Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    25-06-2024 23:14

General

  • Target

    2144b63ec31b393d8aee7cdbc1cbf3c118887538a1f355ae5a69f4f467bb8b86_NeikiAnalytics.dll

  • Size

    120KB

  • MD5

    98aa396dafc2ee912b50dc318351aa20

  • SHA1

    dc3a0140282acd33c162179c87d86ba9bcf149e5

  • SHA256

    2144b63ec31b393d8aee7cdbc1cbf3c118887538a1f355ae5a69f4f467bb8b86

  • SHA512

    a9088c1f40e5198a2f149e7322099fd08f7564d7d4f4d5cda68ac772d55da4e063293ff69f58eb3afd8e935dda4cbc805455330bae695fcdca99c2e967a044e7

  • SSDEEP

    1536:6yInr5A5o4zK+nuC7CD3qAX1AcbV0DKBmpY3FyeRYCr0wGWwoB3Qzw:6yKa5o6K+t7XAlAc3WYsqnC3M

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

  • Modifies firewall policy service 3 TTPs 6 IoCs
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

  • UAC bypass 3 TTPs 2 IoCs
  • Windows security bypass 2 TTPs 12 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • UPX packed file 23 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Windows security modification 2 TTPs 14 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 9 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 41 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs
  • System policy modification 1 TTPs 2 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1244
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1336
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
          PID:1368
          • C:\Windows\system32\rundll32.exe
            rundll32.exe C:\Users\Admin\AppData\Local\Temp\2144b63ec31b393d8aee7cdbc1cbf3c118887538a1f355ae5a69f4f467bb8b86_NeikiAnalytics.dll,#1
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2440
            • C:\Windows\SysWOW64\rundll32.exe
              rundll32.exe C:\Users\Admin\AppData\Local\Temp\2144b63ec31b393d8aee7cdbc1cbf3c118887538a1f355ae5a69f4f467bb8b86_NeikiAnalytics.dll,#1
              3⤵
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:2296
              • C:\Users\Admin\AppData\Local\Temp\f760a1e.exe
                C:\Users\Admin\AppData\Local\Temp\f760a1e.exe
                4⤵
                • Modifies firewall policy service
                • UAC bypass
                • Windows security bypass
                • Executes dropped EXE
                • Windows security modification
                • Checks whether UAC is enabled
                • Enumerates connected drives
                • Drops file in Windows directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:2024
              • C:\Users\Admin\AppData\Local\Temp\f760bf2.exe
                C:\Users\Admin\AppData\Local\Temp\f760bf2.exe
                4⤵
                • Modifies firewall policy service
                • UAC bypass
                • Windows security bypass
                • Executes dropped EXE
                • Windows security modification
                • Checks whether UAC is enabled
                • Drops file in Windows directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:2700
              • C:\Users\Admin\AppData\Local\Temp\f76259a.exe
                C:\Users\Admin\AppData\Local\Temp\f76259a.exe
                4⤵
                • Executes dropped EXE
                PID:2460
        • C:\Windows\system32\DllHost.exe
          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
          1⤵
            PID:884

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Windows\SYSTEM.INI

            Filesize

            257B

            MD5

            518d8c96e15cd7fcd63c01204f2f4eb0

            SHA1

            c0f09297848c6ab69d903d2ee404482fe4bb44db

            SHA256

            e54304d0482cd847d65a507c9d2d22075805e931044105aa7679219ac07aca5e

            SHA512

            8c507fa3b8944b9fbbf55c1376eb9cc6d026234ae9528ee5438623c6dd1af4b922aaec180ecafa3172c23a4df1717e22fc2e3cd4ac744684fda177039c6fa02a

          • \Users\Admin\AppData\Local\Temp\f760a1e.exe

            Filesize

            97KB

            MD5

            dfe7fe4d446734ba1908ab33da69bb98

            SHA1

            9a445d6b8a6576cb56686fabbe4cbda2d64573fb

            SHA256

            a8284ffdcf60b188c8fd30babf5af57b4febf03504a81cd4da51333d204ca569

            SHA512

            f55d19894672d08641c8de288706365327b77734c9d2a3b1034a2841aee7a0679818a72fd8b33e1f9085c25aa8f13d8463c32023006c3739cf9c43138f3d8ba7

          • memory/1244-29-0x0000000002010000-0x0000000002012000-memory.dmp

            Filesize

            8KB

          • memory/2024-63-0x00000000006B0000-0x000000000176A000-memory.dmp

            Filesize

            16.7MB

          • memory/2024-98-0x00000000006B0000-0x000000000176A000-memory.dmp

            Filesize

            16.7MB

          • memory/2024-20-0x00000000006B0000-0x000000000176A000-memory.dmp

            Filesize

            16.7MB

          • memory/2024-14-0x00000000006B0000-0x000000000176A000-memory.dmp

            Filesize

            16.7MB

          • memory/2024-16-0x00000000006B0000-0x000000000176A000-memory.dmp

            Filesize

            16.7MB

          • memory/2024-23-0x00000000006B0000-0x000000000176A000-memory.dmp

            Filesize

            16.7MB

          • memory/2024-11-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2024-51-0x00000000002B0000-0x00000000002B2000-memory.dmp

            Filesize

            8KB

          • memory/2024-52-0x00000000002B0000-0x00000000002B2000-memory.dmp

            Filesize

            8KB

          • memory/2024-49-0x0000000000300000-0x0000000000301000-memory.dmp

            Filesize

            4KB

          • memory/2024-138-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2024-106-0x00000000006B0000-0x000000000176A000-memory.dmp

            Filesize

            16.7MB

          • memory/2024-105-0x00000000002B0000-0x00000000002B2000-memory.dmp

            Filesize

            8KB

          • memory/2024-19-0x00000000006B0000-0x000000000176A000-memory.dmp

            Filesize

            16.7MB

          • memory/2024-15-0x00000000006B0000-0x000000000176A000-memory.dmp

            Filesize

            16.7MB

          • memory/2024-22-0x00000000006B0000-0x000000000176A000-memory.dmp

            Filesize

            16.7MB

          • memory/2024-21-0x00000000006B0000-0x000000000176A000-memory.dmp

            Filesize

            16.7MB

          • memory/2024-18-0x00000000006B0000-0x000000000176A000-memory.dmp

            Filesize

            16.7MB

          • memory/2024-17-0x00000000006B0000-0x000000000176A000-memory.dmp

            Filesize

            16.7MB

          • memory/2024-102-0x00000000006B0000-0x000000000176A000-memory.dmp

            Filesize

            16.7MB

          • memory/2024-101-0x00000000006B0000-0x000000000176A000-memory.dmp

            Filesize

            16.7MB

          • memory/2024-62-0x00000000006B0000-0x000000000176A000-memory.dmp

            Filesize

            16.7MB

          • memory/2024-100-0x00000000006B0000-0x000000000176A000-memory.dmp

            Filesize

            16.7MB

          • memory/2024-139-0x00000000006B0000-0x000000000176A000-memory.dmp

            Filesize

            16.7MB

          • memory/2024-78-0x00000000006B0000-0x000000000176A000-memory.dmp

            Filesize

            16.7MB

          • memory/2024-64-0x00000000006B0000-0x000000000176A000-memory.dmp

            Filesize

            16.7MB

          • memory/2024-77-0x00000000006B0000-0x000000000176A000-memory.dmp

            Filesize

            16.7MB

          • memory/2296-38-0x00000000001E0000-0x00000000001E2000-memory.dmp

            Filesize

            8KB

          • memory/2296-59-0x00000000001E0000-0x00000000001E2000-memory.dmp

            Filesize

            8KB

          • memory/2296-10-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2296-61-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2296-1-0x0000000010000000-0x0000000010020000-memory.dmp

            Filesize

            128KB

          • memory/2296-73-0x00000000001E0000-0x00000000001E2000-memory.dmp

            Filesize

            8KB

          • memory/2296-39-0x00000000001F0000-0x00000000001F1000-memory.dmp

            Filesize

            4KB

          • memory/2296-9-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2296-48-0x00000000001F0000-0x00000000001F1000-memory.dmp

            Filesize

            4KB

          • memory/2460-97-0x0000000000260000-0x0000000000262000-memory.dmp

            Filesize

            8KB

          • memory/2460-94-0x00000000002B0000-0x00000000002B1000-memory.dmp

            Filesize

            4KB

          • memory/2460-95-0x0000000000260000-0x0000000000262000-memory.dmp

            Filesize

            8KB

          • memory/2460-76-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2460-177-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2700-87-0x0000000000240000-0x0000000000241000-memory.dmp

            Filesize

            4KB

          • memory/2700-173-0x0000000000900000-0x00000000019BA000-memory.dmp

            Filesize

            16.7MB

          • memory/2700-96-0x00000000001B0000-0x00000000001B2000-memory.dmp

            Filesize

            8KB

          • memory/2700-151-0x0000000000900000-0x00000000019BA000-memory.dmp

            Filesize

            16.7MB

          • memory/2700-172-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2700-88-0x00000000001B0000-0x00000000001B2000-memory.dmp

            Filesize

            8KB