Analysis
- max time kernel
22s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
27/02/2024, 03:29
General
- Target a81adbf226541ece20dfd6b8cd47a2f5.exe
- Size 172KB
- Sample240227-d176saff3v
- SHA256 41d7253ab0d4f1ff8b3a76d420212dd98fa58421c5ec9dd54f8615d6316c0ac0
Malware Config
Extracted
-
sality
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Sality
Sality is backdoor written in C++, first discovered in 2003.
- UAC bypass 3 TTPs 2 IoCs
- Windows security bypass 2 TTPs 12 IoCs
- Disables RegEdit via registry modification 2 IoCs
- Disables Task Manager via registry modification
- Modifies Windows Firewall 2 TTPs 1 IoCs
- Deletes itself 1 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 7 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- UPX packed file 18 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Windows security modification 2 TTPs 14 IoCs
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- NSIS installer 4 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 25 IoCs
- System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\a81adbf226541ece20dfd6b8cd47a2f5.exe"C:\Users\Admin\AppData\Local\Temp\a81adbf226541ece20dfd6b8cd47a2f5.exe"2⤵
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\3⤵
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode disable4⤵
- Modifies Windows Firewall
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE"4⤵
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE"4⤵
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE"4⤵
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE"4⤵
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE"4⤵
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
Au_.exe
Processes.dll
System.dll
UserInfo.dll
Au_.exe
SYSTEM.INI
memory/232-101-0x00000000012B0000-0x00000000012C7000-memory.dmp
memory/232-100-0x00000000012B0000-0x00000000012C7000-memory.dmp
memory/2028-38-0x0000000002C00000-0x0000000002C12000-memory.dmp
memory/2028-93-0x0000000002380000-0x0000000002382000-memory.dmp
memory/2028-116-0x00000000060C0000-0x00000000070F1000-memory.dmp
memory/2028-61-0x00000000060C0000-0x00000000070F1000-memory.dmp
memory/2028-13-0x0000000000400000-0x0000000000457000-memory.dmp
memory/2028-63-0x00000000060C0000-0x00000000070F1000-memory.dmp
memory/2028-65-0x0000000002380000-0x0000000002382000-memory.dmp
memory/2028-67-0x0000000002380000-0x0000000002382000-memory.dmp
memory/2028-66-0x0000000002C40000-0x0000000002C41000-memory.dmp
memory/2028-64-0x00000000060C0000-0x00000000070F1000-memory.dmp
memory/2028-73-0x00000000060C0000-0x00000000070F1000-memory.dmp
memory/2028-74-0x00000000060C0000-0x00000000070F1000-memory.dmp
memory/2028-78-0x00000000060C0000-0x00000000070F1000-memory.dmp
memory/2028-80-0x00000000060C0000-0x00000000070F1000-memory.dmp
memory/2028-86-0x00000000060C0000-0x00000000070F1000-memory.dmp
memory/2028-114-0x00000000060C0000-0x00000000070F1000-memory.dmp
memory/2028-88-0x00000000060C0000-0x00000000070F1000-memory.dmp
memory/2028-115-0x00000000060C0000-0x00000000070F1000-memory.dmp
memory/2028-95-0x00000000060C0000-0x00000000070F1000-memory.dmp
memory/2028-96-0x00000000060C0000-0x00000000070F1000-memory.dmp
memory/2028-99-0x00000000060C0000-0x00000000070F1000-memory.dmp
memory/2028-105-0x00000000060C0000-0x00000000070F1000-memory.dmp
memory/2860-107-0x0000000000BC0000-0x0000000000BD7000-memory.dmp
memory/2860-109-0x0000000000BC0000-0x0000000000BD7000-memory.dmp
memory/3752-102-0x0000000000600000-0x0000000000617000-memory.dmp
memory/3752-106-0x0000000000600000-0x0000000000617000-memory.dmp
memory/4004-110-0x00000000007E0000-0x00000000007F7000-memory.dmp
memory/4004-111-0x00000000007E0000-0x00000000007F7000-memory.dmp
memory/4164-1-0x0000000002360000-0x0000000003391000-memory.dmp
memory/4164-3-0x0000000002360000-0x0000000003391000-memory.dmp
memory/4164-14-0x0000000000400000-0x0000000000457000-memory.dmp
memory/4164-0-0x0000000000400000-0x0000000000457000-memory.dmp
memory/4972-90-0x0000000000560000-0x0000000000577000-memory.dmp