Analysis
-
max time kernel
117s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
17-04-2024 19:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
19f8c594b5eede63cf4503649718091df87bbef51b752c3c4bf9568ae4009a47.dll
Resource
win7-20240221-en
windows7-x64
17 signatures
150 seconds
General
-
Target
19f8c594b5eede63cf4503649718091df87bbef51b752c3c4bf9568ae4009a47.dll
-
Size
120KB
-
MD5
2ffdb01e789c91cbf165da50208708ac
-
SHA1
f39565ac03238c15619f215d0059baece745eb2f
-
SHA256
19f8c594b5eede63cf4503649718091df87bbef51b752c3c4bf9568ae4009a47
-
SHA512
96c5e8d4edb61ee2b0037e51f3c2200ae26967fb6be5f48285f334e4decbfb16500fdcbfa186b6e3e8986b45ef1956732ddbe7d4c3f6d1621ddfe914772c0088
-
SSDEEP
1536:iH/4PQaw0ytALz/mLq1c50trJFkSh2Wx/3upaaHb33Mqwvn+CkzivaoPkR7vHhAa:8kwGGq1ccrJmScqVadgHEDC
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f767c51.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f767c51.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f767c51.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f767c51.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f767c51.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f767c51.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f767c51.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f767c51.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f767c51.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f767c51.exe -
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 23 IoCs
resource yara_rule behavioral1/memory/3016-14-0x0000000000650000-0x000000000170A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3016-16-0x0000000000650000-0x000000000170A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3016-17-0x0000000000650000-0x000000000170A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3016-22-0x0000000000650000-0x000000000170A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3016-26-0x0000000000650000-0x000000000170A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3016-45-0x0000000000650000-0x000000000170A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3016-29-0x0000000000650000-0x000000000170A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3016-54-0x0000000000650000-0x000000000170A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3016-55-0x0000000000650000-0x000000000170A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3016-60-0x0000000000650000-0x000000000170A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3016-61-0x0000000000650000-0x000000000170A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3016-62-0x0000000000650000-0x000000000170A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3016-63-0x0000000000650000-0x000000000170A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3016-64-0x0000000000650000-0x000000000170A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3016-65-0x0000000000650000-0x000000000170A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3016-80-0x0000000000650000-0x000000000170A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3016-81-0x0000000000650000-0x000000000170A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3016-82-0x0000000000650000-0x000000000170A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3016-84-0x0000000000650000-0x000000000170A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3016-102-0x0000000000650000-0x000000000170A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3016-104-0x0000000000650000-0x000000000170A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3016-106-0x0000000000650000-0x000000000170A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3016-140-0x0000000000650000-0x000000000170A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine -
UPX dump on OEP (original entry point) 26 IoCs
