sality | b9c3adeb63e6be94b581a68b3b675737501283db663484bfc7e14bdecfc7e940

General

Target

dil.exe
Size

104KB
MD5

1c4eae5ef3e10ce0676618418ea9ed65
SHA1

26e7f992746b0e9b783d360c8cf9e475bd1ce015
SHA256

b9c3adeb63e6be94b581a68b3b675737501283db663484bfc7e14bdecfc7e940
SHA512

d459f72f5403941a7c1666dc91911446ac608faba8cae0a44ab8a2324536ed8db25f5a8c9e80cfcffd09df61a541ba181f94545404e62cf23f5e67e896bc2645
SSDEEP

1536:sKSowsA2YQWZzF90K/m2eMJN6tOwSDW7tyQPjccFl3kvQhMuJlAGGk/l:s1JsACe3uNM6tXb7tyOjtb3OQrEDW

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Signatures

Modifies firewall policy service 3 TTPs 3 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

dil.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	dil.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	dil.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	dil.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality
UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1548.002

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

dil.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" dil.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dil.exe

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

dil.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	dil.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	dil.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	dil.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	dil.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	dil.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	dil.exe

UPX packed file 41 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1672-1-0x0000000002190000-0x000000000321E000-memory.dmp	upx
behavioral2/memory/1672-8-0x0000000002190000-0x000000000321E000-memory.dmp	upx
behavioral2/memory/1672-7-0x0000000002190000-0x000000000321E000-memory.dmp	upx
behavioral2/memory/1672-12-0x0000000002190000-0x000000000321E000-memory.dmp	upx
behavioral2/memory/1672-9-0x0000000002190000-0x000000000321E000-memory.dmp	upx
behavioral2/memory/1672-5-0x0000000002190000-0x000000000321E000-memory.dmp	upx
behavioral2/memory/1672-13-0x0000000002190000-0x000000000321E000-memory.dmp	upx
behavioral2/memory/1672-3-0x0000000002190000-0x000000000321E000-memory.dmp	upx
behavioral2/memory/1672-6-0x0000000002190000-0x000000000321E000-memory.dmp	upx
behavioral2/memory/1672-16-0x0000000002190000-0x000000000321E000-memory.dmp	upx
behavioral2/memory/1672-17-0x0000000002190000-0x000000000321E000-memory.dmp	upx
behavioral2/memory/1672-18-0x0000000002190000-0x000000000321E000-memory.dmp	upx
behavioral2/memory/1672-19-0x0000000002190000-0x000000000321E000-memory.dmp	upx
behavioral2/memory/1672-20-0x0000000002190000-0x000000000321E000-memory.dmp	upx
behavioral2/memory/1672-22-0x0000000002190000-0x000000000321E000-memory.dmp	upx
behavioral2/memory/1672-23-0x0000000002190000-0x000000000321E000-memory.dmp	upx
behavioral2/memory/1672-24-0x0000000002190000-0x000000000321E000-memory.dmp	upx
behavioral2/memory/1672-26-0x0000000002190000-0x000000000321E000-memory.dmp	upx
behavioral2/memory/1672-27-0x0000000002190000-0x000000000321E000-memory.dmp	upx
behavioral2/memory/1672-29-0x0000000002190000-0x000000000321E000-memory.dmp	upx
behavioral2/memory/1672-31-0x0000000002190000-0x000000000321E000-memory.dmp	upx
behavioral2/memory/1672-33-0x0000000002190000-0x000000000321E000-memory.dmp	upx
behavioral2/memory/1672-35-0x0000000002190000-0x000000000321E000-memory.dmp	upx
behavioral2/memory/1672-37-0x0000000002190000-0x000000000321E000-memory.dmp	upx
behavioral2/memory/1672-39-0x0000000002190000-0x000000000321E000-memory.dmp	upx
behavioral2/memory/1672-40-0x0000000002190000-0x000000000321E000-memory.dmp	upx
behavioral2/memory/1672-42-0x0000000002190000-0x000000000321E000-memory.dmp	upx
behavioral2/memory/1672-44-0x0000000002190000-0x000000000321E000-memory.dmp	upx
behavioral2/memory/1672-45-0x0000000002190000-0x000000000321E000-memory.dmp	upx
behavioral2/memory/1672-51-0x0000000002190000-0x000000000321E000-memory.dmp	upx
behavioral2/memory/1672-54-0x0000000002190000-0x000000000321E000-memory.dmp	upx
behavioral2/memory/1672-55-0x0000000002190000-0x000000000321E000-memory.dmp	upx
behavioral2/memory/1672-58-0x0000000002190000-0x000000000321E000-memory.dmp	upx
behavioral2/memory/1672-59-0x0000000002190000-0x000000000321E000-memory.dmp	upx
behavioral2/memory/1672-60-0x0000000002190000-0x000000000321E000-memory.dmp	upx
behavioral2/memory/1672-61-0x0000000002190000-0x000000000321E000-memory.dmp	upx
behavioral2/memory/1672-62-0x0000000002190000-0x000000000321E000-memory.dmp	upx
behavioral2/memory/1672-64-0x0000000002190000-0x000000000321E000-memory.dmp	upx
behavioral2/memory/1672-67-0x0000000002190000-0x000000000321E000-memory.dmp	upx
behavioral2/memory/1672-69-0x0000000002190000-0x000000000321E000-memory.dmp	upx
behavioral2/memory/1672-70-0x0000000002190000-0x000000000321E000-memory.dmp	upx

