sality | 12d224499b80a505c2a2617a22eba7e47f1af2c12c1539013b32321a38d5a401

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 23:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

428c8bc13f0748682ce67919971ae549.exe
Size

129KB
MD5

428c8bc13f0748682ce67919971ae549
SHA1

4aaafeb2dc534c1eab525274babb9fb65738f050
SHA256

12d224499b80a505c2a2617a22eba7e47f1af2c12c1539013b32321a38d5a401
SHA512

5175160280c4019edee6ea7f7966e415c2c175601bca8da4a008802204b78f82da3190c0a1c83fd0de9c39d79a754ba974c950f56bc4ca4a964b002d564de6ca
SSDEEP

3072:1c164xHeWZ7dTXawclWzStoHLenksrObVmi:1cjTXiWTLehaVmi

Score

10^/10

sality backdoor upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Signatures

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

Loads dropped DLL 1 IoCs

pid	Process
1820	428c8bc13f0748682ce67919971ae549.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1820-8-0x0000000002440000-0x00000000034CE000-memory.dmp	upx

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1820	428c8bc13f0748682ce67919971ae549.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 3332	1820	428c8bc13f0748682ce67919971ae549.exe	22

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3332
- C:\Users\Admin\AppData\Local\Temp\428c8bc13f0748682ce67919971ae549.exe
  "C:\Users\Admin\AppData\Local\Temp\428c8bc13f0748682ce67919971ae549.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1820

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\240615578.dll

Filesize
9KB

MD5
0adb6f82125d3cb830a532da154677f0

SHA1
b1abad527ee1ed71bd4f00e1bb01214185398efb

SHA256
3449618ca5da3813402d38b8890462af1c90d8a991583e4c0492c3a81b60f425

SHA512
199060e350c1101f138d6b2151fc465e930eed495af77aaeaab837b10ca6d1fc113e32be51b5abe9b9d6c00dc73edf2d80ce720e99aabb8cd60ceae458c640fc

Download Submit
memory/1820-0-0x0000000001000000-0x0000000001023000-memory.dmp

Filesize
140KB

Download
memory/1820-7-0x0000000010000000-0x0000000010004000-memory.dmp

Filesize
16KB

Download
memory/1820-6-0x0000000001000000-0x0000000001023000-memory.dmp

Filesize
140KB

Download
memory/1820-8-0x0000000002440000-0x00000000034CE000-memory.dmp

Filesize
16.6MB

Download