Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    29/02/2024, 06:18

General

  • Target

    ade2a2059d92f988de05067fd44491ef.exe

  • Size

    248KB

  • MD5

    ade2a2059d92f988de05067fd44491ef

  • SHA1

    6d393613db4d16a60d9d9478cc7fb21142229284

  • SHA256

    75074c9368cf924de049bcc3e4a3cce7bbc7a2b721aa66a353a68528abba9fb0

  • SHA512

    5b97929997037497700b15a9a44fce02a228ec49539e7f69a222239877de6342f2ed7ad6927e82556005125982abaf4ee18b5ed9faa260c200e5ffda2838f464

  • SSDEEP

    3072:bIdcFLEdskgrt05bnwhVh6PTPlcfaPHVZxSf/2eYuhhleDbjc5jAZtGMTevwpTR4:UWjZ0xCVh659JSjREDbI5jwtX3z4

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Signatures

  • Modifies firewall policy service 2 TTPs 6 IoCs
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

  • UAC bypass 3 TTPs 2 IoCs
  • Windows security bypass 2 TTPs 12 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • UPX packed file 15 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Windows security modification 2 TTPs 14 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 40 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs
  • System policy modification 1 TTPs 2 IoCs

Processes

  • C:\Windows\system32\DllHost.exe
    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
    1⤵
      PID:2180
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
        PID:1396
        • C:\Users\Admin\AppData\Local\Temp\ade2a2059d92f988de05067fd44491ef.exe
          "C:\Users\Admin\AppData\Local\Temp\ade2a2059d92f988de05067fd44491ef.exe"
          2⤵
          • Modifies firewall policy service
          • UAC bypass
          • Windows security bypass
          • Windows security modification
          • Checks whether UAC is enabled
          • Suspicious use of SetThreadContext
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:2756
          • C:\Users\Admin\AppData\Local\Temp\ade2a2059d92f988de05067fd44491ef.exe
            "C:\Users\Admin\AppData\Local\Temp\ade2a2059d92f988de05067fd44491ef.exe"
            3⤵
            • Loads dropped DLL
            • Adds Run key to start application
            • Suspicious use of WriteProcessMemory
            PID:2440
            • C:\Users\Admin\AppData\Local\Temp\idemoodp0cetka.exe
              "C:\Users\Admin\AppData\Local\Temp\idemoodp0cetka.exe"
              4⤵
              • Modifies firewall policy service
              • UAC bypass
              • Windows security bypass
              • Executes dropped EXE
              • Loads dropped DLL
              • Windows security modification
              • Checks whether UAC is enabled
              • Suspicious use of SetThreadContext
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:2616
              • C:\Users\Admin\AppData\Local\Temp\idemoodp0cetka.exe
                "C:\Users\Admin\AppData\Local\Temp\idemoodp0cetka.exe"
                5⤵
                • Executes dropped EXE
                PID:2764
      • C:\Windows\system32\Dwm.exe
        "C:\Windows\system32\Dwm.exe"
        1⤵
          PID:1352
        • C:\Windows\system32\taskhost.exe
          "taskhost.exe"
          1⤵
            PID:1256

          Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\idemoodp0cetka.exe

                  Filesize

                  248KB

                  MD5

                  ade2a2059d92f988de05067fd44491ef

                  SHA1

                  6d393613db4d16a60d9d9478cc7fb21142229284

                  SHA256

                  75074c9368cf924de049bcc3e4a3cce7bbc7a2b721aa66a353a68528abba9fb0

                  SHA512

                  5b97929997037497700b15a9a44fce02a228ec49539e7f69a222239877de6342f2ed7ad6927e82556005125982abaf4ee18b5ed9faa260c200e5ffda2838f464

                • C:\Windows\SYSTEM.INI

                  Filesize

                  256B

                  MD5

                  2aa1355a23d33cebb4a949316b95e78e

                  SHA1

                  dc39812b16d55041b346c5e2d19928880aa487e4

                  SHA256

                  3fe0b4e96d0f8772ed84d89e13778a35d31745fd794331e395b5989c15ed3075

                  SHA512

                  e37cebeba02ba909912d695368edfa66702a59fd56e6aaa37953e41865deca1ea301933b0075bf6e639f5b8f22fea8e12afe6f8cc9e7d8023120fe70ae81facb

