to memory of 3012 2924 rundll32.exe 28 PID 2924 wrote to memory of 3012 2924 rundll32.exe 28 PID 2924 wrote to memory of 3012 2924 rundll32.exe 28 PID 2924 wrote to memory of 3012 2924 rundll32.exe 28 PID 2924 wrote to memory of 3012 2924 rundll32.exe 28 PID 3012 wrote to memory of 3016 3012 rundll32.exe 29 PID 3012 wrote to memory of 3016 3012 rundll32.exe 29 PID 3012 wrote to memory of 3016 3012 rundll32.exe 29 PID 3012 wrote to memory of 3016 3012 rundll32.exe 29 PID 3016 wrote to memory of 1100 3016 f768aa3.exe 10 PID 3016 wrote to memory of 1168 3016 f768aa3.exe 17 PID 3016 wrote to memory of 1192 3016 f768aa3.exe 11 PID 3016 wrote to memory of 1724 3016 f768aa3.exe 16 PID 3016 wrote to memory of 2924 3016 f768aa3.exe 27 PID 3016 wrote to memory of 3012 3016 f768aa3.exe 28 PID 3016 wrote to memory of 3012 3016 f768aa3.exe 28 PID 3012 wrote to memory of 2444 3012 rundll32.exe 30 PID 3012 wrote to memory of 2444 3012 rundll32.exe 30 PID 3012 wrote to memory of 2444 3012 rundll32.exe 30 PID 3012 wrote to memory of 2444 3012 rundll32.exe 30 PID 3012 wrote to memory of 2864 3012 rundll32.exe 31 PID 3012 wrote to memory of 2864 3012 rundll32.exe 31 PID 3012 wrote to memory of 2864 3012 rundll32.exe 31 PID 3012 wrote to memory of 2864 3012 rundll32.exe 31 PID 3016 wrote to memory of 1100 3016 f768aa3.exe 10 PID 3016 wrote to memory of 1168 3016 f768aa3.exe 17 PID 3016 wrote to memory of 1192 3016 f768aa3.exe 11 PID 3016 wrote to memory of 2444 3016 f768aa3.exe 30 PID 3016 wrote to memory of 2444 3016 f768aa3.exe 30 PID 3016 wrote to memory of 2864 3016 f768aa3.exe 31 PID 3016 wrote to memory of 2864 3016 f768aa3.exe 31 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f768aa3.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1100
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1192
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.f1d3022082240f48b73e3e3d3b134720.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\NEAS.f1d3022082240f48b73e3e3d3b134720.dll,#13⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\f768aa3.exeC:\Users\Admin\AppData\Local\Temp\f768aa3.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3016
-
-
C:\Users\Admin\AppData\Local\Temp\f769270.exeC:\Users\Admin\AppData\Local\Temp\f769270.exe4⤵
- Executes dropped EXE
PID:2444
-
-
C:\Users\Admin\AppData\Local\Temp\f76a499.exeC:\Users\Admin\AppData\Local\Temp\f76a499.exe4⤵
- Executes dropped EXE
PID:2864
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1724
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1168
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD567cfdb2cac3c2662691d3c9bf002f127
SHA1018d4cf4b6c4667019e3e2a6d9516291fc502f7f
SHA25620f7c2733f484ac181c3603d3bbeb2dd0ab80ae45ac02f2968abfbc2065d7fce
