Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
29-05-2024 02:04
General
-
Target
c48e1c16baf853b2b4c0fb81711f5eb2bcac9d5ee970376facfb4efb0d094e28.dll
-
Size
120KB
-
MD5
4ea451f141767fdcb54c553e43e8334e
-
SHA1
eb947bdf0258435b1882277c8f490ab055f24ff9
-
SHA256
c48e1c16baf853b2b4c0fb81711f5eb2bcac9d5ee970376facfb4efb0d094e28
-
SHA512
c939489f875dc8114f0aad8caef8595d0d1d77113c89ad4be9c0848bb239db48288e98aa70bc467d20e7f3b2991586cac10ce4c2500b08ad097deab351066b03
-
SSDEEP
3072:6daWzpyumPP7u8Q7ApWaDcn64LD/+1S31WAsGiq:6da8UK8QzsW6im1tfGiq
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
-
Sality
Sality is backdoor written in C++, first discovered in 2003.
-
UAC bypass 3 TTPs 2 IoCs
-
Windows security bypass 2 TTPs 12 IoCs
-
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 25 IoCs
-
UPX dump on OEP (original entry point) 29 IoCs
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 6 IoCs
-
UPX packed file 25 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Windows security modification 2 TTPs 14 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Windows directory 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 21 IoCs
-
Suspicious use of WriteProcessMemory 33 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c48e1c16baf853b2b4c0fb81711f5eb2bcac9d5ee970376facfb4efb0d094e28.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c48e1c16baf853b2b4c0fb81711f5eb2bcac9d5ee970376facfb4efb0d094e28.dll,#13⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f7624cf.exeC:\Users\Admin\AppData\Local\Temp\f7624cf.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
-
C:\Users\Admin\AppData\Local\Temp\f7626f1.exeC:\Users\Admin\AppData\Local\Temp\f7626f1.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- System policy modification
-
-
C:\Users\Admin\AppData\Local\Temp\f76403b.exeC:\Users\Admin\AppData\Local\Temp\f76403b.exe4⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD524aaee46cf3ab522b078794ed301e3a9
SHA1a9d48245ad25d8391a336a40d853ce0393be74f1
SHA2562c626e8ae2b71a0f3790c2613878941768a4a1b2ba95b7fd7ea107444691c80a
SHA51209c8ea71c059fcbbf041cb8aa66dbc748b8a74cb82430fad66e17aa6b56f3733dbea9b0d346d35bd56ded06797609c2f604c14b4c42b6047d92befa679d20406
-
Filesize
97KB
MD5b1ba97b6047d9c2548b063bad821f165
SHA1a55d510a548bcdcd80c33aefb80061391b46295d
SHA256bdd1c11e3f9953598057367301cc33ccbb080846f8851a127a60b9417306ca38
SHA5122a40ad1269c8843f8ec0d303713f703de8fe6d84101ff8afb8b99f67938531893d7bf7c765a1ad7de328ed998995d37af8bb6053c18108cd021ef3d2a643bc57
-
Filesize
8KB
-
Filesize
16.7MB
-
Filesize
72KB
-
Filesize
16.7MB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
72KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
8KB
-
Filesize
72KB
-
Filesize
4KB
-
Filesize
128KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
4KB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
8KB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
8KB
-
Filesize
72KB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
72KB