Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
21-05-2024 19:02
General
-
Target
16b4dfc06457a6bcfd10a4d7543c4a8f5aed127719d16a730e95ee08e4bd7328.dll
-
Size
120KB
-
MD5
9a9a328c781a0fcbeab84401750ab0b3
-
SHA1
856a320f326bb622de155f0e206892db0490d43e
-
SHA256
16b4dfc06457a6bcfd10a4d7543c4a8f5aed127719d16a730e95ee08e4bd7328
-
SHA512
e88fdfe1e86d2f2baeead719a1ee0bed84b5c70e1f19c3f38a43f3291ccca505e2f2e6f27b3a8fb1d2484ec90af377139fce793779e079687e811990c1e6d7d1
-
SSDEEP
1536:xQRskiO82WOFJnxM7YtICBqLSqKfe/sA2CZeMo1zJVTDwffOwe53UKl4Op2:xXO7JxM7/C4SqV/p26eHTVTcfWKKl3
Score
10/10
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
-
Sality
Sality is backdoor written in C++, first discovered in 2003.
-
UAC bypass 3 TTPs 2 IoCs
-
Windows security bypass 2 TTPs 12 IoCs
-
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 33 IoCs
-
UPX dump on OEP (original entry point) 39 IoCs
-
Executes dropped EXE 4 IoCs
-
UPX packed file 33 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Windows security modification 2 TTPs 14 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Enumerates connected drives 3 TTPs 14 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 4 IoCs
-
Drops file in Windows directory 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\16b4dfc06457a6bcfd10a4d7543c4a8f5aed127719d16a730e95ee08e4bd7328.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\16b4dfc06457a6bcfd10a4d7543c4a8f5aed127719d16a730e95ee08e4bd7328.dll,#13⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e574bfd.exeC:\Users\Admin\AppData\Local\Temp\e574bfd.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\e574da3.exeC:\Users\Admin\AppData\Local\Temp\e574da3.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\e5767c2.exeC:\Users\Admin\AppData\Local\Temp\e5767c2.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\e576830.exeC:\Users\Admin\AppData\Local\Temp\e576830.exe4⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\e574bfd.exeFilesize
97KB
MD55e1e7322707fe9f471fcb71dbc7019a2
SHA123ded2e8f9c6dbede023357c9e8db3349680074c
SHA2566f69c25685f41b3f7ddfab8026c4cd3a4c0d20ba5cfeb5a34a982db31ee30cb1
SHA512f405059b1dc75e453437610a0be53618dde2cd469b30aa9f9a1e543fd76ca431725b97022af55d09e3e3f344dfaab793574bada86d01c19a58088f1a903724e5
-
C:\Windows\SYSTEM.INIFilesize
257B
MD54d36acd2c51002721a16494ec2b8847d
SHA1de0bf67715606e25014b74eb1012731cf1d9389b
SHA256b5c84cdea2d10f4dc1eb0290c37c3e6d4a63dfef5c6ee0d0e644b7a31f852b1b
SHA512b4daa7758ff241432a27ea4ae0994c754ed836f4da2c9fc9dc3eecfd37ff27cdfefc8834d03a86832e3d13e1c6d47a4f103022caf75c61052e4913aafd441591
-
memory/2348-51-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2348-133-0x0000000000B30000-0x0000000001BEA000-memory.dmpFilesize
16.7MB
-
memory/2348-151-0x0000000000B30000-0x0000000001BEA000-memory.dmpFilesize
16.7MB
-
memory/2348-150-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2348-73-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/2348-66-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/2348-69-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/3432-57-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/3432-84-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/3432-10-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/3432-11-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/3432-21-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/3432-17-0x0000000001A40000-0x0000000001A41000-memory.dmpFilesize
4KB
-
memory/3432-5-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3432-9-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/3432-8-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/3432-22-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/3432-97-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/3432-112-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3432-37-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/3432-36-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/3432-38-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/3432-39-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/3432-40-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/3432-42-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/3432-43-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/3432-100-0x0000000001A30000-0x0000000001A32000-memory.dmpFilesize
8KB
-
memory/3432-13-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/3432-28-0x0000000001A30000-0x0000000001A32000-memory.dmpFilesize
8KB
-
memory/3432-59-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/3432-60-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/3432-93-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/3432-90-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/3432-35-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/3432-23-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/3432-89-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/3432-87-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/3432-86-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/3432-34-0x0000000001A30000-0x0000000001A32000-memory.dmpFilesize
8KB
-
memory/3432-12-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/3432-71-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/3432-76-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/3432-80-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/3432-82-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/3660-116-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3660-72-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/3660-63-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/3660-64-0x0000000000570000-0x0000000000571000-memory.dmpFilesize
4KB
-
memory/3660-26-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3724-18-0x0000000001830000-0x0000000001832000-memory.dmpFilesize
8KB
-
memory/3724-15-0x0000000004920000-0x0000000004921000-memory.dmpFilesize
4KB
-
memory/3724-14-0x0000000001830000-0x0000000001832000-memory.dmpFilesize
8KB
-
memory/3724-27-0x0000000001830000-0x0000000001832000-memory.dmpFilesize
8KB
-
memory/3724-1-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/4700-74-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/4700-53-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4700-70-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/4700-149-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4700-68-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB