sality | 9ab29f4e939396b94de9df9bf13fa8bec718457bcbc5ababdf69eac48db88a40

General

Target

46493b50f0fe2e9acaecceda4be9124f.exe
Size

314KB
MD5

46493b50f0fe2e9acaecceda4be9124f
SHA1

87d36884fba1befe5f33b45e2750f00a6e400ba4
SHA256

9ab29f4e939396b94de9df9bf13fa8bec718457bcbc5ababdf69eac48db88a40
SHA512

5742b268c1f0e23efcd959a6e7a9af86418e2ec953890bf5bc48cfb188839b903ba1658b9a8681b6a0a0cd4b710493da862d3b359e1bd1146174a643d74e446b
SSDEEP

6144:txA/BD/qHWdl5EFJSsOkuNg051iH6wNTGN9pzuvJgr:txA/Vj5EFElhV5+hBK3zuvir

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Signatures

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	46493b50f0fe2e9acaecceda4be9124f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	46493b50f0fe2e9acaecceda4be9124f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	46493b50f0fe2e9acaecceda4be9124f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	46493b50f0fe2e9acaecceda4be9124f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	46493b50f0fe2e9acaecceda4be9124f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	46493b50f0fe2e9acaecceda4be9124f.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1"	46493b50f0fe2e9acaecceda4be9124f.exe

Disables Task Manager via registry modification
evasion

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2336-5-0x0000000001D70000-0x0000000002DFE000-memory.dmp	upx
behavioral1/memory/2336-23-0x0000000001D70000-0x0000000002DFE000-memory.dmp	upx

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	46493b50f0fe2e9acaecceda4be9124f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	46493b50f0fe2e9acaecceda4be9124f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	46493b50f0fe2e9acaecceda4be9124f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	46493b50f0fe2e9acaecceda4be9124f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	46493b50f0fe2e9acaecceda4be9124f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	46493b50f0fe2e9acaecceda4be9124f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	46493b50f0fe2e9acaecceda4be9124f.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2336 set thread context of 2360	2336	46493b50f0fe2e9acaecceda4be9124f.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2360	46493b50f0fe2e9acaecceda4be9124f.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2360	2336	46493b50f0fe2e9acaecceda4be9124f.exe	28
PID 2336 wrote to memory of 2360	2336	46493b50f0fe2e9acaecceda4be9124f.exe	28
PID 2336 wrote to memory of 2360	2336	46493b50f0fe2e9acaecceda4be9124f.exe	28
PID 2336 wrote to memory of 2360	2336	46493b50f0fe2e9acaecceda4be9124f.exe	28
PID 2336 wrote to memory of 2360	2336	46493b50f0fe2e9acaecceda4be9124f.exe	28
PID 2336 wrote to memory of 2360	2336	46493b50f0fe2e9acaecceda4be9124f.exe	28
PID 2336 wrote to memory of 2360	2336	46493b50f0fe2e9acaecceda4be9124f.exe	28
PID 2336 wrote to memory of 2360	2336	46493b50f0fe2e9acaecceda4be9124f.exe	28
PID 2360 wrote to memory of 1212	2360	46493b50f0fe2e9acaecceda4be9124f.exe	17
PID 2360 wrote to memory of 1212	2360	46493b50f0fe2e9acaecceda4be9124f.exe	17
PID 2360 wrote to memory of 1212	2360	46493b50f0fe2e9acaecceda4be9124f.exe	17
PID 2360 wrote to memory of 1212	2360	46493b50f0fe2e9acaecceda4be9124f.exe	17
PID 2360 wrote to memory of 1212	2360	46493b50f0fe2e9acaecceda4be9124f.exe	17

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1212
- C:\Users\Admin\AppData\Local\Temp\46493b50f0fe2e9acaecceda4be9124f.exe
  "C:\Users\Admin\AppData\Local\Temp\46493b50f0fe2e9acaecceda4be9124f.exe"
  2⤵
  - Windows security bypass
  - Disables RegEdit via registry modification
  - Windows security modification
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2336
- - C:\Users\Admin\AppData\Local\Temp\46493b50f0fe2e9acaecceda4be9124f.exe
    "C:\Users\Admin\AppData\Local\Temp\46493b50f0fe2e9acaecceda4be9124f.exe" C:\Users\Admin\AppData\Local\Temp\46493b50f0fe2e9acaecceda4be9124f.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0F765715_Rar\46493b50f0fe2e9acaecceda4be9124f.exe

Filesize
246KB

MD5
e2f52ebe8885cedcae7e33c9920f8d3d

SHA1
f317e98b755755b1cdfc830ec98642ffbd66e59b

SHA256
ba973c60d0c9440045d8077682ddf295d8286eb98ecb5ced66ac50be111d9ddf

SHA512
d6b2a93c948005b608c92aa2a26877a1d9b3ab4b09cb936a35fd0732b57dd12c5579dc6bbc6beb08ffc437994236a9e5a3c3600ebd368efa57aef6c0ce433de6

Download Submit
memory/2336-20-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2336-5-0x0000000001D70000-0x0000000002DFE000-memory.dmp

Filesize
16.6MB

Download
memory/2336-0-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2336-10-0x0000000000350000-0x0000000000387000-memory.dmp

Filesize
220KB

Download
memory/2336-23-0x0000000001D70000-0x0000000002DFE000-memory.dmp

Filesize
16.6MB

Download
memory/2360-9-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2360-16-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2360-18-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2360-14-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2360-21-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2360-22-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2360-12-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2360-24-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads