sality | 0ab9b4361d5a9477a10cd5f519dccd4d8051f11e42f68499f4de682b46728d16

General

Target

9da8dc6ea4dff5fc6fd253fb07ea2ad0_NeikiAnalytics.dll
Size

120KB
MD5

9da8dc6ea4dff5fc6fd253fb07ea2ad0
SHA1

9e1397bbfe62548dd6848bfe69efde2ca8f82075
SHA256

0ab9b4361d5a9477a10cd5f519dccd4d8051f11e42f68499f4de682b46728d16
SHA512

0c3e5b9f0059b422e0b17dec792f12a10e4df94ad4885e70f682e54752cc767fac0ce7228d82b432125e815bbbb118104abea1ff1699e1f20daec833c5750d70
SSDEEP

3072:LOYquyjQuTEUE9ULBw4oMq/fhr/oEVGx:L1VyEuAj92w4obfhrQyK

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

Modifies firewall policy service 2 TTPs 3 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Processes:

e574f39.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	e574f39.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	e574f39.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	e574f39.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality
UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1548.002

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

e574f39.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e574f39.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e574f39.exe

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

e574f39.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e574f39.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e574f39.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e574f39.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e574f39.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e574f39.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e574f39.exe

Executes dropped EXE 3 IoCs

Processes:

e574f39.exee575081.exee577639.exe

pid process

4848 e574f39.exe
400 e575081.exe
1064 e577639.exe

pid	process
4848	e574f39.exe
400	e575081.exe
1064	e577639.exe

UPX packed file 24 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4848-6-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/4848-10-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/4848-9-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/4848-17-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/4848-32-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/4848-11-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/4848-18-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/4848-26-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/4848-37-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/4848-38-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/4848-36-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/4848-33-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/4848-39-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/4848-40-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/4848-41-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/4848-60-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/4848-61-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/4848-63-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/4848-64-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/4848-67-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/4848-68-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/4848-70-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/4848-72-0x00000000007B0000-0x000000000186A000-memory.dmp	upx
behavioral2/memory/4848-78-0x00000000007B0000-0x000000000186A000-memory.dmp	upx

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

e574f39.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	e574f39.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	e574f39.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	e574f39.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	e574f39.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	e574f39.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	e574f39.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	e574f39.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

e574f39.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e574f39.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e574f39.exe

Enumerates connected drives 3 TTPs 9 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

e574f39.exe

description	ioc	process
File opened (read-only)	\??\G:	e574f39.exe
File opened (read-only)	\??\H:	e574f39.exe
File opened (read-only)	\??\I:	e574f39.exe
File opened (read-only)	\??\J:	e574f39.exe
File opened (read-only)	\??\M:	e574f39.exe
File opened (read-only)	\??\E:	e574f39.exe
File opened (read-only)	\??\K:	e574f39.exe
File opened (read-only)	\??\L:	e574f39.exe
File opened (read-only)	\??\N:	e574f39.exe

Drops file in Program Files directory 3 IoCs

Processes:

e574f39.exe

description	ioc	process
File opened for modification	C:\Program Files\7-Zip\7z.exe	e574f39.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	e574f39.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	e574f39.exe

Drops file in Windows directory 2 IoCs

Processes:

e574f39.exe

description ioc process

File created C:\Windows\e574f78 e574f39.exe
File opened for modification C:\Windows\SYSTEM.INI e574f39.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

e574f39.exe

pid process

4848 e574f39.exe
4848 e574f39.exe
4848 e574f39.exe
4848 e574f39.exe

description	ioc	process
File created	C:\Windows\e574f78	e574f39.exe
File opened for modification	C:\Windows\SYSTEM.INI	e574f39.exe

pid	process
4848	e574f39.exe
4848	e574f39.exe
4848	e574f39.exe
4848	e574f39.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

e574f39.exe

description	pid	process
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe
Token: SeDebugPrivilege	4848	e574f39.exe

Suspicious use of WriteProcessMemory 53 IoCs

Processes:

rundll32.exerundll32.exee574f39.exe

description	pid	process	target process
PID 652 wrote to memory of 2336	652	rundll32.exe	rundll32.exe
PID 652 wrote to memory of 2336	652	rundll32.exe	rundll32.exe
PID 652 wrote to memory of 2336	652	rundll32.exe	rundll32.exe
PID 2336 wrote to memory of 4848	2336	rundll32.exe	e574f39.exe
PID 2336 wrote to memory of 4848	2336	rundll32.exe	e574f39.exe
PID 2336 wrote to memory of 4848	2336	rundll32.exe	e574f39.exe
PID 4848 wrote to memory of 772	4848	e574f39.exe	fontdrvhost.exe
PID 4848 wrote to memory of 780	4848	e574f39.exe	fontdrvhost.exe
PID 4848 wrote to memory of 316	4848	e574f39.exe	dwm.exe
PID 4848 wrote to memory of 2612	4848	e574f39.exe	sihost.exe
PID 4848 wrote to memory of 2628	4848	e574f39.exe	svchost.exe
PID 4848 wrote to memory of 2900	4848	e574f39.exe	taskhostw.exe
PID 4848 wrote to memory of 3564	4848	e574f39.exe	Explorer.EXE
PID 4848 wrote to memory of 3664	4848	e574f39.exe	svchost.exe
PID 4848 wrote to memory of 3868	4848	e574f39.exe	DllHost.exe
PID 4848 wrote to memory of 3964	4848	e574f39.exe	StartMenuExperienceHost.exe
PID 4848 wrote to memory of 4024	4848	e574f39.exe	RuntimeBroker.exe
PID 4848 wrote to memory of 768	4848	e574f39.exe	SearchApp.exe
PID 4848 wrote to memory of 4124	4848	e574f39.exe	RuntimeBroker.exe
PID 4848 wrote to memory of 4524	4848	e574f39.exe	RuntimeBroker.exe
PID 4848 wrote to memory of 2916	4848	e574f39.exe	TextInputHost.exe
PID 4848 wrote to memory of 4376	4848	e574f39.exe	backgroundTaskHost.exe
PID 4848 wrote to memory of 652	4848	e574f39.exe	rundll32.exe
PID 4848 wrote to memory of 2336	4848	e574f39.exe	rundll32.exe
PID 4848 wrote to memory of 2336	4848	e574f39.exe	rundll32.exe
PID 2336 wrote to memory of 400	2336	rundll32.exe	e575081.exe
PID 2336 wrote to memory of 400	2336	rundll32.exe	e575081.exe
PID 2336 wrote to memory of 400	2336	rundll32.exe	e575081.exe
PID 2336 wrote to memory of 1064	2336	rundll32.exe	e577639.exe
PID 2336 wrote to memory of 1064	2336	rundll32.exe	e577639.exe
PID 2336 wrote to memory of 1064	2336	rundll32.exe	e577639.exe
PID 4848 wrote to memory of 772	4848	e574f39.exe	fontdrvhost.exe
PID 4848 wrote to memory of 780	4848	e574f39.exe	fontdrvhost.exe
PID 4848 wrote to memory of 316	4848	e574f39.exe	dwm.exe
PID 4848 wrote to memory of 2612	4848	e574f39.exe	sihost.exe
PID 4848 wrote to memory of 2628	4848	e574f39.exe	svchost.exe
PID 4848 wrote to memory of 2900	4848	e574f39.exe	taskhostw.exe
PID 4848 wrote to memory of 3564	4848	e574f39.exe	Explorer.EXE
PID 4848 wrote to memory of 3664	4848	e574f39.exe	svchost.exe
PID 4848 wrote to memory of 3868	4848	e574f39.exe	DllHost.exe
PID 4848 wrote to memory of 3964	4848	e574f39.exe	StartMenuExperienceHost.exe
PID 4848 wrote to memory of 4024	4848	e574f39.exe	RuntimeBroker.exe
PID 4848 wrote to memory of 768	4848	e574f39.exe	SearchApp.exe
PID 4848 wrote to memory of 4124	4848	e574f39.exe	RuntimeBroker.exe
PID 4848 wrote to memory of 4524	4848	e574f39.exe	RuntimeBroker.exe
PID 4848 wrote to memory of 2916	4848	e574f39.exe	TextInputHost.exe
PID 4848 wrote to memory of 4376	4848	e574f39.exe	backgroundTaskHost.exe
PID 4848 wrote to memory of 400	4848	e574f39.exe	e575081.exe
PID 4848 wrote to memory of 400	4848	e574f39.exe	e575081.exe
PID 4848 wrote to memory of 396	4848	e574f39.exe	RuntimeBroker.exe
PID 4848 wrote to memory of 436	4848	e574f39.exe	RuntimeBroker.exe
PID 4848 wrote to memory of 1064	4848	e574f39.exe	e577639.exe
PID 4848 wrote to memory of 1064	4848	e574f39.exe	e577639.exe

