Overview

overview

10

Static

static

3

599ba59f51...32.exe

windows7-x64

10

599ba59f51...32.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    50s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    17-06-2024 17:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    599ba59f51a3bb9db2dc7a572df715182d049fefa829e6ff6debdd38d20b7632.exe

  • Size

    708KB

  • MD5

    a7073a3267e29df0e36f16760942c4da

  • SHA1

    9fb42b03685673a6936643673036a0832b90d039

  • SHA256

    599ba59f51a3bb9db2dc7a572df715182d049fefa829e6ff6debdd38d20b7632

  • SHA512

    b7323bc3de45540cec738cf94b87bd6cb942e889126ca9f680731f1899ef95ab90cbd0fa240b562cbb9c9c4d275f29173e85accbfc183a39045e0c70ff358419

  • SSDEEP

    12288:lJFZqYMOaQ0q9nV/zsnK23KHVI6nodVdyMLiqyVcxwtVxgpMiuzOTIfwj7LD5fe:zFZqhOBnVyK23C6OoYMLiVcKtVx4Miu9

Score
10/10
salitybackdoorbootkitevasionpersistencetrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Signatures

  • Modifies firewall policy service 2 TTPs 6 IoCs
    evasion
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality
  • UAC bypass 3 TTPs 2 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 12 IoCs
    evasiontrojan
  • Deletes itself 1 IoCs
  • UPX packed file 25 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Windows security modification 2 TTPs 7 IoCs
    evasiontrojan
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 57 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in Windows directory 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1116
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1172
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
          PID:1208
          • C:\Users\Admin\AppData\Local\Temp\599ba59f51a3bb9db2dc7a572df715182d049fefa829e6ff6debdd38d20b7632.exe
            "C:\Users\Admin\AppData\Local\Temp\599ba59f51a3bb9db2dc7a572df715182d049fefa829e6ff6debdd38d20b7632.exe"
            2⤵
            • Modifies firewall policy service
            • UAC bypass
            • Windows security bypass
            • Windows security modification
            • Checks whether UAC is enabled
            • Enumerates connected drives
            • Writes to the Master Boot Record (MBR)
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:1728
            • C:\Windows\SysWOW64\explorer.exe
              explorer.exe "http://localhost:80"
              3⤵
                PID:2840
          • C:\Windows\system32\DllHost.exe
            C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
            1⤵
              PID:1756
            • C:\Windows\explorer.exe
              C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
              1⤵
              • Suspicious use of WriteProcessMemory
              PID:2624
              • C:\Program Files\Internet Explorer\iexplore.exe
                "C:\Program Files\Internet Explorer\iexplore.exe" http://localhost/
                2⤵
                • Modifies Internet Explorer settings
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:2524
                • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2524 CREDAT:275457 /prefetch:2
                  3⤵
                  • Modifies firewall policy service
                  • UAC bypass
                  • Windows security bypass
                  • Deletes itself
                  • Enumerates connected drives
                  • Modifies Internet Explorer settings
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:2980

            Network

            MITRE ATT&CK Matrix ATT&CK v13

            Initial Access

            Execution

            Persistence

            Create or Modify System Process

            1
            T1543

            Windows Service

            1
            T1543.003

            Pre-OS Boot

            1
            T1542

            Bootkit

            1
            T1542.003

            Privilege Escalation

            Create or Modify System Process

            1
            T1543

            Windows Service

            1
            T1543.003

            Abuse Elevation Control Mechanism

            1
            T1548

            Bypass User Account Control

            1
            T1548.002

            Defense Evasion

            Modify Registry

            6
            T1112

            Abuse Elevation Control Mechanism

            1
            T1548

            Bypass User Account Control

            1
            T1548.002

            Impair Defenses

            3
            T1562

            Disable or Modify Tools

            3
            T1562.001

            Pre-OS Boot

            1
            T1542

            Bootkit

            1
            T1542.003

            Credential Access

            Discovery

            System Information Discovery

            2
            T1082

            Query Registry

            1
            T1012

            Peripheral Device Discovery

            1
            T1120

            Lateral Movement

            Collection

            Exfiltration

            Command and Control

            Impact

            Resource Development

            Reconnaissance

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\0F7622CC_Rar\599ba59f51a3bb9db2dc7a572df715182d049fefa829e6ff6debdd38d20b7632.exe
              Filesize

              635KB

              MD5

              4b7fdcc9f207e2fcd1227b0f58f2631f

              SHA1

              f4fef2e3d310494a3c3962a49c7c5a9ea072b2ea

              SHA256

              12407535426bc2951f8f462cc0ffba79763de8a5fc1ee42a532b804263771e00

              SHA512

              5a9f9f8d7e685fb10ba3f464cffd3178218a51749fde054071aa03fb04915ae3257538abbe8608ad134fb0319d3a43f19281253839053d85990b9518cd916bf1

              Download Submit
            • C:\Users\Admin\AppData\Local\Temp\ridhg.exe
              Filesize

              741B

              MD5

              25aa9bb549ecc7bb6100f8d179452508

              SHA1

              a3bea5e2138d1558109fa26d46e2f79c3a20228f

              SHA256

              df83a0d6940600e4c4954f4874fcd4dd73e781e6690c3bf56f51c95285484a3c

              SHA512

              12e26fa999faf2ca017a49987be5c668930495c26c789e19863097e5b0555add90ecdbb397521436acb47d7f2dfd5029b9b4beed16877ac7df854b3321642e37

              Download Submit
            • C:\Windows\SYSTEM.INI
              Filesize

              257B

              MD5

              fae003797d2120545e9ec3d0e768eb75

              SHA1

              d4c0f6af4f163c9cc935da61425779f0ec7a653b

              SHA256

              a7e01b09e916a5bf2cc27afe5a57e4124cd2b74d0449bdd4f8c534fc20991851

              SHA512

              35c4e33376d7e7e4790b8ff39c3dc9941bfd4435aafe09573e2962eadd3a22aa008783c885df9971dd644c34763369a2227165461edefaf3120ba59555da63e4

              Download Submit
            • C:\umlmww.pif
              Filesize

              96KB

              MD5

              fb3cd54ce9e6843b6e87a19d08d10172

              SHA1

              07870d02a68608f305d006d0c2bf72beee7d753c

              SHA256

              88f8cadc3cdf943c2f9bb624303183f01c72649bd0ba9de830297916130e4447

              SHA512

              285366583127937ad65cc0ee2dcb9845f7206b396dc337fbea9b7c146b2b622ec3f881a1946072c4e0798ea064679f5dcab5cb41e5be17b6bad653b4d324d44a

              Download Submit
            • memory/1116-14-0x0000000002070000-0x0000000002072000-memory.dmp
              Filesize

              8KB

              Download
            • memory/1728-35-0x0000000001F10000-0x0000000002F9E000-memory.dmp
              Filesize

              16.6MB

              Download
            • memory/1728-48-0x0000000001F10000-0x0000000002F9E000-memory.dmp
              Filesize

              16.6MB

              Download
            • memory/1728-4-0x0000000001F10000-0x0000000002F9E000-memory.dmp
              Filesize

              16.6MB

              Download
            • memory/1728-11-0x0000000001F10000-0x0000000002F9E000-memory.dmp
              Filesize

              16.6MB

              Download
            • memory/1728-6-0x0000000001F10000-0x0000000002F9E000-memory.dmp
              Filesize

              16.6MB

              Download
            • memory/1728-13-0x0000000001F10000-0x0000000002F9E000-memory.dmp
              Filesize

              16.6MB

              Download
            • memory/1728-26-0x00000000002D0000-0x00000000002D2000-memory.dmp
              Filesize

              8KB

              Download
            • memory/1728-25-0x00000000002E0000-0x00000000002E1000-memory.dmp
              Filesize

              4KB

              Download
            • memory/1728-23-0x00000000002E0000-0x00000000002E1000-memory.dmp
              Filesize

              4KB

              Download
            • memory/1728-22-0x00000000002D0000-0x00000000002D2000-memory.dmp
              Filesize

              8KB

              Download
            • memory/1728-9-0x0000000001F10000-0x0000000002F9E000-memory.dmp
              Filesize

