Overview

overview

10

Static

static

3

2bae3b6c7c...2f.exe

windows7-x64

10

2bae3b6c7c...2f.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    29s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    10-06-2024 20:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe

  • Size

    327KB

  • MD5

    6d6836a9d6b5f361024c3b8a69bd47bf

  • SHA1

    f940bbf01e03c3dca256cd36b2f5dabc601bd3c4

  • SHA256

    2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f

  • SHA512

    ebff2244be4f1eada9ce81a91175807a15663fe53266af77528dc5780e249e923ddfbfbef02259e5a191f60a2ab3f491c3223c65962f9a5774880d36deaed00a

  • SSDEEP

    6144:XsLqdufVUNDa3S5llllllllllllllllllllllllllllllllllllllllllllllllx:cFUNDa3S5llllllllllllllllllllllh

Score
10/10
salitybackdoorevasionpersistencetrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Signatures

  • Modifies firewall policy service 2 TTPs 6 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality
  • UAC bypass 3 TTPs 2 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 12 IoCs
    evasiontrojan
  • Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 22 IoCs
  • UPX dump on OEP (original entry point) 22 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 7 IoCs
  • UPX packed file 21 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Windows security modification 2 TTPs 14 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 16 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 5 IoCs
  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 52 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1180
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1312
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
          PID:1368
          • C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe
            "C:\Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe"
            2⤵
            • Loads dropped DLL
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2320
            • \??\c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe 
              c:\users\admin\appdata\local\temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe 
              3⤵
              • Modifies firewall policy service
              • UAC bypass
              • Windows security bypass
              • Executes dropped EXE
              • Windows security modification
              • Checks whether UAC is enabled
              • Enumerates connected drives
              • Drops file in Windows directory
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:2216
            • C:\Windows\Resources\Themes\icsys.icn.exe
              C:\Windows\Resources\Themes\icsys.icn.exe
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in Windows directory
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:2232
              • \??\c:\windows\resources\themes\explorer.exe
                c:\windows\resources\themes\explorer.exe
                4⤵
                • Modifies firewall policy service
                • Modifies visiblity of hidden/system files in Explorer
                • UAC bypass
                • Windows security bypass
                • Deletes itself
                • Executes dropped EXE
                • Loads dropped DLL
                • Windows security modification
                • Adds Run key to start application
                • Checks whether UAC is enabled
                • Enumerates connected drives
                • Drops file in System32 directory
                • Drops file in Windows directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: GetForegroundWindowSpam
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:2032
                • \??\c:\windows\resources\spoolsv.exe
                  c:\windows\resources\spoolsv.exe SE
                  5⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Drops file in Windows directory
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:2548
                  • \??\c:\windows\resources\svchost.exe
                    c:\windows\resources\svchost.exe
                    6⤵
                    • Modifies visiblity of hidden/system files in Explorer
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Adds Run key to start application
                    • Drops file in System32 directory
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious behavior: GetForegroundWindowSpam
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:2432
                    • \??\c:\windows\resources\spoolsv.exe
                      c:\windows\resources\spoolsv.exe PR
                      7⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:2456
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 20:21 /f
                      7⤵
                      • Creates scheduled task(s)
                      PID:1112
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 20:22 /f
                      7⤵
                      • Creates scheduled task(s)
                      PID:640
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 20:23 /f
                      7⤵
                      • Creates scheduled task(s)
                      PID:2644
                • C:\Windows\Explorer.exe
                  C:\Windows\Explorer.exe
                  5⤵
                    PID:1904
          • C:\Windows\system32\DllHost.exe
            C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
            1⤵
              PID:460
            • C:\Windows\system32\conhost.exe
              \??\C:\Windows\system32\conhost.exe "-12585533895958160810319371281668936508-845322938354380835-32925554-556094992"
              1⤵
                PID:2332

              Network

              MITRE ATT&CK Matrix ATT&CK v13

              Initial Access

              Execution

              Scheduled Task/Job

              1
              T1053

              Persistence

              Create or Modify System Process

              1
              T1543

              Windows Service

              1
              T1543.003

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Scheduled Task/Job

              1
              T1053

              Privilege Escalation

              Create or Modify System Process

              1
              T1543

              Windows Service

              1
              T1543.003

              Abuse Elevation Control Mechanism

              1
              T1548

              Bypass User Account Control

              1
              T1548.002

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Scheduled Task/Job

              1
              T1053

              Defense Evasion

              Modify Registry

              7
              T1112

              Hide Artifacts

              1
              T1564

              Hidden Files and Directories

              1
              T1564.001

              Abuse Elevation Control Mechanism

              1
              T1548

              Bypass User Account Control

              1
              T1548.002

              Impair Defenses

              3
              T1562

              Disable or Modify Tools

              3
              T1562.001

              Credential Access

              Discovery

              System Information Discovery

              2
              T1082

              Query Registry

              1
              T1012

              Peripheral Device Discovery

              1
              T1120

              Lateral Movement

              Collection

              Exfiltration

              Command and Control

              Impact

              Resource Development

              Reconnaissance

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Windows\Resources\svchost.exe
                Filesize

                135KB

                MD5

                58a09cb3b5da1c50b98e594180213477

                SHA1

                0da72b75d76948a2c8a79ddf28ed95e488e5baf5

                SHA256

                15ea2c75e14ece8644c858a3550f91931aaae32e29f29effe03aaed8b06c85f6

                SHA512

                bc0597f8f4785d7ea941a876b1e1ee438f07b44c74b23dd0d1a7c1b609d9b96c3d9a300f379ff298d7be42d8e5a0786f3612feb4e70872dd0b9e9365f88f532c

                Download Submit
              • C:\Windows\SYSTEM.INI
                Filesize

                256B

                MD5

                4a8a8bdf30ca86c6002d6db121d3157f

                SHA1

                b470d16a14259f1c6db9c1c41cd1510c6c117db4

                SHA256

                0591bcefdd4f012c0fcf0fa919cd94fb1c39c17cf5910b8997be5a098c9cba17

                SHA512

                2bf53377530c98f41740c266eeedce280e9b9769b779dbd81d4f85fc8f48b473d44c3d357b19023aeeba5a149818f78dead38f2ff8d060452dc5e47edd7a711c

                Download Submit
              • C:\vcvd.pif
                Filesize

                100KB

                MD5

                e88fbbf3ada0de81ab0829ad20612cd6

                SHA1

                614732e31327af7ad81c4fd7a10a1b665166acc6

                SHA256

                aadaf7fb9917a173e095f35aeea85fe62e141e307b4691256453c0d638054d29

                SHA512

                d6c1e0246f09beab64ee9bf61b95f9b7003c11be97c302be7f6295a15f2d888a5e348be2e6a53ee26662be4cc5a15a8126ff621ee1081473fe13711d9cc67c46

                Download Submit
              • \Users\Admin\AppData\Local\Temp\2bae3b6c7ccb527e97e722b3288b60320d836c8e6de8ca1ec757ed0602f1322f.exe 
                Filesize

                192KB

                MD5

                44981b4bc4a2a86d97d9daa4dfdc56c9

                SHA1

                34de2285a03a85eabbe026dbde0a832472253df4

                SHA256

                dab149bc4edcc9e8762df554bf96544cc70c0a549598a70f89b5064a4e557e53

                SHA512

                0441f7685f812675ef28db2d622111a4a5a5362a659b553a2ed78a73abeed45580915bd2c5dd0e8ff77df2bab0e46cc60d2dfcd7427f8201c8029b9baf28af98

                Download Submit
              • \Windows\Resources\Themes\explorer.exe
                Filesize

                135KB

                MD5

                08218b37b1eb854e8fd8dd0859c5fe00

                SHA1

                1d5d5a35ff77b1440be0d1cf7214e4427d49e351

                SHA256

                6b99c9c859c38b75a8dbe0fd148a71235bf3d2f69f48663d1195e95526d48608

                SHA512

                c3a94072d5a927d9bfd97997761c3d5a121bbd537b2d6185429d3ffc4fe13be7972efc4db75b2edca5ec63dbf178ac83028d171610aaace66656b6084615c0c0

                Download Submit
              • \Windows\Resources\Themes\icsys.icn.exe
                Filesize

                135KB

                MD5

                10bf281bd01dcdf7759c981fbf652071

                SHA1

                3954d13520598847ba6e907cf3a62b47c7ec75e1

                SHA256

                603f4b2906e73b7a46d7312ae7441a8596817a67e8985030c782d109445f8812

                SHA512

                91aaf2618eba99f6964b2e38d2735589a09c538342359ffb66161a72322b58d4e789ed09ccda771f8f519c63bbfaec2b87720bd2cc5837c1c24d7bbc589d1d1f

                Download Submit
              • \Windows\Resources\spoolsv.exe
                Filesize

                135KB

                MD5

                04afaf1c88170ff539ad04a5bb66cd45

                SHA1

                cadd3a6e44b1cd9a5b9a3520bc824d5a8b4b2d50

                SHA256

                5b1cb6251026aa49115068179b6ea1838ea3141f648079be8492e2400452071b

                SHA512

                d99a06b7e211f77ab8ebbc3ab9b0260f0dafc36e7d44d969c871ea1f2d90e686a252c5009d58fc61fa1566bb16306c0d40ee8fe7906d701d3505579d7c344d9a

                Download Submit
              • memory/1180-39-0x0000000001B40000-0x0000000001B42000-memory.dmp
                Filesize

                8KB

                Download
              • memory/2032-76-0x0000000000270000-0x000000000028F000-memory.dmp
                Filesize

                124KB

                Download
              • memory/2216-32-0x0000000000610000-0x000000000169E000-memory.dmp
                Filesize

                16.6MB

                Download
              • memory/2216-112-0x0000000000610000-0x000000000169E000-memory.dmp
                Filesize

                16.6MB

                Download
              • memory/2216-29-0x0000000000610000-0x000000000169E000-memory.dmp
                Filesize

                16.6MB

                Download
              • memory/2216-28-0x0000000000610000-0x000000000169E000-memory.dmp
                Filesize

                16.6MB

                Download
              • memory/2216-36-0x0000000000610000-0x000000000169E000-memory.dmp
                Filesize

                16.6MB

                Download
              • memory/2216-187-0x0000000000610000-0x000000000169E000-memory.dmp
                Filesize

                16.6MB

                Download
              • memory/2216-186-0x0000000000400000-0x0000000000431000-memory.dmp
                Filesize

                196KB

                Download
              • memory/2216-122-0x0000000000610000-0x000000000169E000-memory.dmp
                Filesize

                16.6MB

                Download
              • memory/2216-31-0x0000000000610000-0x000000000169E000-memory.dmp
                Filesize

                16.6MB

                Download
              • memory/2216-27-0x0000000000610000-0x000000000169E000-memory.dmp
                Filesize

                16.6MB

                Download
              • memory/2216-65-0x00000000004A0000-0x00000000004A2000-memory.dmp
                Filesize

                8KB

                Download
              • memory/2216-64-0x0000000000610000-0x000000000169E000-memory.dmp
                Filesize

                16.6MB

                Download
              • memory/2216-123-0x0000000000610000-0x000000000169E000-memory.dmp
                Filesize

                16.6MB

                Download
              • memory/2216-121-0x00000000004A0000-0x00000000004A2000-memory.dmp
                Filesize

                8KB

                Download
              • memory/2216-37-0x0000000000610000-0x000000000169E000-memory.dmp
                Filesize

                16.6MB

                Download
              • memory/2216-120-0x0000000000610000-0x000000000169E000-memory.dmp
                Filesize

                16.6MB

                Download
              • memory/2216-61-0x00000000004A0000-0x00000000004A2000-memory.dmp
                Filesize

                8KB

                Download
              • memory/2216-118-0x0000000000610000-0x000000000169E000-memory.dmp
                Filesize

                16.6MB

                Download
              • memory/2216-54-0x0000000000500000-0x0000000000501000-memory.dmp
                Filesize

                4KB

                Download
              • memory/2216-116-0x0000000000610000-0x000000000169E000-memory.dmp
                Filesize

                16.6MB

                Download
              • memory/2216-115-0x0000000000610000-0x000000000169E000-memory.dmp
                Filesize

                16.6MB

                Download
              • memory/2216-113-0x0000000000610000-0x000000000169E000-memory.dmp
                Filesize

                16.6MB

                Download
              • memory/2216-30-0x0000000000610000-0x000000000169E000-memory.dmp
                Filesize

                16.6MB

                Download
              • memory/2216-93-0x0000000000610000-0x000000000169E000-memory.dmp
                Filesize

                16.6MB

                Download
              • memory/2216-111-0x0000000000610000-0x000000000169E000-memory.dmp
                Filesize

                16.6MB

                Download
              • memory/2216-95-0x0000000000610000-0x000000000169E000-memory.dmp
                Filesize

                16.6MB

                Download
              • memory/2232-58-0x0000000000270000-0x0000000000271000-memory.dmp
                Filesize

                4KB

                Download
              • memory/2232-63-0x0000000000250000-0x0000000000252000-memory.dmp
                Filesize

                8KB

                Download
              • memory/2232-106-0x0000000000400000-0x000000000041F000-memory.dmp
                Filesize

                124KB

                Download
              • memory/2232-103-0x0000000000250000-0x0000000000252000-memory.dmp
                Filesize

                8KB

                Download
              • memory/2232-67-0x0000000000250000-0x0000000000252000-memory.dmp
                Filesize

                8KB

                Download
              • memory/2320-48-0x00000000003E0000-0x00000000003E1000-memory.dmp
                Filesize

                4KB

                Download
              • memory/2320-46-0x00000000001F0000-0x00000000001F2000-memory.dmp
                Filesize

                8KB

                Download
              • memory/2320-47-0x00000000003E0000-0x00000000003E1000-memory.dmp
                Filesize

                4KB

                Download
              • memory/2320-110-0x0000000000400000-0x000000000041F000-memory.dmp
                Filesize

                124KB

                Download
              • memory/2320-0-0x0000000000400000-0x000000000041F000-memory.dmp
                Filesize

                124KB

                Download
              • memory/2320-62-0x00000000001F0000-0x00000000001F2000-memory.dmp
                Filesize

                8KB

                Download
              • memory/2320-66-0x00000000001F0000-0x00000000001F2000-memory.dmp
                Filesize

                8KB

                Download
              • memory/2320-107-0x00000000001F0000-0x00000000001F2000-memory.dmp
                Filesize

                8KB

                Download
              • memory/2320-18-0x00000000002A0000-0x00000000002BF000-memory.dmp
                Filesize

                124KB

                Download
              • memory/2320-7-0x00000000002A0000-0x00000000002D1000-memory.dmp
                Filesize

                196KB

                Download
              • memory/2456-101-0x0000000000400000-0x000000000041F000-memory.dmp
                Filesize

                124KB

                Download
              • memory/2548-88-0x0000000000310000-0x000000000032F000-memory.dmp
                Filesize

                124KB

                Download
              • memory/2548-102-0x0000000000400000-0x000000000041F000-memory.dmp
                Filesize

                124KB

                Download