                • memory/1256-8-0x00000000000E0000-0x00000000000E2000-memory.dmp

                  Filesize

                  8KB

                • memory/2440-25-0x0000000000400000-0x000000000040D000-memory.dmp

                  Filesize

                  52KB

                • memory/2440-49-0x00000000003B0000-0x00000000003FB000-memory.dmp

                  Filesize

                  300KB

                • memory/2440-53-0x00000000003B0000-0x00000000003FB000-memory.dmp

                  Filesize

                  300KB

                • memory/2440-39-0x0000000000400000-0x000000000040D000-memory.dmp

                  Filesize

                  52KB

                • memory/2440-54-0x0000000000400000-0x000000000040D000-memory.dmp

                  Filesize

                  52KB

                • memory/2440-29-0x0000000000400000-0x000000000040D000-memory.dmp

                  Filesize

                  52KB

                • memory/2440-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                  Filesize

                  4KB

                • memory/2616-73-0x0000000002670000-0x00000000036FE000-memory.dmp

                  Filesize

                  16.6MB

                • memory/2616-78-0x00000000044D0000-0x000000000451B000-memory.dmp

                  Filesize

                  300KB

                • memory/2616-64-0x0000000002670000-0x00000000036FE000-memory.dmp

                  Filesize

                  16.6MB

                • memory/2616-60-0x0000000002670000-0x00000000036FE000-memory.dmp

                  Filesize

                  16.6MB

                • memory/2616-59-0x0000000002670000-0x00000000036FE000-memory.dmp

                  Filesize

                  16.6MB

                • memory/2616-71-0x0000000000240000-0x0000000000242000-memory.dmp

                  Filesize

                  8KB

                • memory/2616-68-0x0000000002670000-0x00000000036FE000-memory.dmp

                  Filesize

                  16.6MB

                • memory/2616-69-0x0000000000240000-0x0000000000242000-memory.dmp

                  Filesize

                  8KB

                • memory/2616-74-0x00000000003E0000-0x00000000003E1000-memory.dmp

                  Filesize

                  4KB

                • memory/2616-89-0x0000000000240000-0x0000000000242000-memory.dmp

                  Filesize

                  8KB

                • memory/2616-52-0x0000000002670000-0x00000000036FE000-memory.dmp

                  Filesize

                  16.6MB

                • memory/2616-85-0x0000000002670000-0x00000000036FE000-memory.dmp

                  Filesize

                  16.6MB

                • memory/2616-96-0x0000000000400000-0x000000000044B000-memory.dmp

                  Filesize

                  300KB

                • memory/2616-51-0x0000000000400000-0x000000000044B000-memory.dmp

                  Filesize

                  300KB

                • memory/2756-23-0x00000000002C0000-0x00000000002C1000-memory.dmp

                  Filesize

                  4KB

                • memory/2756-40-0x0000000000400000-0x000000000044B000-memory.dmp

                  Filesize

                  300KB

                • memory/2756-33-0x0000000002550000-0x00000000035DE000-memory.dmp

                  Filesize

                  16.6MB

                • memory/2756-32-0x00000000001F0000-0x00000000001F2000-memory.dmp

                  Filesize

                  8KB

                • memory/2756-21-0x00000000001F0000-0x00000000001F2000-memory.dmp

                  Filesize

                  8KB

                • memory/2756-18-0x0000000002550000-0x00000000035DE000-memory.dmp

                  Filesize

                  16.6MB

                • memory/2756-24-0x0000000004520000-0x000000000456B000-memory.dmp

                  Filesize

                  300KB

                • memory/2756-0-0x0000000000400000-0x000000000044B000-memory.dmp

                  Filesize

                  300KB

                • memory/2756-19-0x00000000002C0000-0x00000000002C1000-memory.dmp

                  Filesize

                  4KB

                • memory/2756-17-0x00000000001F0000-0x00000000001F2000-memory.dmp

                  Filesize

                  8KB

                • memory/2756-14-0x0000000002550000-0x00000000035DE000-memory.dmp

                  Filesize

                  16.6MB

                • memory/2756-10-0x0000000002550000-0x00000000035DE000-memory.dmp

                  Filesize

                  16.6MB

                • memory/2756-7-0x0000000002550000-0x00000000035DE000-memory.dmp

                  Filesize

                  16.6MB

                • memory/2756-6-0x0000000002550000-0x00000000035DE000-memory.dmp

                  Filesize

                  16.6MB

                • memory/2756-3-0x0000000002550000-0x00000000035DE000-memory.dmp

                  Filesize

                  16.6MB

                • memory/2756-2-0x0000000002550000-0x00000000035DE000-memory.dmp

                  Filesize

                  16.6MB