              16.6MB

              Download
            • memory/1728-12-0x0000000001F10000-0x0000000002F9E000-memory.dmp
              Filesize

              16.6MB

              Download
            • memory/1728-29-0x0000000075920000-0x0000000075921000-memory.dmp
              Filesize

              4KB

              Download
            • memory/1728-30-0x0000000075910000-0x0000000075A00000-memory.dmp
              Filesize

              960KB

              Download
            • memory/1728-31-0x0000000075910000-0x0000000075A00000-memory.dmp
              Filesize

              960KB

              Download
            • memory/1728-32-0x0000000075910000-0x0000000075A00000-memory.dmp
              Filesize

              960KB

              Download
            • memory/1728-34-0x0000000075910000-0x0000000075A00000-memory.dmp
              Filesize

              960KB

              Download
            • memory/1728-0-0x0000000000400000-0x00000000005A9000-memory.dmp
              Filesize

              1.7MB

              Download
            • memory/1728-36-0x0000000001F10000-0x0000000002F9E000-memory.dmp
              Filesize

              16.6MB

              Download
            • memory/1728-37-0x0000000001F10000-0x0000000002F9E000-memory.dmp
              Filesize

              16.6MB

              Download
            • memory/1728-47-0x0000000001F10000-0x0000000002F9E000-memory.dmp
              Filesize

              16.6MB

              Download
            • memory/1728-7-0x0000000001F10000-0x0000000002F9E000-memory.dmp
              Filesize

              16.6MB

              Download
            • memory/1728-49-0x0000000001F10000-0x0000000002F9E000-memory.dmp
              Filesize

              16.6MB

              Download
            • memory/1728-51-0x0000000001F10000-0x0000000002F9E000-memory.dmp
              Filesize

              16.6MB

              Download
            • memory/1728-53-0x0000000001F10000-0x0000000002F9E000-memory.dmp
              Filesize

              16.6MB

              Download
            • memory/1728-55-0x0000000001F10000-0x0000000002F9E000-memory.dmp
              Filesize

              16.6MB

              Download
            • memory/1728-56-0x0000000001F10000-0x0000000002F9E000-memory.dmp
              Filesize

              16.6MB

              Download
            • memory/1728-57-0x0000000000400000-0x00000000005A9000-memory.dmp
              Filesize

              1.7MB

              Download
            • memory/1728-76-0x0000000004D40000-0x0000000004D42000-memory.dmp
              Filesize

              8KB

              Download
            • memory/1728-73-0x0000000006360000-0x0000000006361000-memory.dmp
              Filesize

              4KB

              Download
            • memory/1728-77-0x0000000001F10000-0x0000000002F9E000-memory.dmp
              Filesize

              16.6MB

              Download
            • memory/1728-79-0x0000000001F10000-0x0000000002F9E000-memory.dmp
              Filesize

              16.6MB

              Download
            • memory/1728-80-0x0000000075910000-0x0000000075A00000-memory.dmp
              Filesize

              960KB

              Download
            • memory/1728-83-0x0000000001F10000-0x0000000002F9E000-memory.dmp
              Filesize

              16.6MB

              Download
            • memory/1728-90-0x00000000002D0000-0x00000000002D2000-memory.dmp
              Filesize

              8KB

              Download
            • memory/1728-112-0x0000000075910000-0x0000000075A00000-memory.dmp
              Filesize

              960KB

              Download
            • memory/1728-139-0x0000000001F10000-0x0000000002F9E000-memory.dmp
              Filesize

              16.6MB

              Download
            • memory/1728-140-0x0000000075910000-0x0000000075A00000-memory.dmp
              Filesize

              960KB

              Download
            • memory/1728-10-0x0000000001F10000-0x0000000002F9E000-memory.dmp
              Filesize

              16.6MB

              Download
            • memory/1728-5-0x0000000001F10000-0x0000000002F9E000-memory.dmp
              Filesize

              16.6MB

              Download
            • memory/1728-3-0x0000000001F10000-0x0000000002F9E000-memory.dmp
              Filesize

              16.6MB

              Download
            • memory/1728-8-0x0000000001F10000-0x0000000002F9E000-memory.dmp
              Filesize

              16.6MB

              Download