Analysis
-
max time kernel
52s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
11-06-2024 00:48
General
-
Target
948b9a0a1289e60bef06a547c6ebb9fb032cfff6c738accc7d9c3b0fb8fdfbd1.dll
-
Size
120KB
-
MD5
4eae6b2e5635ad34d664864e147f0f2d
-
SHA1
145c6cab6f374b929a6aeec8c48e4aac60997876
-
SHA256
948b9a0a1289e60bef06a547c6ebb9fb032cfff6c738accc7d9c3b0fb8fdfbd1
-
SHA512
14f8dca9a8348295c8bcf1b5b5df495d35832ed77c0068c8fb68c8363fb699e1e82f033633ae4dfa4456853583b309bc270841515d52c340ffdc8cd16abc750e
-
SSDEEP
3072:izNK4uqQWvq54EdSV+WTeT1Gun4VdNMA8V2X1zrAE:YK3q/C5rw8pGu43Nu0trAE
Score
10/10
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
-
Sality
Sality is backdoor written in C++, first discovered in 2003.
-
UAC bypass 3 TTPs 2 IoCs
-
Windows security bypass 2 TTPs 12 IoCs
-
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 33 IoCs
-
UPX dump on OEP (original entry point) 37 IoCs
-
Executes dropped EXE 4 IoCs
-
UPX packed file 33 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Windows security modification 2 TTPs 14 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Enumerates connected drives 3 TTPs 14 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 4 IoCs
-
Drops file in Windows directory 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 57 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\948b9a0a1289e60bef06a547c6ebb9fb032cfff6c738accc7d9c3b0fb8fdfbd1.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\948b9a0a1289e60bef06a547c6ebb9fb032cfff6c738accc7d9c3b0fb8fdfbd1.dll,#13⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e574dc2.exeC:\Users\Admin\AppData\Local\Temp\e574dc2.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\e574e8d.exeC:\Users\Admin\AppData\Local\Temp\e574e8d.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\e576987.exeC:\Users\Admin\AppData\Local\Temp\e576987.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\e576997.exeC:\Users\Admin\AppData\Local\Temp\e576997.exe4⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\e574dc2.exeFilesize
97KB
MD5b4eb138de3dd7720bcd792976718bd75
SHA1c81ed62a689dad66deceaed8c0163a54346121a5
SHA2560a15b8d06abf95dba5cc6d951222633fcee11f5b1f240ad039b7551bb89b2fb2
SHA512766230c963a9f9ba62639c13b189d0c722658e34b38a01ef13bebbfb616e1d8603e9f4742286be2bbedef2d76dcd5849e1a3dc36cff3881417da093fca399beb
-
C:\Windows\SYSTEM.INIFilesize
257B
MD5bb81ec616b1027bc22858cb2d9bea29a
SHA1120d83975892b57127079c387cf70d4a3165cc2f
SHA2567a250ab8ad50473deba5f486f976abca07e68809a9b9202793fe5cf65ec3d659
SHA512edaaf90689b752d5474b93b20eb29abe72baa6550616c6535167e0a214ae66f6508ffa185c300fcd6650179c56b233ff365fad551907ef3f790cd9eeb03b4045
-
memory/1316-34-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/1316-79-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/1316-10-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/1316-26-0x0000000003520000-0x0000000003522000-memory.dmpFilesize
8KB
-
memory/1316-5-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1316-33-0x0000000003520000-0x0000000003522000-memory.dmpFilesize
8KB
-
memory/1316-12-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/1316-111-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1316-74-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/1316-20-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/1316-35-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/1316-23-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/1316-102-0x0000000003520000-0x0000000003522000-memory.dmpFilesize
8KB
-
memory/1316-16-0x0000000003E70000-0x0000000003E71000-memory.dmpFilesize
4KB
-
memory/1316-92-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/1316-91-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/1316-11-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/1316-8-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/1316-32-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/1316-6-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/1316-42-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/1316-37-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/1316-38-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/1316-39-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/1316-40-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/1316-36-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/1316-43-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/1316-89-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/1316-88-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/1316-57-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/1316-59-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/1316-60-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/1316-87-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/1316-86-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/1316-83-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/1316-82-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/1316-9-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/1316-76-0x0000000000740000-0x00000000017FA000-memory.dmpFilesize
16.7MB
-
memory/4320-56-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4320-70-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/4320-144-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4320-73-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/4320-67-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/4424-72-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/4424-69-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/4424-24-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4424-63-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/4424-115-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4880-25-0x0000000002770000-0x0000000002772000-memory.dmpFilesize
8KB
-
memory/4880-1-0x0000000010000000-0x0000000010020000-memory.dmpFilesize
128KB
-
memory/4880-13-0x0000000002770000-0x0000000002772000-memory.dmpFilesize
8KB
-
memory/4880-14-0x0000000002800000-0x0000000002801000-memory.dmpFilesize
4KB
-
memory/4880-17-0x0000000002770000-0x0000000002772000-memory.dmpFilesize
8KB
-
memory/5044-71-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/5044-50-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/5044-68-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/5044-139-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/5044-65-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/5044-140-0x0000000000B30000-0x0000000001BEA000-memory.dmpFilesize
16.7MB