Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    29/02/2024, 08:51

General

  • Target

    Packed.Win32.Salpack.dll

  • Size

    120KB

  • MD5

    d1aa87b843048ddaaa60250a8d2356ee

  • SHA1

    99193bc74f0b9450211d78902a7b281aa45f45fe

  • SHA256

    9cba23e62607106638fbefce00cebfd267791bca3ac8289d7ec5ec2a346d0c28

  • SHA512

    fd885290957f4186ce12c536fa6b4b46890f172d52703bf8fc84dd5b03bae4336b429521f51baf335bd2c3eacc14159dc45f676eae1e9c97d2db096b51d8aa5c

  • SSDEEP

    3072:70IxCoyignbh6wL9cjPIR7axm3Bg5MDzZr4yD7a:3xCoyPbhJatm32YVz7a

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

  • Modifies firewall policy service 2 TTPs 6 IoCs
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

  • UAC bypass 3 TTPs 2 IoCs
  • Windows security bypass 2 TTPs 12 IoCs
  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 25 IoCs
  • UPX dump on OEP (original entry point) 29 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • UPX packed file 25 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Windows security modification 2 TTPs 14 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 13 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 41 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs
  • System policy modification 1 TTPs 2 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1120
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
        PID:1248
        • C:\Windows\system32\rundll32.exe
          rundll32.exe C:\Users\Admin\AppData\Local\Temp\Packed.Win32.Salpack.dll,#1
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1444
          • C:\Windows\SysWOW64\rundll32.exe
            rundll32.exe C:\Users\Admin\AppData\Local\Temp\Packed.Win32.Salpack.dll,#1
            3⤵
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:2012
            • C:\Users\Admin\AppData\Local\Temp\f761d70.exe
              C:\Users\Admin\AppData\Local\Temp\f761d70.exe
              4⤵
              • Modifies firewall policy service
              • UAC bypass
              • Windows security bypass
              • Executes dropped EXE
              • Windows security modification
              • Checks whether UAC is enabled
              • Enumerates connected drives
              • Drops file in Windows directory
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:2356
            • C:\Users\Admin\AppData\Local\Temp\f762240.exe
              C:\Users\Admin\AppData\Local\Temp\f762240.exe
              4⤵
              • Executes dropped EXE
              PID:2580
            • C:\Users\Admin\AppData\Local\Temp\f763939.exe
              C:\Users\Admin\AppData\Local\Temp\f763939.exe
              4⤵
              • Modifies firewall policy service
              • UAC bypass
              • Windows security bypass
              • Executes dropped EXE
              • Windows security modification
              • Checks whether UAC is enabled
              • Enumerates connected drives
              • Drops file in Windows directory
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:2604
      • C:\Windows\system32\DllHost.exe
        C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
        1⤵
          PID:1072
        • C:\Windows\system32\Dwm.exe
          "C:\Windows\system32\Dwm.exe"
          1⤵
            PID:1176

          Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\f761d70.exe

                  Filesize

                  97KB

                  MD5

                  caf5df77dd351caf192c62df01558c5f

                  SHA1

                  23019aecb3f2825c43553c2cb8737cb488933bd7

                  SHA256

                  c1b3f78e6f24cced31d35f064ec9401160491f158ab8a88c42bbf39153c1e73b

                  SHA512

                  d223855ad608ed25c501cd21bc939a8588a8845e30ba9ddaac352cb5a87582eb66e02b1540c343c072bae50b14187dce02e26bf7eb407d8de031f9bc36e51d16

                • C:\Windows\SYSTEM.INI

                  Filesize

                  257B

                  MD5

                  6a4b5a903a29fc207c0958399d957053

                  SHA1

                  154701aa4525c2da67417e24d64550dabd188045

                  SHA256

                  1d870296107db4e5514a59b38ed578cbd37d5d8919b2e42b7cc907a57e748974

                  SHA512

                  7e8bd8557886409b5c84434c0d28136dad7aa4611c1da8323c091f2e36917eaae6f381ac4d7eb741de470d78d80ff3609bad9d0bd6e398883f41001e70492621