System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

e574f39.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e574f39.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e574f39.exe

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:772

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:780

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:316

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2628

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2900

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3564

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9da8dc6ea4dff5fc6fd253fb07ea2ad0_NeikiAnalytics.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:652

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9da8dc6ea4dff5fc6fd253fb07ea2ad0_NeikiAnalytics.dll,#1
3⤵
- Suspicious use of WriteProcessMemory
PID:2336

C:\Users\Admin\AppData\Local\Temp\e574f39.exe
C:\Users\Admin\AppData\Local\Temp\e574f39.exe
4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4848

C:\Users\Admin\AppData\Local\Temp\e575081.exe
C:\Users\Admin\AppData\Local\Temp\e575081.exe
4⤵
- Executes dropped EXE
PID:400

C:\Users\Admin\AppData\Local\Temp\e577639.exe
C:\Users\Admin\AppData\Local\Temp\e577639.exe
4⤵
- Executes dropped EXE
PID:1064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3664

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3868

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3964

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4024

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:768

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4124

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4524

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:2916

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:4376

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:396

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:436

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Defense Evasion

Modify Registry

5

T1112

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

3

T1562

Disable or Modify Tools

3

T1562.001

Credential Access

Discovery

System Information Discovery

2

T1082

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\e574f39.exe
Filesize
97KB

MD5
51de760e39f29cb0c5341463737b351d

SHA1
6fb12948b4e3afc7403c416add8716a56bf085d3

SHA256
cf70535b617a8db4f17448aea1c508739849a7761f8eefde029369344f027872

SHA512
46da291bc8095d366e737807ec30af55c310ccec7405e8204bed9ced25a54a31078a4c014361f60261d64162359b2d94963e3346e7d4670534c11ff2a0826501

Download Submit
memory/400-57-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/400-52-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/400-97-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/400-53-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/400-35-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1064-58-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/1064-56-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/1064-55-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/1064-50-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1064-101-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2336-4-0x0000000010000000-0x0000000010020000-memory.dmp

Filesize
128KB

Download
memory/2336-23-0x00000000045B0000-0x00000000045B2000-memory.dmp

Filesize
8KB

Download
memory/2336-28-0x00000000045B0000-0x00000000045B2000-memory.dmp

Filesize
8KB

Download
memory/2336-27-0x0000000004640000-0x0000000004641000-memory.dmp

Filesize
4KB

Download
memory/2336-19-0x00000000045B0000-0x00000000045B2000-memory.dmp

Filesize
8KB

Download
memory/4848-33-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/4848-9-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/4848-26-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/4848-37-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/4848-38-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/4848-36-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/4848-18-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/4848-39-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/4848-40-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/4848-41-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/4848-29-0x0000000001970000-0x0000000001972000-memory.dmp

Filesize
8KB

Download
memory/4848-11-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/4848-34-0x0000000001970000-0x0000000001972000-memory.dmp

Filesize
8KB

Download
memory/4848-32-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/4848-17-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/4848-22-0x0000000001980000-0x0000000001981000-memory.dmp

Filesize
4KB

Download
memory/4848-10-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/4848-60-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/4848-61-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/4848-63-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/4848-64-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/4848-67-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/4848-68-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/4848-70-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/4848-72-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/4848-82-0x0000000001970000-0x0000000001972000-memory.dmp

Filesize
8KB

Download
memory/4848-78-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/4848-93-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4848-6-0x00000000007B0000-0x000000000186A000-memory.dmp

Filesize
16.7MB

Download
memory/4848-5-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads