Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    18-05-2024 20:43

General

  • Target

    4bceefbe345b452abeb46ece84d2ed50_NeikiAnalytics.dll

  • Size

    120KB

  • MD5

    4bceefbe345b452abeb46ece84d2ed50

  • SHA1

    c77be676463a84a7350f0a43f3117e79562efa16

  • SHA256

    93fe6d0e6779b13610e5106a44faa5f7089232d5ef85926bf9a0eb8a6e774a5d

  • SHA512

    d0f877869d769d866750b6b05165c7c63b5043b0830591c634a4b9577edd323d10bd24a23766d80884dfa7b490721d59240b929b7d54d726dab53afb57e9f392

  • SSDEEP

    1536:LKlY9zzPhfAkgf1nF8BleBXWX8TtKjf1ZIh8O8uOyVh8Y2Cdv4TVEKLx3yScvxv/:mizPGnF8BuEk3Y/CdyFncvRu3

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

  • Modifies firewall policy service 2 TTPs 6 IoCs
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

  • UAC bypass 3 TTPs 2 IoCs
  • Windows security bypass 2 TTPs 12 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • UPX packed file 25 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Windows security modification 2 TTPs 14 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 15 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs
  • System policy modification 1 TTPs 2 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1104
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1168
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
          PID:1232
          • C:\Windows\system32\rundll32.exe
            rundll32.exe C:\Users\Admin\AppData\Local\Temp\4bceefbe345b452abeb46ece84d2ed50_NeikiAnalytics.dll,#1
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:1720
            • C:\Windows\SysWOW64\rundll32.exe
              rundll32.exe C:\Users\Admin\AppData\Local\Temp\4bceefbe345b452abeb46ece84d2ed50_NeikiAnalytics.dll,#1
              3⤵
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:2144
              • C:\Users\Admin\AppData\Local\Temp\f7619b8.exe
                C:\Users\Admin\AppData\Local\Temp\f7619b8.exe
                4⤵
                • Modifies firewall policy service
                • UAC bypass
                • Windows security bypass
                • Executes dropped EXE
                • Windows security modification
                • Checks whether UAC is enabled
                • Enumerates connected drives
                • Drops file in Windows directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:2880
              • C:\Users\Admin\AppData\Local\Temp\f761b9c.exe
                C:\Users\Admin\AppData\Local\Temp\f761b9c.exe
                4⤵
                • Modifies firewall policy service
                • UAC bypass
                • Windows security bypass
                • Executes dropped EXE
                • Windows security modification
                • Checks whether UAC is enabled
                • Drops file in Windows directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:2632
              • C:\Users\Admin\AppData\Local\Temp\f7638ad.exe
                C:\Users\Admin\AppData\Local\Temp\f7638ad.exe
                4⤵
                • Executes dropped EXE
                PID:1644
        • C:\Windows\system32\DllHost.exe
          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
          1⤵
            PID:2392

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\f7619b8.exe

            Filesize

            97KB

            MD5

            fec4f783bd68280cc60aedb74e1a4481

            SHA1

            05a05fc98323e28d5bb5a2a194a05698911faaea

            SHA256

            d2927b19d9a11f5998311d9a6a98c169dbed017cc197b5180f1cb6de99c2a526

            SHA512

            f582543b4a3151b352e2f4fe300b69db0dd1329f5cf87e512edb8a6178cedb6cc85700eb29043bfe0c5d7673d177ca07513b73a5c1f2238c76162b8c523e3b72

          • C:\Windows\SYSTEM.INI

            Filesize

            257B

            MD5

            9ac1c2919d5c3574e61b3f1685c1feb6

            SHA1

            733207541c9a86d52b39c6b1cbd7550133769af6

            SHA256

            3f238f07872b857bec77664589649c25ff1449646de317603a216e53dbe30e05

            SHA512

            181bf2023e0e545ec4bfc392582128d637e72234e2036237747af266a992463d04aca30d1fc8912a4172ea41149f7656c003fe19769f4770802d4a9ce3a4616d

          • memory/1104-32-0x0000000002020000-0x0000000002022000-memory.dmp

            Filesize

            8KB

          • memory/1644-108-0x00000000001F0000-0x00000000001F2000-memory.dmp

            Filesize

            8KB

          • memory/1644-196-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/1644-110-0x00000000001F0000-0x00000000001F2000-memory.dmp

            Filesize

            8KB

          • memory/1644-106-0x0000000000200000-0x0000000000201000-memory.dmp

            Filesize

            4KB

          • memory/1644-89-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2144-13-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2144-3-0x0000000010000000-0x0000000010020000-memory.dmp

            Filesize

            128KB

          • memory/2144-0-0x0000000010000000-0x0000000010020000-memory.dmp

            Filesize

            128KB

          • memory/2144-12-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2144-41-0x00000000002B0000-0x00000000002B2000-memory.dmp

            Filesize

            8KB

          • memory/2144-42-0x00000000002D0000-0x00000000002D1000-memory.dmp

            Filesize

            4KB

          • memory/2144-1-0x0000000010000000-0x0000000010020000-memory.dmp

            Filesize

            128KB

          • memory/2144-2-0x0000000010000000-0x0000000010020000-memory.dmp

            Filesize

            128KB

          • memory/2144-63-0x00000000002B0000-0x00000000002B2000-memory.dmp

            Filesize

            8KB

          • memory/2144-62-0x00000000002E0000-0x00000000002F2000-memory.dmp

            Filesize

            72KB

          • memory/2144-78-0x0000000000390000-0x00000000003A2000-memory.dmp

            Filesize

            72KB

          • memory/2144-60-0x00000000002B0000-0x00000000002B2000-memory.dmp

            Filesize

            8KB

          • memory/2144-50-0x00000000002D0000-0x00000000002D1000-memory.dmp

            Filesize

            4KB

          • memory/2632-191-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2632-109-0x0000000000220000-0x0000000000222000-memory.dmp

            Filesize

            8KB

          • memory/2632-107-0x0000000000220000-0x0000000000222000-memory.dmp

            Filesize

            8KB

          • memory/2632-100-0x0000000000230000-0x0000000000231000-memory.dmp

            Filesize

            4KB

          • memory/2632-165-0x00000000009C0000-0x0000000001A7A000-memory.dmp

            Filesize

            16.7MB

          • memory/2632-192-0x00000000009C0000-0x0000000001A7A000-memory.dmp

            Filesize

            16.7MB

          • memory/2880-53-0x00000000004E0000-0x00000000004E2000-memory.dmp

            Filesize

            8KB

          • memory/2880-23-0x0000000000710000-0x00000000017CA000-memory.dmp

            Filesize

            16.7MB

          • memory/2880-65-0x0000000000710000-0x00000000017CA000-memory.dmp

            Filesize

            16.7MB

          • memory/2880-67-0x0000000000710000-0x00000000017CA000-memory.dmp

            Filesize

            16.7MB

          • memory/2880-68-0x0000000000710000-0x00000000017CA000-memory.dmp

            Filesize

            16.7MB

          • memory/2880-69-0x0000000000710000-0x00000000017CA000-memory.dmp

            Filesize

            16.7MB

          • memory/2880-71-0x0000000000710000-0x00000000017CA000-memory.dmp

            Filesize

            16.7MB

          • memory/2880-72-0x0000000000710000-0x00000000017CA000-memory.dmp

            Filesize

            16.7MB

          • memory/2880-73-0x0000000000710000-0x00000000017CA000-memory.dmp

            Filesize

            16.7MB

          • memory/2880-74-0x0000000000710000-0x00000000017CA000-memory.dmp

            Filesize

            16.7MB

          • memory/2880-17-0x0000000000710000-0x00000000017CA000-memory.dmp

            Filesize

            16.7MB

          • memory/2880-80-0x0000000000710000-0x00000000017CA000-memory.dmp

            Filesize

            16.7MB

          • memory/2880-19-0x0000000000710000-0x00000000017CA000-memory.dmp

            Filesize

            16.7MB

          • memory/2880-91-0x0000000000710000-0x00000000017CA000-memory.dmp

            Filesize

            16.7MB

          • memory/2880-21-0x0000000000710000-0x00000000017CA000-memory.dmp

            Filesize

            16.7MB

          • memory/2880-66-0x0000000000710000-0x00000000017CA000-memory.dmp

            Filesize

            16.7MB

          • memory/2880-25-0x0000000000710000-0x00000000017CA000-memory.dmp

            Filesize

            16.7MB

          • memory/2880-26-0x0000000000710000-0x00000000017CA000-memory.dmp

            Filesize

            16.7MB

          • memory/2880-93-0x0000000000710000-0x00000000017CA000-memory.dmp

            Filesize

            16.7MB

          • memory/2880-61-0x00000000004E0000-0x00000000004E2000-memory.dmp

            Filesize

            8KB

          • memory/2880-51-0x00000000004F0000-0x00000000004F1000-memory.dmp

            Filesize

            4KB

          • memory/2880-115-0x00000000004E0000-0x00000000004E2000-memory.dmp

            Filesize

            8KB

          • memory/2880-157-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2880-158-0x0000000000710000-0x00000000017CA000-memory.dmp

            Filesize

            16.7MB

          • memory/2880-14-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2880-20-0x0000000000710000-0x00000000017CA000-memory.dmp

            Filesize

            16.7MB

          • memory/2880-24-0x0000000000710000-0x00000000017CA000-memory.dmp

            Filesize

            16.7MB

          • memory/2880-22-0x0000000000710000-0x00000000017CA000-memory.dmp

            Filesize

            16.7MB

          • memory/2880-18-0x0000000000710000-0x00000000017CA000-memory.dmp

            Filesize

            16.7MB