Analysis

  • max time kernel
    104s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/01/2024, 19:37

General

  • Target

    aa1efe82b7a8462a234757d822dd2466.exe

  • Size

    614KB

  • MD5

    aa1efe82b7a8462a234757d822dd2466

  • SHA1

    41fdc3584bfc507af135ad645b9c6fd4131b1bee

  • SHA256

    7cca4f23bd94e5cf9208a12bae1d251a38365c73a89322de96aae09be86f40bf

  • SHA512

    20e5ed625cf99b0af442d6067fb1b8c57a47d9f8d58b950b92ec1f98182e8e44ba125fc847f9c827fdde832f92a0345d077dca09dfa0c4043906507e59cb8c4c

  • SSDEEP

    6144:k9npUgSbTLYf44yKHreU8L94jDV9ULoU8LSHP0x8Taj9j2kJDg:ipU1bTLpgLG9QDV9UESitDg

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Signatures

  • Detect Neshta payload 10 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

  • Windows security bypass 2 TTPs 6 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Disables Task Manager via registry modification
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Windows security modification 2 TTPs 7 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • NSIS installer 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\aa1efe82b7a8462a234757d822dd2466.exe
    "C:\Users\Admin\AppData\Local\Temp\aa1efe82b7a8462a234757d822dd2466.exe"
    1⤵
    • Checks computer location settings
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3368
    • C:\Users\Admin\AppData\Local\Temp\3582-490\aa1efe82b7a8462a234757d822dd2466.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\aa1efe82b7a8462a234757d822dd2466.exe"
      2⤵
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      PID:1436

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe

          Filesize

          897KB

          MD5

          355cb9870b5f65da1d11eaa3e8f40788

          SHA1

          6346a6d3aa55c39175c2bdaf67c0a89e8d383ab8

          SHA256

          754d47f95ce671da871da32afa71fcf46868439e52e78e6eb29d085d5e2b141c

          SHA512

          080a738294554ec2906be6c6abc1d49750e936779e624e7550ee9a837912d89592adb089ac6e5eb938ccd71a48947cb8f79ed3227ddb4ea0d66d3f6ac9751374

        • C:\Users\Admin\AppData\Local\Temp\3582-490\aa1efe82b7a8462a234757d822dd2466.exe

          Filesize

          574KB

          MD5

          729b18ffd039c5574b2d9685401f42c8

          SHA1

          27ef6946fff89bf261b465a3364ca9b333fbadd2

          SHA256

          a2ca75d551c5143691815c7b61ee2d7baa469cc758bf25d4344dad852c7a2162

          SHA512

          3fcf6cf454caab2b943e4c419c228d9db156e3ab42a8879b1b13bf21de925180086bea5ff7cb2cf504c32f596c68d3e4af548c6acea5537f55d6ea32e8fc1de9

        • C:\Users\Admin\AppData\Local\Temp\nsl7C74.tmp\System.dll

          Filesize

          10KB

          MD5

          05e52213cfa17dee760186462a9645ed

          SHA1

          f6d5e82080bbba65db7d54e89250c95af833aae3

          SHA256

          d9d3ffa4c7d7a152f435f4777e72aa1b6a6c0555f277e59eedebc587c3b66ba5

          SHA512

          586eea0bec6345b437667ce528bc2396427dd444a396456e38046a8962e92a52e7ee62b9f6c97f41bc1fb4a1b3905a302d6f7055e26b84e60709ba3b416ad172

        • memory/1436-11-0x0000000000400000-0x0000000000454000-memory.dmp

          Filesize

          336KB

        • memory/1436-25-0x0000000002270000-0x00000000032FE000-memory.dmp

          Filesize

          16.6MB

        • memory/1436-26-0x0000000000400000-0x0000000000454000-memory.dmp

          Filesize

          336KB

        • memory/1436-27-0x0000000002270000-0x00000000032FE000-memory.dmp

          Filesize

          16.6MB

        • memory/3368-114-0x0000000000400000-0x000000000041B000-memory.dmp

          Filesize

          108KB

        • memory/3368-98-0x0000000000400000-0x000000000041B000-memory.dmp

          Filesize

          108KB

        • memory/3368-115-0x0000000000400000-0x000000000041B000-memory.dmp

          Filesize

          108KB

        • memory/3368-125-0x0000000000400000-0x000000000041B000-memory.dmp

          Filesize

          108KB

        • memory/3368-126-0x0000000000400000-0x000000000041B000-memory.dmp

          Filesize

          108KB

        • memory/3368-127-0x0000000000400000-0x000000000041B000-memory.dmp

          Filesize

          108KB

        • memory/3368-128-0x0000000000400000-0x000000000041B000-memory.dmp

          Filesize

          108KB

        • memory/3368-130-0x0000000000400000-0x000000000041B000-memory.dmp

          Filesize

          108KB

        • memory/3368-131-0x0000000000400000-0x000000000041B000-memory.dmp

          Filesize

          108KB