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

dil.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	dil.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	dil.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	dil.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	dil.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	dil.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	dil.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	dil.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

dil.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" dil.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dil.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

dil.exe

description	ioc	process
File opened (read-only)	\??\E:	dil.exe
File opened (read-only)	\??\G:	dil.exe
File opened (read-only)	\??\I:	dil.exe
File opened (read-only)	\??\O:	dil.exe
File opened (read-only)	\??\Q:	dil.exe
File opened (read-only)	\??\W:	dil.exe
File opened (read-only)	\??\H:	dil.exe
File opened (read-only)	\??\K:	dil.exe
File opened (read-only)	\??\M:	dil.exe
File opened (read-only)	\??\N:	dil.exe
File opened (read-only)	\??\P:	dil.exe
File opened (read-only)	\??\R:	dil.exe
File opened (read-only)	\??\V:	dil.exe
File opened (read-only)	\??\Z:	dil.exe
File opened (read-only)	\??\J:	dil.exe
File opened (read-only)	\??\S:	dil.exe
File opened (read-only)	\??\X:	dil.exe
File opened (read-only)	\??\L:	dil.exe
File opened (read-only)	\??\T:	dil.exe
File opened (read-only)	\??\U:	dil.exe
File opened (read-only)	\??\Y:	dil.exe

Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media
T1091

Processes:

dil.exe

description ioc process

File opened for modification C:\autorun.inf dil.exe
File opened for modification F:\autorun.inf dil.exe

description	ioc	process
File opened for modification	C:\autorun.inf	dil.exe
File opened for modification	F:\autorun.inf	dil.exe

Drops file in Program Files directory 12 IoCs

Processes:

dil.exe

description	ioc	process
File opened for modification	C:\PROGRAM FILES\7-ZIP\Uninstall.exe	dil.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	dil.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe	dil.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe	dil.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe	dil.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe	dil.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe	dil.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe	dil.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7z.exe	dil.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7zFM.exe	dil.exe
File opened for modification	C:\PROGRAM FILES\7-ZIP\7zG.exe	dil.exe
File opened for modification	C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe	dil.exe

Drops file in Windows directory 1 IoCs

Processes:

dil.exe

description ioc process

File opened for modification C:\Windows\SYSTEM.INI dil.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

dil.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings dil.exe

description	ioc	process
File opened for modification	C:\Windows\SYSTEM.INI	dil.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	dil.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

Processes:

dil.exe

pid	process
1672	dil.exe
1672	dil.exe
1672	dil.exe
1672	dil.exe
1672	dil.exe
1672	dil.exe
1672	dil.exe
1672	dil.exe
1672	dil.exe
1672	dil.exe
1672	dil.exe
1672	dil.exe
1672	dil.exe
1672	dil.exe
1672	dil.exe
1672	dil.exe
1672	dil.exe
1672	dil.exe
1672	dil.exe
1672	dil.exe
1672	dil.exe
1672	dil.exe
1672	dil.exe
1672	dil.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

dil.exe

description	pid	process
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe
Token: SeDebugPrivilege	1672	dil.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

dil.exe

description	pid	process	target process
PID 1672 wrote to memory of 788	1672	dil.exe	fontdrvhost.exe
PID 1672 wrote to memory of 796	1672	dil.exe	fontdrvhost.exe
PID 1672 wrote to memory of 60	1672	dil.exe	dwm.exe
PID 1672 wrote to memory of 2644	1672	dil.exe	sihost.exe
PID 1672 wrote to memory of 2748	1672	dil.exe	svchost.exe
PID 1672 wrote to memory of 2968	1672	dil.exe	taskhostw.exe
PID 1672 wrote to memory of 3420	1672	dil.exe	Explorer.EXE
PID 1672 wrote to memory of 3560	1672	dil.exe	svchost.exe
PID 1672 wrote to memory of 3752	1672	dil.exe	DllHost.exe
PID 1672 wrote to memory of 3876	1672	dil.exe	StartMenuExperienceHost.exe
PID 1672 wrote to memory of 3960	1672	dil.exe	RuntimeBroker.exe
PID 1672 wrote to memory of 4036	1672	dil.exe	SearchApp.exe
PID 1672 wrote to memory of 3844	1672	dil.exe	RuntimeBroker.exe
PID 1672 wrote to memory of 4616	1672	dil.exe	TextInputHost.exe
PID 1672 wrote to memory of 4380	1672	dil.exe	RuntimeBroker.exe
PID 1672 wrote to memory of 788	1672	dil.exe	fontdrvhost.exe
PID 1672 wrote to memory of 796	1672	dil.exe	fontdrvhost.exe
PID 1672 wrote to memory of 60	1672	dil.exe	dwm.exe
PID 1672 wrote to memory of 2644	1672	dil.exe	sihost.exe
PID 1672 wrote to memory of 2748	1672	dil.exe	svchost.exe
PID 1672 wrote to memory of 2968	1672	dil.exe	taskhostw.exe
PID 1672 wrote to memory of 3420	1672	dil.exe	Explorer.EXE
PID 1672 wrote to memory of 3560	1672	dil.exe	svchost.exe
PID 1672 wrote to memory of 3752	1672	dil.exe	DllHost.exe
PID 1672 wrote to memory of 3876	1672	dil.exe	StartMenuExperienceHost.exe
PID 1672 wrote to memory of 3960	1672	dil.exe	RuntimeBroker.exe
PID 1672 wrote to memory of 4036	1672	dil.exe	SearchApp.exe
PID 1672 wrote to memory of 3844	1672	dil.exe	RuntimeBroker.exe
PID 1672 wrote to memory of 4616	1672	dil.exe	TextInputHost.exe
PID 1672 wrote to memory of 4380	1672	dil.exe	RuntimeBroker.exe
PID 1672 wrote to memory of 788	1672	dil.exe	fontdrvhost.exe
PID 1672 wrote to memory of 796	1672	dil.exe	fontdrvhost.exe
PID 1672 wrote to memory of 60	1672	dil.exe	dwm.exe
PID 1672 wrote to memory of 2644	1672	dil.exe	sihost.exe
PID 1672 wrote to memory of 2748	1672	dil.exe	svchost.exe
PID 1672 wrote to memory of 2968	1672	dil.exe	taskhostw.exe
PID 1672 wrote to memory of 3420	1672	dil.exe	Explorer.EXE
PID 1672 wrote to memory of 3560	1672	dil.exe	svchost.exe
PID 1672 wrote to memory of 3752	1672	dil.exe	DllHost.exe
PID 1672 wrote to memory of 3876	1672	dil.exe	StartMenuExperienceHost.exe
PID 1672 wrote to memory of 3960	1672	dil.exe	RuntimeBroker.exe
PID 1672 wrote to memory of 4036	1672	dil.exe	SearchApp.exe
PID 1672 wrote to memory of 3844	1672	dil.exe	RuntimeBroker.exe
PID 1672 wrote to memory of 4616	1672	dil.exe	TextInputHost.exe
PID 1672 wrote to memory of 4380	1672	dil.exe	RuntimeBroker.exe
PID 1672 wrote to memory of 788	1672	dil.exe	fontdrvhost.exe
PID 1672 wrote to memory of 796	1672	dil.exe	fontdrvhost.exe
PID 1672 wrote to memory of 60	1672	dil.exe	dwm.exe
PID 1672 wrote to memory of 2644	1672	dil.exe	sihost.exe
PID 1672 wrote to memory of 2748	1672	dil.exe	svchost.exe
PID 1672 wrote to memory of 2968	1672	dil.exe	taskhostw.exe
PID 1672 wrote to memory of 3420	1672	dil.exe	Explorer.EXE
PID 1672 wrote to memory of 3560	1672	dil.exe	svchost.exe
PID 1672 wrote to memory of 3752	1672	dil.exe	DllHost.exe
PID 1672 wrote to memory of 3876	1672	dil.exe	StartMenuExperienceHost.exe
PID 1672 wrote to memory of 3960	1672	dil.exe	RuntimeBroker.exe
PID 1672 wrote to memory of 4036	1672	dil.exe	SearchApp.exe
PID 1672 wrote to memory of 3844	1672	dil.exe	RuntimeBroker.exe
PID 1672 wrote to memory of 4616	1672	dil.exe	TextInputHost.exe
PID 1672 wrote to memory of 4380	1672	dil.exe	RuntimeBroker.exe
PID 1672 wrote to memory of 788	1672	dil.exe	fontdrvhost.exe
PID 1672 wrote to memory of 796	1672	dil.exe	fontdrvhost.exe
PID 1672 wrote to memory of 60	1672	dil.exe	dwm.exe
PID 1672 wrote to memory of 2644	1672	dil.exe	sihost.exe

