Analysis
-
max time kernel
26s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
28-05-2024 21:31
General
-
Target
2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe
-
Size
11.5MB
-
MD5
6a2839b47bde6cb093f618cfd6fe63a4
-
SHA1
f892a7537f9cb00cb1c5b1aefe8652b59aed818c
-
SHA256
eca844e81be6c7c82a329dfb4d31bc61a7d6b82e64758cb1cdbf15450910d686
-
SHA512
010a5e7b4bf8a649529745d1fd0ccb4712c7c6047e6bc916a5b4145f8fcb44ed98dce34e9e47b02a9d1da84c02db42a38bc5df2c8f713650775874e8ee523812
-
SSDEEP
98304:rSy3mKysr9uBx4WZTvyqL+R6ZiFLOAkGkzdnEVomFHKnPLc96hxvWbrtUTrUHO23:rjB2AqL+RPFLOyomFHKnPLcAx+NcIOA
Score
10/10
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
-
Sality
Sality is backdoor written in C++, first discovered in 2003.
-
UAC bypass 3 TTPs 2 IoCs
-
Windows security bypass 2 TTPs 12 IoCs
-
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 39 IoCs
-
UPX dump on OEP (original entry point) 40 IoCs
-
Disables RegEdit via registry modification 2 IoCs
-
Disables Task Manager via registry modification
-
Deletes itself 1 IoCs
-
UPX packed file 38 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Windows security modification 2 TTPs 7 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Windows directory 1 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 58 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-28_6a2839b47bde6cb093f618cfd6fe63a4_darpapox_icedid_nymaim.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Deletes itself
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 8363⤵
- Program crash
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2984 -ip 29841⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SYSTEM.INIFilesize
257B
MD5bd2db8131d1807e69481d25f03424ec5
SHA16d72c52c0d0d477c2630f2db32436af9b81713d0
SHA25620bdc3adba2756f89501d714a1f71e723f9856262fa8daf55f1a80284e428f0b
SHA5126749df393ccbc4e30dd147b9c3c89933e1ec350fc185523648d4c809274b500cbdced197873b054ff01001e821209d8c6fbd30e19d286fdeb1cf16ebe2df5d3b
-
F:\ucql.pifFilesize
100KB
MD57b92ce7d1d3bd0aa3ed1b23d0868475e
SHA131bf1063d1eaae164ac72f51886bcf178d984049
SHA256d0a2e4889f0330ae74cdc5505cd5da50efc319e1ae37d3fc97fbc1a600e9d740
SHA5124b6a4f8989b3d79d8cbe6c240de733d59793e5a53397bd6b3884fd26364af19b1c4a6ef4279869b0292a30b2a6f1a73efcf5573c63894b66a50afd33a1cc3a9a
-
memory/2984-0-0x0000000002B40000-0x0000000003BCE000-memory.dmpFilesize
16.6MB
-
memory/2984-2-0x0000000002B40000-0x0000000003BCE000-memory.dmpFilesize
16.6MB
-
memory/2984-13-0x0000000000FE0000-0x0000000000FE2000-memory.dmpFilesize
8KB
-
memory/2984-12-0x0000000002B40000-0x0000000003BCE000-memory.dmpFilesize
16.6MB
-
memory/2984-5-0x0000000002B40000-0x0000000003BCE000-memory.dmpFilesize
16.6MB
-
memory/2984-15-0x0000000002B40000-0x0000000003BCE000-memory.dmpFilesize
16.6MB
-
memory/2984-14-0x0000000002B40000-0x0000000003BCE000-memory.dmpFilesize
16.6MB
-
memory/2984-17-0x0000000000FE0000-0x0000000000FE2000-memory.dmpFilesize
8KB
-
memory/2984-16-0x0000000002B40000-0x0000000003BCE000-memory.dmpFilesize
16.6MB
-
memory/2984-3-0x0000000002B40000-0x0000000003BCE000-memory.dmpFilesize
16.6MB
-
memory/2984-9-0x00000000047D0000-0x00000000047D1000-memory.dmpFilesize
4KB
-
memory/2984-8-0x0000000000FE0000-0x0000000000FE2000-memory.dmpFilesize
8KB
-
memory/2984-7-0x0000000000400000-0x0000000000DB0000-memory.dmpFilesize
9.7MB
-
memory/2984-4-0x0000000002B40000-0x0000000003BCE000-memory.dmpFilesize
16.6MB
-
memory/2984-20-0x0000000002B40000-0x0000000003BCE000-memory.dmpFilesize
16.6MB
-
memory/2984-31-0x0000000000400000-0x0000000000DB0000-memory.dmpFilesize
9.7MB
-
memory/4852-36-0x0000000002DD0000-0x0000000003E5E000-memory.dmpFilesize
16.6MB
-
memory/4852-45-0x0000000002DD0000-0x0000000003E5E000-memory.dmpFilesize
16.6MB
-
memory/4852-19-0x0000000001010000-0x0000000001012000-memory.dmpFilesize
8KB
-
memory/4852-32-0x0000000002DD0000-0x0000000003E5E000-memory.dmpFilesize
16.6MB
-
memory/4852-34-0x0000000002DD0000-0x0000000003E5E000-memory.dmpFilesize
16.6MB
-
memory/4852-35-0x0000000002DD0000-0x0000000003E5E000-memory.dmpFilesize
16.6MB
-
memory/4852-11-0x00000000010A0000-0x00000000010A1000-memory.dmpFilesize
4KB
-
memory/4852-37-0x0000000002DD0000-0x0000000003E5E000-memory.dmpFilesize
16.6MB
-
memory/4852-38-0x0000000002DD0000-0x0000000003E5E000-memory.dmpFilesize
16.6MB
-
memory/4852-39-0x0000000002DD0000-0x0000000003E5E000-memory.dmpFilesize
16.6MB
-
memory/4852-40-0x0000000002DD0000-0x0000000003E5E000-memory.dmpFilesize
16.6MB
-
memory/4852-41-0x0000000002DD0000-0x0000000003E5E000-memory.dmpFilesize
16.6MB
-
memory/4852-42-0x0000000002DD0000-0x0000000003E5E000-memory.dmpFilesize
16.6MB
-
memory/4852-43-0x0000000002DD0000-0x0000000003E5E000-memory.dmpFilesize
16.6MB
-
memory/4852-44-0x0000000002DD0000-0x0000000003E5E000-memory.dmpFilesize
16.6MB
-
memory/4852-18-0x0000000001010000-0x0000000001012000-memory.dmpFilesize
8KB
-
memory/4852-46-0x0000000002DD0000-0x0000000003E5E000-memory.dmpFilesize
16.6MB
-
memory/4852-48-0x0000000002DD0000-0x0000000003E5E000-memory.dmpFilesize
16.6MB
-
memory/4852-49-0x0000000002DD0000-0x0000000003E5E000-memory.dmpFilesize
16.6MB
-
memory/4852-50-0x0000000002DD0000-0x0000000003E5E000-memory.dmpFilesize
16.6MB
-
memory/4852-52-0x0000000002DD0000-0x0000000003E5E000-memory.dmpFilesize
16.6MB
-
memory/4852-53-0x0000000002DD0000-0x0000000003E5E000-memory.dmpFilesize
16.6MB
-
memory/4852-55-0x0000000002DD0000-0x0000000003E5E000-memory.dmpFilesize
16.6MB
-
memory/4852-57-0x0000000002DD0000-0x0000000003E5E000-memory.dmpFilesize
16.6MB
-
memory/4852-60-0x0000000002DD0000-0x0000000003E5E000-memory.dmpFilesize
16.6MB
-
memory/4852-62-0x0000000002DD0000-0x0000000003E5E000-memory.dmpFilesize
16.6MB
-
memory/4852-64-0x0000000002DD0000-0x0000000003E5E000-memory.dmpFilesize
16.6MB
-
memory/4852-66-0x0000000002DD0000-0x0000000003E5E000-memory.dmpFilesize
16.6MB
-
memory/4852-68-0x0000000002DD0000-0x0000000003E5E000-memory.dmpFilesize
16.6MB
-
memory/4852-70-0x0000000002DD0000-0x0000000003E5E000-memory.dmpFilesize
16.6MB
-
memory/4852-87-0x0000000001010000-0x0000000001012000-memory.dmpFilesize
8KB
-
memory/4852-95-0x0000000002DD0000-0x0000000003E5E000-memory.dmpFilesize
16.6MB