SHA512302ae3a708744fabcb07cf66aff1955db2e26e1a9a2b6f439e2ef4e5cd9c0545b7ffc442a90afcab7271af7301a91fd3366e46fcbdceec23c7665b6cad0c25f2
-
Filesize
97KB
MD567cfdb2cac3c2662691d3c9bf002f127
SHA1018d4cf4b6c4667019e3e2a6d9516291fc502f7f
SHA25620f7c2733f484ac181c3603d3bbeb2dd0ab80ae45ac02f2968abfbc2065d7fce
SHA512302ae3a708744fabcb07cf66aff1955db2e26e1a9a2b6f439e2ef4e5cd9c0545b7ffc442a90afcab7271af7301a91fd3366e46fcbdceec23c7665b6cad0c25f2
-
Filesize
97KB
MD567cfdb2cac3c2662691d3c9bf002f127
SHA1018d4cf4b6c4667019e3e2a6d9516291fc502f7f
SHA25620f7c2733f484ac181c3603d3bbeb2dd0ab80ae45ac02f2968abfbc2065d7fce
SHA512302ae3a708744fabcb07cf66aff1955db2e26e1a9a2b6f439e2ef4e5cd9c0545b7ffc442a90afcab7271af7301a91fd3366e46fcbdceec23c7665b6cad0c25f2
-
Filesize
97KB
MD567cfdb2cac3c2662691d3c9bf002f127
SHA1018d4cf4b6c4667019e3e2a6d9516291fc502f7f
SHA25620f7c2733f484ac181c3603d3bbeb2dd0ab80ae45ac02f2968abfbc2065d7fce
SHA512302ae3a708744fabcb07cf66aff1955db2e26e1a9a2b6f439e2ef4e5cd9c0545b7ffc442a90afcab7271af7301a91fd3366e46fcbdceec23c7665b6cad0c25f2
-
Filesize
97KB
MD567cfdb2cac3c2662691d3c9bf002f127
SHA1018d4cf4b6c4667019e3e2a6d9516291fc502f7f
SHA25620f7c2733f484ac181c3603d3bbeb2dd0ab80ae45ac02f2968abfbc2065d7fce
SHA512302ae3a708744fabcb07cf66aff1955db2e26e1a9a2b6f439e2ef4e5cd9c0545b7ffc442a90afcab7271af7301a91fd3366e46fcbdceec23c7665b6cad0c25f2
-
Filesize
97KB
MD567cfdb2cac3c2662691d3c9bf002f127
SHA1018d4cf4b6c4667019e3e2a6d9516291fc502f7f
SHA25620f7c2733f484ac181c3603d3bbeb2dd0ab80ae45ac02f2968abfbc2065d7fce
SHA512302ae3a708744fabcb07cf66aff1955db2e26e1a9a2b6f439e2ef4e5cd9c0545b7ffc442a90afcab7271af7301a91fd3366e46fcbdceec23c7665b6cad0c25f2
-
Filesize
97KB
MD567cfdb2cac3c2662691d3c9bf002f127
SHA1018d4cf4b6c4667019e3e2a6d9516291fc502f7f
SHA25620f7c2733f484ac181c3603d3bbeb2dd0ab80ae45ac02f2968abfbc2065d7fce
SHA512302ae3a708744fabcb07cf66aff1955db2e26e1a9a2b6f439e2ef4e5cd9c0545b7ffc442a90afcab7271af7301a91fd3366e46fcbdceec23c7665b6cad0c25f2
-
Filesize
97KB
MD567cfdb2cac3c2662691d3c9bf002f127
SHA1018d4cf4b6c4667019e3e2a6d9516291fc502f7f
SHA25620f7c2733f484ac181c3603d3bbeb2dd0ab80ae45ac02f2968abfbc2065d7fce
SHA512302ae3a708744fabcb07cf66aff1955db2e26e1a9a2b6f439e2ef4e5cd9c0545b7ffc442a90afcab7271af7301a91fd3366e46fcbdceec23c7665b6cad0c25f2
-
Filesize
97KB
MD567cfdb2cac3c2662691d3c9bf002f127
SHA1018d4cf4b6c4667019e3e2a6d9516291fc502f7f
SHA25620f7c2733f484ac181c3603d3bbeb2dd0ab80ae45ac02f2968abfbc2065d7fce
SHA512302ae3a708744fabcb07cf66aff1955db2e26e1a9a2b6f439e2ef4e5cd9c0545b7ffc442a90afcab7271af7301a91fd3366e46fcbdceec23c7665b6cad0c25f2
-
Filesize
97KB
MD567cfdb2cac3c2662691d3c9bf002f127
SHA1018d4cf4b6c4667019e3e2a6d9516291fc502f7f
SHA25620f7c2733f484ac181c3603d3bbeb2dd0ab80ae45ac02f2968abfbc2065d7fce
SHA512302ae3a708744fabcb07cf66aff1955db2e26e1a9a2b6f439e2ef4e5cd9c0545b7ffc442a90afcab7271af7301a91fd3366e46fcbdceec23c7665b6cad0c25f2