resource yara_rule behavioral1/memory/3016-14-0x0000000000650000-0x000000000170A000-memory.dmp UPX behavioral1/memory/3016-16-0x0000000000650000-0x000000000170A000-memory.dmp UPX behavioral1/memory/3016-17-0x0000000000650000-0x000000000170A000-memory.dmp UPX behavioral1/memory/3016-22-0x0000000000650000-0x000000000170A000-memory.dmp UPX behavioral1/memory/3016-26-0x0000000000650000-0x000000000170A000-memory.dmp UPX behavioral1/memory/3016-45-0x0000000000650000-0x000000000170A000-memory.dmp UPX behavioral1/memory/2808-48-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral1/memory/3016-29-0x0000000000650000-0x000000000170A000-memory.dmp UPX behavioral1/memory/3016-54-0x0000000000650000-0x000000000170A000-memory.dmp UPX behavioral1/memory/3016-55-0x0000000000650000-0x000000000170A000-memory.dmp UPX behavioral1/memory/3016-60-0x0000000000650000-0x000000000170A000-memory.dmp UPX behavioral1/memory/3016-61-0x0000000000650000-0x000000000170A000-memory.dmp UPX behavioral1/memory/3016-62-0x0000000000650000-0x000000000170A000-memory.dmp UPX behavioral1/memory/3016-63-0x0000000000650000-0x000000000170A000-memory.dmp UPX behavioral1/memory/3016-64-0x0000000000650000-0x000000000170A000-memory.dmp UPX behavioral1/memory/3016-65-0x0000000000650000-0x000000000170A000-memory.dmp UPX behavioral1/memory/3016-80-0x0000000000650000-0x000000000170A000-memory.dmp UPX behavioral1/memory/3016-81-0x0000000000650000-0x000000000170A000-memory.dmp UPX behavioral1/memory/3016-82-0x0000000000650000-0x000000000170A000-memory.dmp UPX behavioral1/memory/3016-84-0x0000000000650000-0x000000000170A000-memory.dmp UPX behavioral1/memory/3016-102-0x0000000000650000-0x000000000170A000-memory.dmp UPX behavioral1/memory/3016-104-0x0000000000650000-0x000000000170A000-memory.dmp UPX behavioral1/memory/3016-106-0x0000000000650000-0x000000000170A000-memory.dmp UPX behavioral1/memory/3016-141-0x0000000000400000-0x0000000000412000-memory.dmp UPX behavioral1/memory/3016-140-0x0000000000650000-0x000000000170A000-memory.dmp UPX behavioral1/memory/472-145-0x0000000000400000-0x0000000000412000-memory.dmp UPX -
Executes dropped EXE 3 IoCs
pid Process 3016 f767c51.exe 2808 f7682a7.exe 472 f769647.exe -
Loads dropped DLL 6 IoCs
pid Process 1760 rundll32.exe 1760 rundll32.exe 1760 rundll32.exe 1760 rundll32.exe 1760 rundll32.exe 1760 rundll32.exe -
resource yara_rule behavioral1/memory/3016-14-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/3016-16-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/3016-17-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/3016-22-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/3016-26-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/3016-45-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/3016-29-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/3016-54-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/3016-55-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/3016-60-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/3016-61-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/3016-62-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/3016-63-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/3016-64-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/3016-65-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/3016-80-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/3016-81-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/3016-82-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/3016-84-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/3016-102-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/3016-104-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/3016-106-0x0000000000650000-0x000000000170A000-memory.dmp upx behavioral1/memory/3016-140-0x0000000000650000-0x000000000170A000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f767c51.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f767c51.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f767c51.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f767c51.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f767c51.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f767c51.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f767c51.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f767c51.exe -
Enumerates connected drives 3 TTPs 10 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: f767c51.exe File opened (read-only) \??\I: f767c51.exe File opened (read-only) \??\J: f767c51.exe File opened (read-only) \??\O: f767c51.exe File opened (read-only) \??\E: f767c51.exe File opened (read-only) \??\H: f767c51.exe File opened (read-only) \??\K: f767c51.exe File opened (read-only) \??\L: f767c51.exe File opened (read-only) \??\M: f767c51.exe File opened (read-only) \??\N: f767c51.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\f767e15 f767c51.exe File opened for modification C:\Windows\SYSTEM.INI f767c51.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3016 f767c51.exe 3016 f767c51.exe -