System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

dil.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" dil.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dil.exe

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:788

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:796

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:60

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2748

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2968

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3420

C:\Users\Admin\AppData\Local\Temp\dil.exe
"C:\Users\Admin\AppData\Local\Temp\dil.exe"
2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3560

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3752

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3876

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3960

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4036

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3844

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:4616

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4380

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Replication Through Removable Media

1

T1091

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Defense Evasion

Modify Registry

5

T1112

Impair Defenses

4

T1562

Disable or Modify Tools

3

T1562.001

Disable or Modify System Firewall

1

T1562.004

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Credential Access

Discovery

System Information Discovery

3

T1082

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

Lateral Movement

Replication Through Removable Media

1

T1091

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

F:\slpm.exe
Filesize
100KB

MD5
33a3f9158599153d387e1bbe2018f4b8

SHA1
0bb34212d4f0eb8f30aee8af67fb8391c0ace343

SHA256
44f546a034fcea930761d319daf23f6b2230d920e53919b6c2536a98ccf959f9

SHA512
ae6ce4b50144c6be44f2f9f5a79fe4df0e2dfed801af30e712f8ea9ad389a4a68419957f8d4de24b55f0e17e78439664c3a88c0d4014ba005a96630aaeb84448

Download Submit
memory/1672-29-0x0000000002190000-0x000000000321E000-memory.dmp

Filesize
16.6MB

Download
memory/1672-64-0x0000000002190000-0x000000000321E000-memory.dmp

Filesize
16.6MB

Download
memory/1672-7-0x0000000002190000-0x000000000321E000-memory.dmp

Filesize
16.6MB

Download
memory/1672-14-0x0000000003270000-0x0000000003272000-memory.dmp

Filesize
8KB

Download
memory/1672-15-0x0000000003270000-0x0000000003272000-memory.dmp

Filesize
8KB

Download
memory/1672-12-0x0000000002190000-0x000000000321E000-memory.dmp

Filesize
16.6MB

Download
memory/1672-9-0x0000000002190000-0x000000000321E000-memory.dmp

Filesize
16.6MB

Download
memory/1672-5-0x0000000002190000-0x000000000321E000-memory.dmp

Filesize
16.6MB

Download
memory/1672-11-0x0000000004110000-0x0000000004111000-memory.dmp

Filesize
4KB

Download
memory/1672-10-0x0000000003270000-0x0000000003272000-memory.dmp

Filesize
8KB

Download
memory/1672-13-0x0000000002190000-0x000000000321E000-memory.dmp

Filesize
16.6MB

Download
memory/1672-3-0x0000000002190000-0x000000000321E000-memory.dmp

Filesize
16.6MB

Download
memory/1672-6-0x0000000002190000-0x000000000321E000-memory.dmp

