sality | ece3ea9e88d7d918cc8b0c53d826b24aca93c642819607d5a3be46f9634b070a

General

Target
ece3ea9e88d7d918cc8b0c53d826b24aca93c642819607d5a3be46f9634b070a.exe
Size 176KB
Sample240610-xtkxfsxdnr
SHA256 ece3ea9e88d7d918cc8b0c53d826b24aca93c642819607d5a3be46f9634b070a
MD5 de79a6122c9aa91ab060205f80b8e4d0
SHA1 17e4987cbe9d96a44b7a3e771d9e30b64675dcc6
SHA512 ac87e1618c80f0b4c1dcaf27163d22f0bba6b0d4b55da01e2b5b7d59e0d4ec4288d7985514e999852c148679ec9ecb56b6ab78b97feedefd887a37bad3b36e05
SSDEEP 3072:VE7RKgUuGN9ylMST2Y+r0Q6/x4kLG9SJmiJ3kp/u684OHqQtnX:VE7mN9woVoxHiUUiNOu684OHqQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif

Signatures

Modifies firewall policy service 2 TTPs 3 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	ece3ea9e88d7d918cc8b0c53d826b24aca93c642819607d5a3be46f9634b070a.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	ece3ea9e88d7d918cc8b0c53d826b24aca93c642819607d5a3be46f9634b070a.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	ece3ea9e88d7d918cc8b0c53d826b24aca93c642819607d5a3be46f9634b070a.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ece3ea9e88d7d918cc8b0c53d826b24aca93c642819607d5a3be46f9634b070a.exe

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	ece3ea9e88d7d918cc8b0c53d826b24aca93c642819607d5a3be46f9634b070a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	ece3ea9e88d7d918cc8b0c53d826b24aca93c642819607d5a3be46f9634b070a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	ece3ea9e88d7d918cc8b0c53d826b24aca93c642819607d5a3be46f9634b070a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	ece3ea9e88d7d918cc8b0c53d826b24aca93c642819607d5a3be46f9634b070a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	ece3ea9e88d7d918cc8b0c53d826b24aca93c642819607d5a3be46f9634b070a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	ece3ea9e88d7d918cc8b0c53d826b24aca93c642819607d5a3be46f9634b070a.exe

Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 3 IoCs

resource	yara_rule
behavioral2/memory/1848-1-0x0000000002310000-0x00000000033CA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/1848-5-0x0000000002310000-0x00000000033CA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine
behavioral2/memory/1848-3-0x0000000002310000-0x00000000033CA000-memory.dmp	INDICATOR_EXE_Packed_SimplePolyEngine

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/1848-1-0x0000000002310000-0x00000000033CA000-memory.dmp	UPX
behavioral2/memory/1848-5-0x0000000002310000-0x00000000033CA000-memory.dmp	UPX
behavioral2/memory/1848-3-0x0000000002310000-0x00000000033CA000-memory.dmp	UPX
behavioral2/memory/1848-7-0x0000000000400000-0x0000000000430000-memory.dmp	UPX

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1848-1-0x0000000002310000-0x00000000033CA000-memory.dmp	upx
behavioral2/memory/1848-5-0x0000000002310000-0x00000000033CA000-memory.dmp	upx
behavioral2/memory/1848-3-0x0000000002310000-0x00000000033CA000-memory.dmp	upx

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	ece3ea9e88d7d918cc8b0c53d826b24aca93c642819607d5a3be46f9634b070a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	ece3ea9e88d7d918cc8b0c53d826b24aca93c642819607d5a3be46f9634b070a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	ece3ea9e88d7d918cc8b0c53d826b24aca93c642819607d5a3be46f9634b070a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	ece3ea9e88d7d918cc8b0c53d826b24aca93c642819607d5a3be46f9634b070a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	ece3ea9e88d7d918cc8b0c53d826b24aca93c642819607d5a3be46f9634b070a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	ece3ea9e88d7d918cc8b0c53d826b24aca93c642819607d5a3be46f9634b070a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	ece3ea9e88d7d918cc8b0c53d826b24aca93c642819607d5a3be46f9634b070a.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ece3ea9e88d7d918cc8b0c53d826b24aca93c642819607d5a3be46f9634b070a.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\e57e966	ece3ea9e88d7d918cc8b0c53d826b24aca93c642819607d5a3be46f9634b070a.exe
File opened for modification	C:\Windows\SYSTEM.INI	ece3ea9e88d7d918cc8b0c53d826b24aca93c642819607d5a3be46f9634b070a.exe

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ece3ea9e88d7d918cc8b0c53d826b24aca93c642819607d5a3be46f9634b070a.exe

C:\Users\Admin\AppData\Local\Temp\ece3ea9e88d7d918cc8b0c53d826b24aca93c642819607d5a3be46f9634b070a.exe
"C:\Users\Admin\AppData\Local\Temp\ece3ea9e88d7d918cc8b0c53d826b24aca93c642819607d5a3be46f9634b070a.exe"
1⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System policy modification
PID:1848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2268 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:8
1⤵
PID:1196