Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
-
submitted
26-05-2024 22:27
General
-
Target
64b8f9f5155aa3633e1b47d5ac57f6a23aa44e90ba56f66291143e1df0a91701.dll
-
Size
120KB
-
MD5
133048d2d075e9ff4e0fd9089ed893cf
-
SHA1
91e35dc46302f298a32aae165e6e7a890bebad18
-
SHA256
64b8f9f5155aa3633e1b47d5ac57f6a23aa44e90ba56f66291143e1df0a91701
-
SHA512
004dd1257b00472e9e59bf0004211268f5269c583cfec7f53e5fbdcb0ffa9cab8f8f2c34e9ecda3682acd5d32e928575824147642902eb1b2196994ac1e94156
-
SSDEEP
1536:lNnP5boe/Pml0jmbdqid9LsyFoeWEdPBrrKDIZZJScmgrWZSTpKc61fzxR8su5jL:vP1Pmijmbpd9wyFogDYZcd/61fzxU
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
-
Sality
Sality is backdoor written in C++, first discovered in 2003.
-
UAC bypass 3 TTPs 2 IoCs
-
Windows security bypass 2 TTPs 12 IoCs
-
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 23 IoCs
-
UPX dump on OEP (original entry point) 28 IoCs
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 6 IoCs
-
UPX packed file 23 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Windows security modification 2 TTPs 14 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Enumerates connected drives 3 TTPs 11 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Windows directory 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 41 IoCs
-
Suspicious use of WriteProcessMemory 36 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\64b8f9f5155aa3633e1b47d5ac57f6a23aa44e90ba56f66291143e1df0a91701.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\64b8f9f5155aa3633e1b47d5ac57f6a23aa44e90ba56f66291143e1df0a91701.dll,#13⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f760d4a.exeC:\Users\Admin\AppData\Local\Temp\f760d4a.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
-
C:\Users\Admin\AppData\Local\Temp\f760ec0.exeC:\Users\Admin\AppData\Local\Temp\f760ec0.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
-
C:\Users\Admin\AppData\Local\Temp\f763459.exeC:\Users\Admin\AppData\Local\Temp\f763459.exe4⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD51c437a0aaf995f65cc3b52bb0a4387e1
SHA1e457459f94a890ac9c7ba1dc5965606b94e64ffc
SHA256f4ff13d41a047786d625618879b69c7dd0af9913f152b9cf837464e5e7e84328
SHA51204ef873a2f1e2a4983f0aa17ab8e50ddde5a57ab1bef903fa17d8860cdd08ba9b96ac7f9392a2daa45d8785e95c31d37eca3375e6e2b08c4a27a6491c1c38e1f
-
Filesize
97KB
MD5c6534e4d01ef1521b3ede7141bd42467
SHA19eb969dd67ac882fc209769efb0c751eaa0762c0
SHA256d8085917b693eaaa6c27a7bbcf1dd7d405baf75d577d9d9e31bbef9bd875edae
SHA5124134abe047e316899ce5400b73106fb34330715ef79f0a07b7642e4355ea5f87f150643e8561787cebb6efc72b1ad3d63652cd20c019f3ec767561300679fa79
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
72KB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
8KB
-
Filesize
72KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
8KB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
72KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
128KB
-
Filesize
72KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
72KB
-
Filesize
4KB
-
Filesize
72KB
-
Filesize
8KB
-
Filesize
72KB
-
Filesize
8KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
4KB
-
Filesize
16.7MB
-
Filesize
8KB
-
Filesize
16.7MB
-
Filesize
8KB