Suspicious use of AdjustPrivilegeToken 21 IoCs
description pid Process Token: SeDebugPrivilege 3016 f767c51.exe Token: SeDebugPrivilege 3016 f767c51.exe Token: SeDebugPrivilege 3016 f767c51.exe Token: SeDebugPrivilege 3016 f767c51.exe Token: SeDebugPrivilege 3016 f767c51.exe Token: SeDebugPrivilege 3016 f767c51.exe Token: SeDebugPrivilege 3016 f767c51.exe Token: SeDebugPrivilege 3016 f767c51.exe Token: SeDebugPrivilege 3016 f767c51.exe Token: SeDebugPrivilege 3016 f767c51.exe Token: SeDebugPrivilege 3016 f767c51.exe Token: SeDebugPrivilege 3016 f767c51.exe Token: SeDebugPrivilege 3016 f767c51.exe Token: SeDebugPrivilege 3016 f767c51.exe Token: SeDebugPrivilege 3016 f767c51.exe Token: SeDebugPrivilege 3016 f767c51.exe Token: SeDebugPrivilege 3016 f767c51.exe Token: SeDebugPrivilege 3016 f767c51.exe Token: SeDebugPrivilege 3016 f767c51.exe Token: SeDebugPrivilege 3016 f767c51.exe Token: SeDebugPrivilege 3016 f767c51.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 2184 wrote to memory of 1760 2184 rundll32.exe 28 PID 2184 wrote to memory of 1760 2184 rundll32.exe 28 PID 2184 wrote to memory of 1760 2184 rundll32.exe 28 PID 2184 wrote to memory of 1760 2184 rundll32.exe 28 PID 2184 wrote to memory of 1760 2184 rundll32.exe 28 PID 2184 wrote to memory of 1760 2184 rundll32.exe 28 PID 2184 wrote to memory of 1760 2184 rundll32.exe 28 PID 1760 wrote to memory of 3016 1760 rundll32.exe 29 PID 1760 wrote to memory of 3016 1760 rundll32.exe 29 PID 1760 wrote to memory of 3016 1760 rundll32.exe 29 PID 1760 wrote to memory of 3016 1760 rundll32.exe 29 PID 3016 wrote to memory of 1116 3016 f767c51.exe 19 PID 3016 wrote to memory of 1172 3016 f767c51.exe 20 PID 3016 wrote to memory of 1200 3016 f767c51.exe 21 PID 3016 wrote to memory of 1992 3016 f767c51.exe 23 PID 3016 wrote to memory of 2184 3016 f767c51.exe 27 PID 3016 wrote to memory of 1760 3016 f767c51.exe 28 PID 3016 wrote to memory of 1760 3016 f767c51.exe 28 PID 1760 wrote to memory of 2808 1760 rundll32.exe 30 PID 1760 wrote to memory of 2808 1760 rundll32.exe 30 PID 1760 wrote to memory of 2808 1760 rundll32.exe 30 PID 1760 wrote to memory of 2808 1760 rundll32.exe 30 PID 1760 wrote to memory of 472 1760 rundll32.exe 31 PID 1760 wrote to memory of 472 1760 rundll32.exe 31 PID 1760 wrote to memory of 472 1760 rundll32.exe 31 PID 1760 wrote to memory of 472 1760 rundll32.exe 31 PID 3016 wrote to memory of 1116 3016 f767c51.exe 19 PID 3016 wrote to memory of 1172 3016 f767c51.exe 20 PID 3016 wrote to memory of 1200 3016 f767c51.exe 21 PID 3016 wrote to memory of 2808 3016 f767c51.exe 30 PID 3016 wrote to memory of 2808 3016 f767c51.exe 30 PID 3016 wrote to memory of 472 3016 f767c51.exe 31 PID 3016 wrote to memory of 472 3016 f767c51.exe 31 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f767c51.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1116
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1172
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1200
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\19f8c594b5eede63cf4503649718091df87bbef51b752c3c4bf9568ae4009a47.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\19f8c594b5eede63cf4503649718091df87bbef51b752c3c4bf9568ae4009a47.dll,#13⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\f767c51.exeC:\Users\Admin\AppData\Local\Temp\f767c51.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3016
-
-
C:\Users\Admin\AppData\Local\Temp\f7682a7.exeC:\Users\Admin\AppData\Local\Temp\f7682a7.exe4⤵
- Executes dropped EXE
PID:2808
-
-
C:\Users\Admin\AppData\Local\Temp\f769647.exeC:\Users\Admin\AppData\Local\Temp\f769647.exe4⤵
- Executes dropped EXE
PID:472
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1992
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD5c2ed8616e77f95d9a94dea6fe82a6792
SHA167cac907bf4e931369da3bb2099b27e972c61e77
SHA25652d724ddea772266f43c526ea2899e9b711f1525628f87a4e7a11c9e65c33357
SHA51290b3f1901da703bb6092ddd6b43fcd8b0cc236eed21280dacfaf59720410afa34284a69ff8280b6ba49a74360e6258b14731b522f81473c4e85d8f19fc3ca6cc