                • memory/1120-15-0x0000000000490000-0x0000000000492000-memory.dmp

                  Filesize

                  8KB

                • memory/2012-72-0x00000000002E0000-0x00000000002F2000-memory.dmp

                  Filesize

                  72KB

                • memory/2012-70-0x0000000000170000-0x0000000000172000-memory.dmp

                  Filesize

                  8KB

                • memory/2012-76-0x00000000002E0000-0x00000000002F2000-memory.dmp

                  Filesize

                  72KB

                • memory/2012-28-0x0000000000170000-0x0000000000172000-memory.dmp

                  Filesize

                  8KB

                • memory/2012-77-0x0000000000140000-0x0000000000142000-memory.dmp

                  Filesize

                  8KB

                • memory/2012-9-0x0000000000140000-0x0000000000152000-memory.dmp

                  Filesize

                  72KB

                • memory/2012-1-0x0000000010000000-0x0000000010020000-memory.dmp

                  Filesize

                  128KB

                • memory/2012-24-0x0000000000170000-0x0000000000172000-memory.dmp

                  Filesize

                  8KB

                • memory/2012-43-0x00000000002E0000-0x00000000002F2000-memory.dmp

                  Filesize

                  72KB

                • memory/2012-26-0x0000000000270000-0x0000000000271000-memory.dmp

                  Filesize

                  4KB

                • memory/2012-41-0x00000000002E0000-0x00000000002F2000-memory.dmp

                  Filesize

                  72KB

                • memory/2012-29-0x0000000000270000-0x0000000000271000-memory.dmp

                  Filesize

                  4KB

                • memory/2356-58-0x00000000005A0000-0x000000000165A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2356-13-0x00000000005A0000-0x000000000165A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2356-22-0x00000000005A0000-0x000000000165A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2356-11-0x0000000000400000-0x0000000000412000-memory.dmp

                  Filesize

                  72KB

                • memory/2356-45-0x00000000005A0000-0x000000000165A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2356-49-0x00000000005A0000-0x000000000165A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2356-50-0x0000000001760000-0x0000000001761000-memory.dmp

                  Filesize

                  4KB

                • memory/2356-55-0x0000000000470000-0x0000000000472000-memory.dmp

                  Filesize

                  8KB

                • memory/2356-30-0x00000000005A0000-0x000000000165A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2356-56-0x0000000000470000-0x0000000000472000-memory.dmp

                  Filesize

                  8KB

                • memory/2356-57-0x00000000005A0000-0x000000000165A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2356-19-0x00000000005A0000-0x000000000165A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2356-59-0x00000000005A0000-0x000000000165A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2356-60-0x00000000005A0000-0x000000000165A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2356-61-0x00000000005A0000-0x000000000165A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2356-16-0x00000000005A0000-0x000000000165A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2356-74-0x00000000005A0000-0x000000000165A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2356-14-0x00000000005A0000-0x000000000165A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2356-146-0x00000000005A0000-0x000000000165A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2356-25-0x00000000005A0000-0x000000000165A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2356-10-0x00000000005A0000-0x000000000165A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2356-79-0x00000000005A0000-0x000000000165A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2356-80-0x00000000005A0000-0x000000000165A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2356-82-0x00000000005A0000-0x000000000165A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2356-84-0x00000000005A0000-0x000000000165A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2356-108-0x0000000000470000-0x0000000000472000-memory.dmp

                  Filesize

                  8KB

                • memory/2356-106-0x00000000005A0000-0x000000000165A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2356-104-0x00000000005A0000-0x000000000165A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2580-95-0x0000000000260000-0x0000000000262000-memory.dmp

                  Filesize

                  8KB

                • memory/2580-94-0x0000000000270000-0x0000000000271000-memory.dmp

                  Filesize

                  4KB

                • memory/2580-93-0x0000000000260000-0x0000000000262000-memory.dmp

                  Filesize

                  8KB

                • memory/2580-46-0x0000000000400000-0x0000000000412000-memory.dmp

                  Filesize

                  72KB

                • memory/2604-101-0x0000000000220000-0x0000000000222000-memory.dmp

                  Filesize

                  8KB

                • memory/2604-103-0x0000000000230000-0x0000000000231000-memory.dmp

                  Filesize

                  4KB

                • memory/2604-78-0x0000000000400000-0x0000000000412000-memory.dmp

                  Filesize

                  72KB

                • memory/2604-153-0x00000000009C0000-0x0000000001A7A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2604-192-0x00000000009C0000-0x0000000001A7A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2604-193-0x0000000000400000-0x0000000000412000-memory.dmp

                  Filesize

                  72KB