Analysis

  • max time kernel
    124s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    19/02/2024, 21:45

General

  • Target

    775050c673393af1a3f36dd617734d5ec79964df494c3ab954cdfcc4a93e0dbd.exe

  • Size

    1.1MB

  • MD5

    19f530e6ee013b1e94f9c4ce1e338a9d

  • SHA1

    58b577f2d98aafcc0b661b50c615d32c212b3f6e

  • SHA256

    775050c673393af1a3f36dd617734d5ec79964df494c3ab954cdfcc4a93e0dbd

  • SHA512

    e21ee753036496593c9db3add0e3e6abb29f4961db8cb6b2d2db37b1f60a3c912d56bacb4716014c97ad2390407b43f500610ffc5e295d40ff8fcc13a56d860b

  • SSDEEP

    24576:N4U3X8wEKwArXRtrltivOT22qhwxbSUoNL/mzVf:N4U9wMRpBqhw5SUoNjMh

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

  • Modifies firewall policy service 2 TTPs 3 IoCs
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

  • UAC bypass 3 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 6 IoCs
  • UPX packed file 29 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Windows security modification 2 TTPs 7 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 4 IoCs
  • Drops file in Program Files directory 5 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 30 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1124
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
        PID:1268
        • C:\Users\Admin\AppData\Local\Temp\775050c673393af1a3f36dd617734d5ec79964df494c3ab954cdfcc4a93e0dbd.exe
          "C:\Users\Admin\AppData\Local\Temp\775050c673393af1a3f36dd617734d5ec79964df494c3ab954cdfcc4a93e0dbd.exe"
          2⤵
          • Modifies firewall policy service
          • UAC bypass
          • Windows security bypass
          • Windows security modification
          • Checks whether UAC is enabled
          • Enumerates connected drives
          • Writes to the Master Boot Record (MBR)
          • Drops autorun.inf file
          • Drops file in System32 directory
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:3000
      • C:\Windows\system32\DllHost.exe
        C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
        1⤵
          PID:1996
        • C:\Windows\system32\Dwm.exe
          "C:\Windows\system32\Dwm.exe"
          1⤵
            PID:1232

          Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\hsgejb.exe

                  Filesize

                  97KB

                  MD5

                  6c24d6c405feec354930acc201444b66

                  SHA1

                  06c5f17265a3be54ca8f36c8733125040c8b2c61

                  SHA256

                  bd18c587493485ec3f398c235afdb5985eb82d07bbd125961ca269fcd9daa5d9

                  SHA512

                  eb362790b473aca92f9c184725f816308c2dee005cfda8a6bb85b3c4ebfe2d6d611fd6a3d415dcf69f7fe4784329c0eca51791bca3fee66ae9ddbac67e59265d

                • memory/1124-10-0x0000000001C40000-0x0000000001C42000-memory.dmp

                  Filesize

                  8KB

                • memory/3000-36-0x0000000001FD0000-0x000000000308A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/3000-6-0x00000000003F0000-0x00000000003F1000-memory.dmp

                  Filesize

                  4KB

                • memory/3000-8-0x0000000001FD0000-0x000000000308A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/3000-1-0x0000000001FD0000-0x000000000308A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/3000-9-0x0000000001FD0000-0x000000000308A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/3000-14-0x0000000001FD0000-0x000000000308A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/3000-17-0x0000000001FD0000-0x000000000308A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/3000-18-0x0000000001FD0000-0x000000000308A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/3000-26-0x00000000031B0000-0x00000000031B2000-memory.dmp

                  Filesize

                  8KB

                • memory/3000-28-0x0000000003610000-0x0000000003611000-memory.dmp

                  Filesize

                  4KB

                • memory/3000-27-0x0000000001FD0000-0x000000000308A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/3000-29-0x00000000031B0000-0x00000000031B2000-memory.dmp

                  Filesize

                  8KB

                • memory/3000-31-0x0000000003610000-0x0000000003611000-memory.dmp

                  Filesize

                  4KB

                • memory/3000-32-0x0000000001FD0000-0x000000000308A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/3000-33-0x0000000001FD0000-0x000000000308A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/3000-34-0x0000000001FD0000-0x000000000308A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/3000-35-0x0000000001FD0000-0x000000000308A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/3000-0-0x0000000000400000-0x0000000000518000-memory.dmp

                  Filesize

                  1.1MB

                • memory/3000-61-0x0000000001FD0000-0x000000000308A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/3000-38-0x0000000001FD0000-0x000000000308A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/3000-39-0x0000000001FD0000-0x000000000308A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/3000-41-0x0000000001FD0000-0x000000000308A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/3000-42-0x0000000001FD0000-0x000000000308A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/3000-43-0x0000000001FD0000-0x000000000308A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/3000-45-0x0000000001FD0000-0x000000000308A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/3000-48-0x0000000001FD0000-0x000000000308A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/3000-55-0x0000000001FD0000-0x000000000308A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/3000-57-0x0000000001FD0000-0x000000000308A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/3000-37-0x0000000001FD0000-0x000000000308A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/3000-65-0x0000000001FD0000-0x000000000308A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/3000-67-0x0000000001FD0000-0x000000000308A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/3000-69-0x0000000001FD0000-0x000000000308A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/3000-71-0x0000000001FD0000-0x000000000308A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/3000-73-0x0000000001FD0000-0x000000000308A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/3000-103-0x00000000031B0000-0x00000000031B2000-memory.dmp

                  Filesize

                  8KB

                • memory/3000-5-0x0000000001FD0000-0x000000000308A000-memory.dmp

                  Filesize

                  16.7MB