Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
18-05-2024 01:47
General
-
Target
abe72f21162c7034bdac8871251c22534ad7b3454e95af5b0a50a35512c3323f.dll
-
Size
120KB
-
MD5
71305acc3015beff7266b85370ff3363
-
SHA1
d29c0a7bdfbe9af43784483ac973687564fad756
-
SHA256
abe72f21162c7034bdac8871251c22534ad7b3454e95af5b0a50a35512c3323f
-
SHA512
6391f4a4c83532040a545479b87f3d3e5ea5f290a89f02c4899c381221c6f6938aa1dd8cbeaea3b0e0eb768db33fa4849a1912e139d6b29b78c57b63bba32618
-
SSDEEP
3072:U1pIZQjlSUqniIeL0amHQbTJXVC7xJxAG0Qss3:Uj/Rq5ew1HQa9JeQz
Score
10/10
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
-
Sality
Sality is backdoor written in C++, first discovered in 2003.
-
UAC bypass 3 TTPs 2 IoCs
-
Windows security bypass 2 TTPs 12 IoCs
-
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 33 IoCs
-
UPX dump on OEP (original entry point) 36 IoCs
-
Executes dropped EXE 3 IoCs
-
UPX packed file 33 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Windows security modification 2 TTPs 14 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Enumerates connected drives 3 TTPs 14 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 4 IoCs
-
Drops file in Windows directory 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 54 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\abe72f21162c7034bdac8871251c22534ad7b3454e95af5b0a50a35512c3323f.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\abe72f21162c7034bdac8871251c22534ad7b3454e95af5b0a50a35512c3323f.dll,#13⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e574120.exeC:\Users\Admin\AppData\Local\Temp\e574120.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\e57420a.exeC:\Users\Admin\AppData\Local\Temp\e57420a.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\e575ca7.exeC:\Users\Admin\AppData\Local\Temp\e575ca7.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System policy modification
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\e574120.exeFilesize
97KB
MD5d71946392d8974c5924f3a899ab84f83
SHA18535ee2be0b943f61a00d0356b46ed21e41759bb
SHA25604a50f17ffc2756024d8c0ab689cb774a6a99b9362b0613a6f64ceb5b0ffea5e
SHA512c3eba86eea6a1ca0a5df992e4246cd766ad04f157a4318272bdb05be6e0712be5f36a9d5839bc2b764b2f17d9b126056ecc1a1fc418e6a664ad07bd9278176eb
-
C:\Windows\SYSTEM.INIFilesize
257B
MD58f2b3ab813ac345a0299cf042284fe83
SHA13888ee813f4d62482c8f931dc60e2d79e7acfaf1
SHA256044678cbc3a9fbe028bd7fe36fe92fcab197f31656bd87461b66c68748e78977
SHA512187be80c022f635ea887bb5db994e965caf9128ac48ac9de899bfae7beb456f5f436a478c6713ac740db814142794cabc40d5c3358165cdc4013ffcabcf7e935
-
memory/1068-62-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/1068-64-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/1068-136-0x0000000000B60000-0x0000000001C1A000-memory.dmpFilesize
16.7MB
-
memory/1068-137-0x0000000000B60000-0x0000000001C1A000-memory.dmpFilesize
16.7MB
-
memory/1068-135-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1068-61-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/1068-51-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2000-13-0x0000000000940000-0x0000000000942000-memory.dmpFilesize
8KB
-
memory/2000-17-0x0000000000940000-0x0000000000942000-memory.dmpFilesize
8KB
-
memory/2000-32-0x0000000000940000-0x0000000000942000-memory.dmpFilesize
8KB
-
memory/2000-2-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/2000-14-0x0000000003D60000-0x0000000003D61000-memory.dmpFilesize
4KB
-
memory/3900-58-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/3900-63-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/3900-30-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3900-59-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/3900-111-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4792-42-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/4792-12-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/4792-6-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/4792-36-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/4792-37-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/4792-38-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/4792-39-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/4792-40-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/4792-9-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/4792-43-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/4792-27-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/4792-52-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/4792-54-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/4792-55-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/4792-25-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/4792-28-0x0000000001B30000-0x0000000001B32000-memory.dmpFilesize
8KB
-
memory/4792-35-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/4792-26-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/4792-34-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/4792-16-0x0000000001B40000-0x0000000001B41000-memory.dmpFilesize
4KB
-
memory/4792-65-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/4792-67-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/4792-70-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/4792-72-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/4792-74-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/4792-76-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/4792-78-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/4792-79-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/4792-80-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/4792-81-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/4792-107-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4792-33-0x0000000001B30000-0x0000000001B32000-memory.dmpFilesize
8KB
-
memory/4792-97-0x0000000001B30000-0x0000000001B32000-memory.dmpFilesize
8KB
-
memory/4792-92-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/4792-11-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/4792-10-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/4792-8-0x00000000007A0000-0x000000000185A000-memory.dmpFilesize
16.7MB
-
memory/4792-5-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB