Analysis

  • max time kernel
    123s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/02/2024, 21:36

General

  • Target

    e484a6a145d0682eb866798124ad0d37ad8f5d44cd39fcd5deef7f77998e71af.exe

  • Size

    1.6MB

  • MD5

    39c180bc4277af876a7d77d3b712c12d

  • SHA1

    5e4aacb249c49b07ac902742d62831ab8fe3a45f

  • SHA256

    e484a6a145d0682eb866798124ad0d37ad8f5d44cd39fcd5deef7f77998e71af

  • SHA512

    ab1388a8ca58bb1fd392d1fcf083100a875765c4a65975ff6347efec8e7a5d982687f43c81a01031aebca74194474dfbdc4dbd9d943c4d580f6d45d87cd9c179

  • SSDEEP

    49152:+NLSrgb+LpHtEg5x31Vu+/oTUPJcrGqKIY:+NWrjLpNEox31Vu+v6rq

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

  • Modifies firewall policy service 2 TTPs 3 IoCs
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

  • UAC bypass 3 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 6 IoCs
  • UPX packed file 43 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Windows security modification 2 TTPs 7 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in Program Files directory 11 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 42 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:2536
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
      1⤵
        PID:2556
      • C:\Windows\system32\taskhostw.exe
        taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
        1⤵
          PID:2660
        • C:\Windows\Explorer.EXE
          C:\Windows\Explorer.EXE
          1⤵
            PID:3328
            • C:\Users\Admin\AppData\Local\Temp\e484a6a145d0682eb866798124ad0d37ad8f5d44cd39fcd5deef7f77998e71af.exe
              "C:\Users\Admin\AppData\Local\Temp\e484a6a145d0682eb866798124ad0d37ad8f5d44cd39fcd5deef7f77998e71af.exe"
              2⤵
              • Modifies firewall policy service
              • UAC bypass
              • Windows security bypass
              • Windows security modification
              • Checks whether UAC is enabled
              • Enumerates connected drives
              • Writes to the Master Boot Record (MBR)
              • Drops autorun.inf file
              • Drops file in Program Files directory
              • Drops file in Windows directory
              • Modifies Internet Explorer settings
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:1844
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
            1⤵
              PID:3604
            • C:\Windows\system32\DllHost.exe
              C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
              1⤵
                PID:3844
              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                1⤵
                  PID:664
                • C:\Windows\System32\RuntimeBroker.exe
                  C:\Windows\System32\RuntimeBroker.exe -Embedding
                  1⤵
                    PID:4040
                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                    1⤵
                      PID:3936
                    • C:\Windows\System32\RuntimeBroker.exe
                      C:\Windows\System32\RuntimeBroker.exe -Embedding
                      1⤵
                        PID:4160
                      • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
                        "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
                        1⤵
                          PID:5072
                        • C:\Windows\System32\RuntimeBroker.exe
                          C:\Windows\System32\RuntimeBroker.exe -Embedding
                          1⤵
                            PID:4628

                          Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\oadmvg.exe

                                  Filesize

                                  97KB

                                  MD5

                                  684db93bd17fdc50054c722e42828668

                                  SHA1

                                  bb38bd3e6def3edda8611a1f9c823c2ec7334493

                                  SHA256

                                  52ab3ed90e1f9790564d13fd1944ee428889a653f60939517633e957be298bda

                                  SHA512

                                  ab920fafd6c95fceede36145a57f0a55f0e4a1d2ea80022632af7e02d2ee92045ca02877542b965faee8b4bcdb3c63f71ef1e2eb5fcf1dc84d68896cc6f2ddea

                                • memory/1844-0-0x0000000000400000-0x00000000005B2000-memory.dmp

                                  Filesize

                                  1.7MB

                                • memory/1844-2-0x0000000002500000-0x00000000035BA000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/1844-4-0x0000000002500000-0x00000000035BA000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/1844-6-0x0000000003750000-0x0000000003752000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/1844-5-0x0000000002500000-0x00000000035BA000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/1844-9-0x0000000003750000-0x0000000003752000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/1844-7-0x0000000003790000-0x0000000003791000-memory.dmp

                                  Filesize

                                  4KB

                                • memory/1844-10-0x0000000002500000-0x00000000035BA000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/1844-11-0x0000000002500000-0x00000000035BA000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/1844-17-0x0000000002500000-0x00000000035BA000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/1844-18-0x0000000002500000-0x00000000035BA000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/1844-19-0x0000000002500000-0x00000000035BA000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/1844-20-0x0000000002500000-0x00000000035BA000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/1844-21-0x0000000002500000-0x00000000035BA000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/1844-22-0x0000000002500000-0x00000000035BA000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/1844-23-0x0000000002500000-0x00000000035BA000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/1844-24-0x0000000002500000-0x00000000035BA000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/1844-25-0x0000000002500000-0x00000000035BA000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/1844-26-0x0000000002500000-0x00000000035BA000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/1844-28-0x0000000002500000-0x00000000035BA000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/1844-29-0x0000000002500000-0x00000000035BA000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/1844-30-0x0000000002500000-0x00000000035BA000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/1844-31-0x0000000002500000-0x00000000035BA000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/1844-34-0x0000000002500000-0x00000000035BA000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/1844-35-0x0000000002500000-0x00000000035BA000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/1844-37-0x0000000002500000-0x00000000035BA000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/1844-39-0x0000000002500000-0x00000000035BA000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/1844-40-0x0000000002500000-0x00000000035BA000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/1844-47-0x0000000002500000-0x00000000035BA000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/1844-49-0x0000000002500000-0x00000000035BA000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/1844-51-0x0000000002500000-0x00000000035BA000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/1844-53-0x0000000002500000-0x00000000035BA000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/1844-55-0x0000000002500000-0x00000000035BA000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/1844-56-0x0000000002500000-0x00000000035BA000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/1844-57-0x0000000002500000-0x00000000035BA000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/1844-60-0x0000000002500000-0x00000000035BA000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/1844-62-0x0000000002500000-0x00000000035BA000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/1844-64-0x0000000002500000-0x00000000035BA000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/1844-66-0x0000000002500000-0x00000000035BA000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/1844-68-0x0000000002500000-0x00000000035BA000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/1844-70-0x0000000002500000-0x00000000035BA000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/1844-72-0x0000000002500000-0x00000000035BA000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/1844-74-0x0000000002500000-0x00000000035BA000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/1844-76-0x0000000002500000-0x00000000035BA000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/1844-88-0x0000000002500000-0x00000000035BA000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/1844-89-0x0000000002500000-0x00000000035BA000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/1844-90-0x0000000003750000-0x0000000003752000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/1844-105-0x0000000003750000-0x0000000003752000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/1844-109-0x0000000000400000-0x00000000005B2000-memory.dmp

                                  Filesize

                                  1.7MB

                                • memory/1844-110-0x0000000002500000-0x00000000035BA000-memory.dmp

                                  Filesize

                                  16.7MB