sality | 3375df9b8a72180f8162dcd081078d4064ef036dfd198896ca56563242cecc4e

General

Target

3375df9b8a72180f8162dcd081078d4064ef036dfd198896ca56563242cecc4e.bin.exe
Size

2.0MB
MD5

98c17b152d7bfb9c5a024b6ed479ecc5
SHA1

a563303925f1bfaa8ec08e7d233440ff84a8e3f5
SHA256

3375df9b8a72180f8162dcd081078d4064ef036dfd198896ca56563242cecc4e
SHA512

0202b354c43291b67ddcb9acb683e422650962d2addb264cfdc10c4cb85d36a6e4286660062083f6fcd46216cfd67ee55474d8a5d4317f67ac37f9d1dae267d9
SSDEEP

49152:3uriX899OM/gSY8wHTsb+92hnHO6xfV6vq7NrpOPfgLs1OADgMex:3uriq9jgSY3Two2hHXxL7NrpjD

Score

10^/10

sality backdoor discovery evasion trojan upx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

3375df9b8a72180f8162dcd081078d4064ef036dfd198896ca56563242cecc4e.bin.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	3375df9b8a72180f8162dcd081078d4064ef036dfd198896ca56563242cecc4e.bin.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	3375df9b8a72180f8162dcd081078d4064ef036dfd198896ca56563242cecc4e.bin.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	3375df9b8a72180f8162dcd081078d4064ef036dfd198896ca56563242cecc4e.bin.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	3375df9b8a72180f8162dcd081078d4064ef036dfd198896ca56563242cecc4e.bin.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	3375df9b8a72180f8162dcd081078d4064ef036dfd198896ca56563242cecc4e.bin.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	3375df9b8a72180f8162dcd081078d4064ef036dfd198896ca56563242cecc4e.bin.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2036-2-0x0000000001F70000-0x000000000302A000-memory.dmp	upx
behavioral1/memory/2036-4-0x0000000001F70000-0x000000000302A000-memory.dmp	upx

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

3375df9b8a72180f8162dcd081078d4064ef036dfd198896ca56563242cecc4e.bin.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	3375df9b8a72180f8162dcd081078d4064ef036dfd198896ca56563242cecc4e.bin.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	3375df9b8a72180f8162dcd081078d4064ef036dfd198896ca56563242cecc4e.bin.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	3375df9b8a72180f8162dcd081078d4064ef036dfd198896ca56563242cecc4e.bin.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	3375df9b8a72180f8162dcd081078d4064ef036dfd198896ca56563242cecc4e.bin.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	3375df9b8a72180f8162dcd081078d4064ef036dfd198896ca56563242cecc4e.bin.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	3375df9b8a72180f8162dcd081078d4064ef036dfd198896ca56563242cecc4e.bin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	3375df9b8a72180f8162dcd081078d4064ef036dfd198896ca56563242cecc4e.bin.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

3375df9b8a72180f8162dcd081078d4064ef036dfd198896ca56563242cecc4e.bin.exe

pid	process
2036	3375df9b8a72180f8162dcd081078d4064ef036dfd198896ca56563242cecc4e.bin.exe
2036	3375df9b8a72180f8162dcd081078d4064ef036dfd198896ca56563242cecc4e.bin.exe
2036	3375df9b8a72180f8162dcd081078d4064ef036dfd198896ca56563242cecc4e.bin.exe
2036	3375df9b8a72180f8162dcd081078d4064ef036dfd198896ca56563242cecc4e.bin.exe
2036	3375df9b8a72180f8162dcd081078d4064ef036dfd198896ca56563242cecc4e.bin.exe
2036	3375df9b8a72180f8162dcd081078d4064ef036dfd198896ca56563242cecc4e.bin.exe
2036	3375df9b8a72180f8162dcd081078d4064ef036dfd198896ca56563242cecc4e.bin.exe
2036	3375df9b8a72180f8162dcd081078d4064ef036dfd198896ca56563242cecc4e.bin.exe

C:\Users\Admin\AppData\Local\Temp\3375df9b8a72180f8162dcd081078d4064ef036dfd198896ca56563242cecc4e.bin.exe
"C:\Users\Admin\AppData\Local\Temp\3375df9b8a72180f8162dcd081078d4064ef036dfd198896ca56563242cecc4e.bin.exe"
1⤵
- Windows security bypass
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
PID:2036

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2036-0-0x0000000000400000-0x0000000000611000-memory.dmp

Filesize
2.1MB

Download
memory/2036-2-0x0000000001F70000-0x000000000302A000-memory.dmp

Filesize
16.7MB

Download
memory/2036-3-0x0000000000400000-0x0000000000611000-memory.dmp

Filesize
2.1MB

Download
memory/2036-4-0x0000000001F70000-0x000000000302A000-memory.dmp

Filesize
16.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads