sality | 469c03431549dba4a3a49ba65abb6de71e9c191aa600d635791ac795379e89d9

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
18-05-2024 19:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3eafc62984702e015db77e1df30e2950_NeikiAnalytics.dll
Size

120KB
MD5

3eafc62984702e015db77e1df30e2950
SHA1

69725258c0e82c8ed41baaad2810ff07d7a85624
SHA256

469c03431549dba4a3a49ba65abb6de71e9c191aa600d635791ac795379e89d9
SHA512

0957d8c155ada6853879e57f4fb8fd1d68516bdb12725c88a4503dc6a681e14e64d20221764833f08debee334199e52a660a7c98057951c88f2c2eb8805c6af0
SSDEEP

3072:ep3SeK8uYK+/AxdlPUwZa2awNnCSsqk3sh7MiVrT8N0W:0YYKBxdlBLNCrqkUVen

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Modifies firewall policy service 2 TTPs 3 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Processes:

f760efe.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	f760efe.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	f760efe.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	f760efe.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality
UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1548.002

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

f760efe.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f760efe.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f760efe.exe

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f760efe.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f760efe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f760efe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f760efe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f760efe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f760efe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f760efe.exe

Executes dropped EXE 3 IoCs

Processes:

f760efe.exef761094.exef762a8a.exe

pid process

1884 f760efe.exe
2628 f761094.exe
2340 f762a8a.exe
Loads dropped DLL 6 IoCs

Processes:

rundll32.exe

pid process

2848 rundll32.exe
2848 rundll32.exe
2848 rundll32.exe
2848 rundll32.exe
2848 rundll32.exe
2848 rundll32.exe

pid	process
1884	f760efe.exe
2628	f761094.exe
2340	f762a8a.exe

pid	process
2848	rundll32.exe
2848	rundll32.exe
2848	rundll32.exe
2848	rundll32.exe
2848	rundll32.exe
2848	rundll32.exe

UPX packed file 23 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1884-21-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/1884-14-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/1884-16-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/1884-17-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/1884-19-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/1884-15-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/1884-23-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/1884-22-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/1884-20-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/1884-18-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/1884-61-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/1884-62-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/1884-63-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/1884-65-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/1884-64-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/1884-67-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/1884-68-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/1884-83-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/1884-84-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/1884-86-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/1884-105-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/1884-107-0x0000000000670000-0x000000000172A000-memory.dmp	upx
behavioral1/memory/1884-150-0x0000000000670000-0x000000000172A000-memory.dmp	upx

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

f760efe.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc	f760efe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	f760efe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	f760efe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	f760efe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	f760efe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	f760efe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1"	f760efe.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

f760efe.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f760efe.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f760efe.exe

Enumerates connected drives 3 TTPs 14 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

f760efe.exe

description	ioc	process
File opened (read-only)	\??\J:	f760efe.exe
File opened (read-only)	\??\M:	f760efe.exe
File opened (read-only)	\??\P:	f760efe.exe
File opened (read-only)	\??\G:	f760efe.exe
File opened (read-only)	\??\H:	f760efe.exe
File opened (read-only)	\??\L:	f760efe.exe
File opened (read-only)	\??\O:	f760efe.exe
File opened (read-only)	\??\I:	f760efe.exe
File opened (read-only)	\??\Q:	f760efe.exe
File opened (read-only)	\??\R:	f760efe.exe
File opened (read-only)	\??\S:	f760efe.exe
File opened (read-only)	\??\E:	f760efe.exe
File opened (read-only)	\??\K:	f760efe.exe
File opened (read-only)	\??\N:	f760efe.exe

Drops file in Windows directory 2 IoCs

Processes:

f760efe.exe

description ioc process

File created C:\Windows\f760f5c f760efe.exe
File opened for modification C:\Windows\SYSTEM.INI f760efe.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

f760efe.exe

pid process

1884 f760efe.exe
1884 f760efe.exe

description	ioc	process
File created	C:\Windows\f760f5c	f760efe.exe
File opened for modification	C:\Windows\SYSTEM.INI	f760efe.exe

pid	process
1884	f760efe.exe
1884	f760efe.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

f760efe.exe

description	pid	process
Token: SeDebugPrivilege	1884	f760efe.exe
Token: SeDebugPrivilege	1884	f760efe.exe
Token: SeDebugPrivilege	1884	f760efe.exe
Token: SeDebugPrivilege	1884	f760efe.exe
Token: SeDebugPrivilege	1884	f760efe.exe
Token: SeDebugPrivilege	1884	f760efe.exe
Token: SeDebugPrivilege	1884	f760efe.exe
Token: SeDebugPrivilege	1884	f760efe.exe
Token: SeDebugPrivilege	1884	f760efe.exe
Token: SeDebugPrivilege	1884	f760efe.exe
Token: SeDebugPrivilege	1884	f760efe.exe
Token: SeDebugPrivilege	1884	f760efe.exe
Token: SeDebugPrivilege	1884	f760efe.exe
Token: SeDebugPrivilege	1884	f760efe.exe
Token: SeDebugPrivilege	1884	f760efe.exe
Token: SeDebugPrivilege	1884	f760efe.exe
Token: SeDebugPrivilege	1884	f760efe.exe
Token: SeDebugPrivilege	1884	f760efe.exe
Token: SeDebugPrivilege	1884	f760efe.exe
Token: SeDebugPrivilege	1884	f760efe.exe
Token: SeDebugPrivilege	1884	f760efe.exe

Suspicious use of WriteProcessMemory 33 IoCs

Processes:

rundll32.exerundll32.exef760efe.exe

description	pid	process	target process
PID 2800 wrote to memory of 2848	2800	rundll32.exe	rundll32.exe
PID 2800 wrote to memory of 2848	2800	rundll32.exe	rundll32.exe
PID 2800 wrote to memory of 2848	2800	rundll32.exe	rundll32.exe
PID 2800 wrote to memory of 2848	2800	rundll32.exe	rundll32.exe
PID 2800 wrote to memory of 2848	2800	rundll32.exe	rundll32.exe
PID 2800 wrote to memory of 2848	2800	rundll32.exe	rundll32.exe
PID 2800 wrote to memory of 2848	2800	rundll32.exe	rundll32.exe
PID 2848 wrote to memory of 1884	2848	rundll32.exe	f760efe.exe
PID 2848 wrote to memory of 1884	2848	rundll32.exe	f760efe.exe
PID 2848 wrote to memory of 1884	2848	rundll32.exe	f760efe.exe
PID 2848 wrote to memory of 1884	2848	rundll32.exe	f760efe.exe
PID 1884 wrote to memory of 1120	1884	f760efe.exe	taskhost.exe
PID 1884 wrote to memory of 1180	1884	f760efe.exe	Dwm.exe
PID 1884 wrote to memory of 1216	1884	f760efe.exe	Explorer.EXE
PID 1884 wrote to memory of 2132	1884	f760efe.exe	DllHost.exe
PID 1884 wrote to memory of 2800	1884	f760efe.exe	rundll32.exe
PID 1884 wrote to memory of 2848	1884	f760efe.exe	rundll32.exe
PID 1884 wrote to memory of 2848	1884	f760efe.exe	rundll32.exe
PID 2848 wrote to memory of 2628	2848	rundll32.exe	f761094.exe
PID 2848 wrote to memory of 2628	2848	rundll32.exe	f761094.exe
PID 2848 wrote to memory of 2628	2848	rundll32.exe	f761094.exe
PID 2848 wrote to memory of 2628	2848	rundll32.exe	f761094.exe
PID 2848 wrote to memory of 2340	2848	rundll32.exe	f762a8a.exe
PID 2848 wrote to memory of 2340	2848	rundll32.exe	f762a8a.exe
PID 2848 wrote to memory of 2340	2848	rundll32.exe	f762a8a.exe
PID 2848 wrote to memory of 2340	2848	rundll32.exe	f762a8a.exe
PID 1884 wrote to memory of 1120	1884	f760efe.exe	taskhost.exe
PID 1884 wrote to memory of 1180	1884	f760efe.exe	Dwm.exe
PID 1884 wrote to memory of 1216	1884	f760efe.exe	Explorer.EXE
PID 1884 wrote to memory of 2628	1884	f760efe.exe	f761094.exe
PID 1884 wrote to memory of 2628	1884	f760efe.exe	f761094.exe
PID 1884 wrote to memory of 2340	1884	f760efe.exe	f762a8a.exe
PID 1884 wrote to memory of 2340	1884	f760efe.exe	f762a8a.exe

System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

f760efe.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f760efe.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f760efe.exe

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1120

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1180

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1216

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3eafc62984702e015db77e1df30e2950_NeikiAnalytics.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:2800

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3eafc62984702e015db77e1df30e2950_NeikiAnalytics.dll,#1
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2848

C:\Users\Admin\AppData\Local\Temp\f760efe.exe
C:\Users\Admin\AppData\Local\Temp\f760efe.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1884

C:\Users\Admin\AppData\Local\Temp\f761094.exe
C:\Users\Admin\AppData\Local\Temp\f761094.exe
4⤵
- Executes dropped EXE
PID:2628

C:\Users\Admin\AppData\Local\Temp\f762a8a.exe
C:\Users\Admin\AppData\Local\Temp\f762a8a.exe
4⤵
- Executes dropped EXE
PID:2340

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\f760efe.exe

Filesize
97KB

MD5
a36a2ef79824fa706524099b792abc4e

SHA1
61821464c08c110d226f3be1a0f8b82e93666bac

SHA256
9a793f3ff68844bef7027537680ff7bd3cd0cf21e7330c09f4b5c2c4b1390962

SHA512
2ebb0b7a0055ec61d371909362a68b7a19275ce28bcb09f699e84dc30346b9385349a738bead73c8fe7ca21a75333b03bf447ea53a1d25aa7dccc13a8ff3af8b

Download Submit
memory/1120-24-0x0000000001F90000-0x0000000001F92000-memory.dmp

Filesize
8KB

Download
memory/1884-59-0x0000000000290000-0x0000000000292000-memory.dmp

Filesize
8KB

Download
memory/1884-83-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/1884-150-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/1884-21-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/1884-14-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/1884-16-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/1884-17-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/1884-19-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/1884-15-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/1884-23-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/1884-22-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/1884-20-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/1884-147-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1884-107-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/1884-60-0x0000000000290000-0x0000000000292000-memory.dmp

Filesize
8KB

Download
memory/1884-18-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/1884-86-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/1884-84-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/1884-40-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/1884-11-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1884-61-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/1884-68-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/1884-67-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/1884-105-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/1884-64-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/1884-62-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/1884-63-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/1884-65-0x0000000000670000-0x000000000172A000-memory.dmp

Filesize
16.7MB

Download
memory/2340-104-0x0000000000260000-0x0000000000262000-memory.dmp

Filesize
8KB

Download
memory/2340-102-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2340-156-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2340-81-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2628-96-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2628-95-0x0000000000260000-0x0000000000262000-memory.dmp

Filesize
8KB

Download
memory/2628-152-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2628-53-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2628-103-0x0000000000260000-0x0000000000262000-memory.dmp

Filesize
8KB

Download
memory/2848-80-0x00000000001B0000-0x00000000001B2000-memory.dmp

Filesize
8KB

Download
memory/2848-78-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/2848-10-0x00000000001B0000-0x00000000001C2000-memory.dmp

Filesize
72KB

Download
memory/2848-51-0x0000000000380000-0x0000000000392000-memory.dmp

Filesize
72KB

Download
memory/2848-49-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/2848-1-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/2848-52-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/2848-41-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2848-9-0x00000000001B0000-0x00000000001C2000-memory.dmp

Filesize
72KB

Download
memory/2848-32-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2848-31-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download