Filesize
16.6MB

Download
memory/1672-16-0x0000000002190000-0x000000000321E000-memory.dmp

Filesize
16.6MB

Download
memory/1672-17-0x0000000002190000-0x000000000321E000-memory.dmp

Filesize
16.6MB

Download
memory/1672-18-0x0000000002190000-0x000000000321E000-memory.dmp

Filesize
16.6MB

Download
memory/1672-19-0x0000000002190000-0x000000000321E000-memory.dmp

Filesize
16.6MB

Download
memory/1672-20-0x0000000002190000-0x000000000321E000-memory.dmp

Filesize
16.6MB

Download
memory/1672-22-0x0000000002190000-0x000000000321E000-memory.dmp

Filesize
16.6MB

Download
memory/1672-23-0x0000000002190000-0x000000000321E000-memory.dmp

Filesize
16.6MB

Download
memory/1672-24-0x0000000002190000-0x000000000321E000-memory.dmp

Filesize
16.6MB

Download
memory/1672-26-0x0000000002190000-0x000000000321E000-memory.dmp

Filesize
16.6MB

Download
memory/1672-70-0x0000000002190000-0x000000000321E000-memory.dmp

Filesize
16.6MB

Download
memory/1672-8-0x0000000002190000-0x000000000321E000-memory.dmp

Filesize
16.6MB

Download
memory/1672-37-0x0000000002190000-0x000000000321E000-memory.dmp

Filesize
16.6MB

Download
memory/1672-33-0x0000000002190000-0x000000000321E000-memory.dmp

Filesize
16.6MB

Download
memory/1672-35-0x0000000002190000-0x000000000321E000-memory.dmp

Filesize
16.6MB

Download
memory/1672-31-0x0000000002190000-0x000000000321E000-memory.dmp

Filesize
16.6MB

Download
memory/1672-39-0x0000000002190000-0x000000000321E000-memory.dmp

Filesize
16.6MB

Download
memory/1672-40-0x0000000002190000-0x000000000321E000-memory.dmp

Filesize
16.6MB

Download
memory/1672-42-0x0000000002190000-0x000000000321E000-memory.dmp

Filesize
16.6MB

Download
memory/1672-44-0x0000000002190000-0x000000000321E000-memory.dmp

Filesize
16.6MB

Download
memory/1672-45-0x0000000002190000-0x000000000321E000-memory.dmp

Filesize
16.6MB

Download
memory/1672-51-0x0000000002190000-0x000000000321E000-memory.dmp

Filesize
16.6MB

Download
memory/1672-54-0x0000000002190000-0x000000000321E000-memory.dmp

Filesize
16.6MB

Download
memory/1672-55-0x0000000002190000-0x000000000321E000-memory.dmp

Filesize
16.6MB

Download
memory/1672-58-0x0000000002190000-0x000000000321E000-memory.dmp

Filesize
16.6MB

Download
memory/1672-59-0x0000000002190000-0x000000000321E000-memory.dmp

Filesize
16.6MB

Download
memory/1672-60-0x0000000002190000-0x000000000321E000-memory.dmp

Filesize
16.6MB

Download
memory/1672-61-0x0000000002190000-0x000000000321E000-memory.dmp

Filesize
16.6MB

Download
memory/1672-62-0x0000000002190000-0x000000000321E000-memory.dmp

Filesize
16.6MB

Download
memory/1672-0-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1672-67-0x0000000002190000-0x000000000321E000-memory.dmp

Filesize
16.6MB

Download
memory/1672-68-0x0000000003270000-0x0000000003272000-memory.dmp

Filesize
8KB

Download
memory/1672-69-0x0000000002190000-0x000000000321E000-memory.dmp

Filesize
16.6MB

Download
memory/1672-27-0x0000000002190000-0x000000000321E000-memory.dmp

Filesize
16.6MB

Download
memory/1672-1-0x0000000002190000-0x000000000321E000-memory.dmp

Filesize
16.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads