Overview

overview

10

Static

static

3

0cf7e1c3ef...05.exe

windows7-x64

10

0cf7e1c3ef...05.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    123s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    19/07/2024, 09:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0cf7e1c3efbe6b365efbc513c2ba80b9a93fe9de5241ef030f01fd99574a5e05.exe

  • Size

    124KB

  • MD5

    9a1ab17165e7479a824fff589f61ff4c

  • SHA1

    3e113fde76fd0132f92ba18d8eca697925d1ded3

  • SHA256

    0cf7e1c3efbe6b365efbc513c2ba80b9a93fe9de5241ef030f01fd99574a5e05

  • SHA512

    3af303a03dd9a63dd0efddbf8f56944c5654467ca440e67843253d2461458b9836c8dc678315c347a491b9fc901ec431e166c2ac9f7d40eb2e06e11ad89c86a8

  • SSDEEP

    1536:A3SHmLKarIpY/LcP50Gb8Tfp804Xel9hx5r6XOcCaWuG3rgQSw8O:AkF3p8LchVYW0Uel9hD6XvCduVQth

Score
10/10
salitybackdoorevasiontrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

  • Modifies firewall policy service 3 TTPs 3 IoCs
    evasion
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality
  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 6 IoCs
    evasiontrojan
  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 25 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Windows security modification 2 TTPs 7 IoCs
    evasiontrojan
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 42 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 23 IoCs
  • Suspicious use of AdjustPrivilegeToken 31 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1116
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1172
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
          PID:1208
          • C:\Users\Admin\AppData\Local\Temp\0cf7e1c3efbe6b365efbc513c2ba80b9a93fe9de5241ef030f01fd99574a5e05.exe
            "C:\Users\Admin\AppData\Local\Temp\0cf7e1c3efbe6b365efbc513c2ba80b9a93fe9de5241ef030f01fd99574a5e05.exe"
            2⤵
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:2708
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c C:\Users\Admin\AppData\Local\Temp\$$a754F.bat
              3⤵
              • Deletes itself
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:2748
              • C:\Users\Admin\AppData\Local\Temp\0cf7e1c3efbe6b365efbc513c2ba80b9a93fe9de5241ef030f01fd99574a5e05.exe
                "C:\Users\Admin\AppData\Local\Temp\0cf7e1c3efbe6b365efbc513c2ba80b9a93fe9de5241ef030f01fd99574a5e05.exe"
                4⤵
                • Modifies firewall policy service
                • UAC bypass
                • Windows security bypass
                • Executes dropped EXE
                • Windows security modification
                • Checks whether UAC is enabled
                • Enumerates connected drives
                • Drops autorun.inf file
                • Drops file in Windows directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:1324
            • C:\Windows\Logo1_.exe
              C:\Windows\Logo1_.exe
              3⤵
              • Executes dropped EXE
              • Enumerates connected drives
              • Drops file in Program Files directory
              • Drops file in Windows directory
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:2424
              • C:\Windows\SysWOW64\net.exe
                net stop "Kingsoft AntiVirus Service"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:2900
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                  5⤵
                    PID:2712
          • C:\Windows\system32\DllHost.exe
            C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
            1⤵
              PID:848
            • C:\Windows\system32\conhost.exe
              \??\C:\Windows\system32\conhost.exe "1286549379-5854605411942578434-783410810-2026872515818333064-133925999816119696"
              1⤵
                PID:2724

              Network

              MITRE ATT&CK Enterprise v15

              Reconnaissance

              Resource Development

              Initial Access

              Replication Through Removable Media

              1
              T1091

              Execution

              Persistence

              Create or Modify System Process

              1
              T1543

              Windows Service

              1
              T1543.003

              Privilege Escalation

              Abuse Elevation Control Mechanism

              1
              T1548

              Bypass User Account Control

              1
              T1548.002

              Create or Modify System Process

              1
              T1543

              Windows Service

              1
              T1543.003

              Defense Evasion

              Abuse Elevation Control Mechanism

              1
              T1548

              Bypass User Account Control

              1
              T1548.002

              Impair Defenses

              4
              T1562

              Disable or Modify System Firewall

              1
              T1562.004

              Disable or Modify Tools

              3
              T1562.001

              Modify Registry

              5
              T1112

              Credential Access

              Discovery

              Peripheral Device Discovery

              1
              T1120

              Query Registry

              1
              T1012

              System Information Discovery

              3
              T1082

              Lateral Movement

              Replication Through Removable Media

              1
              T1091

              Collection

              Command and Control

              Exfiltration

              Impact

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.exe
                Filesize

                244KB

                MD5

                9f8f669886f191f9bab2173ebe11a2c4

                SHA1

                d11f16fa21132fe7376f13803a73b367baa5fc3b

                SHA256

                3d568dedbf4be55e88de3a132711f535d90757735d3c913d6deb311a9616f80b

                SHA512

                4823b9aaff42cf1071bbe47f0beec326d47a46a8e2c7d092a8844f56a0b0db43e32fdd1c2d6d02a2266cde98b4d79c4cf967843ec65ab74e944c790725dbccab

                Download Submit

              • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe
                Filesize

                1.1MB

                MD5

                8161aa853025349842e51400a271c43c

                SHA1

                e1e870f39dc38e4ea3825f52cbe1366e45d5aa3b

                SHA256

                8bf2ddce8410ee7fe8189e43152975c09e60a21f2f893e1345d0ebe2ecff5498

                SHA512

                495789823f488bd6bbf90abc6a915b7552e605969449f233a13b6d3e8caeaab6e4cbffba110a0076e47764b793cbad25d853b9e5f00f04701311d871a7a16fd1

                Download Submit

              • C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXE
                Filesize

                1.9MB

                MD5

                945605f7647118dce0d4e654f618a115

                SHA1

                e9faff667b91113a32f0d1c9929646493e11875d

                SHA256

                863bf8814bf929abddd16305ad87d5d38544c6926b976a505887c166269e1030

                SHA512

                1b1315a06dd530341eae45ddd995514d7245ab8ebfaf4ac0c2a88a66499acb3198a0f6ecac969c312fcd68b0ab17681822c063df532a058be5fddf707a2e17b6

                Download Submit

              • C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwtrig20.exe
                Filesize

                627KB

                MD5

                eaef6fd036e6d2db77b0e21791141ce2

                SHA1

                cc198d2c5afcec5269c13dfa190a3b1a244a1391

                SHA256

                5e9637a0214899171d942f15feebe9997d3a80cffb93dc2f7d6a572ca597621a

                SHA512

                2b4ef0fc8a960787a997f716a12cabe3b1ef50d2223a0509bd8d0b266de2e78b652339bb8eaf58b312ceb11723df1bd5766e575b8c0cd255088f4c16c2b77dc5

                Download Submit

              • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe
                Filesize

                252KB

                MD5

                667779f0573e09ee14120a39fa88225e

                SHA1

                2c937fd4db0b82599d153b705902ff373c67af41

                SHA256

                1fc2b580c675acf35608bd23b13b90459c9421222d9be15812db36c16d4850f3

                SHA512

                f3b6b7dac69e47b0cb201cabe4ce0ee7489de981c1b0cf6b57be64a0831473f844de8b5b36b0f2ac1ac13f69f367e388f96f1283f39ead23c3aabf4e7bc3fe99

                Download Submit

              • C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
                Filesize

                180KB

                MD5

                9c2924fc96c48c815172f24b1e6e9f12

                SHA1

                350d1cfbf662d1ebbc509245249a62d4f55c8c7e

                SHA256

                2523c647fe6356cc81778214cfbb9bf0a41d0bd6855b9b58f7481d549509eb2c

                SHA512

                7df92fbb1e524dfd920ff1bf1ae7ad37de2d58cc895e4631c3e1af35cdee5bf11b5b2ec87f98c3552aac4046c9b768f4adc94151fbfdd0239d7838eb7df5241d

                Download Submit

              • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
                Filesize

                472KB

                MD5

                88eb1bca8c399bc3f46e99cdde2f047e

                SHA1

                55fafbceb011e1af2edced978686a90971bd95f2

                SHA256

                42fd78c05bc240d4ded16ac974f17c336f6ae3a1814d548021c48a942cc30428

                SHA512

                149d4de0c024e25a13a7bb17471e6f48391d4f26b1c8388672320eed1c255f84219ad7b72bbebc531ae558d5192dd4bb6d0dddd6c65a45300c8e8348a4fb3728

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\$$a754F.bat
                Filesize

                722B

                MD5

                ced71abbe12b48f15f230f4df48c5b13

                SHA1

                5a1bad0418666d6318c615dfe62ed1aabea35922

                SHA256

                f07e3b4b506e9fb1c3d401d21538111ae41e7ebc5b6751e6851f7080af1ad646

                SHA512

                52d2f1c5da2b696ac93ce1754a56ab5166c395780718de4c1610c09baccf4db47af089f9b35b8e03b7e421813b2a6677dcfc641a162e1e9d5d45da35cd983c84

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\0cf7e1c3efbe6b365efbc513c2ba80b9a93fe9de5241ef030f01fd99574a5e05.exe.exe
                Filesize

                97KB

                MD5

                46556ee3036ad5f36d9e11c707732357

                SHA1

                c29cda7b177901a11b78e2aed416c17086c332e8

                SHA256

                a9703618fd528863b15123b95e24f46fdc9cd1968634c1bff2dfffb40ff12746

                SHA512

                5081dbd9f14dcea8dc9889213d23fea44460fac1c83ad9b8e97fc669b6ab641b545f084f7cffa3ab13752acd6a8e88601c2078232bb0450de1bd375294046bd1

                Download Submit

              • C:\Windows\Logo1_.exe
                Filesize

                27KB

                MD5

                3992018359c15d0314fdd929a93f6de6

                SHA1

                f555c42a2d4e15a428a549ac4a6efd625dca9f1d

                SHA256

                29351c1cb276aa4bd87e3e0c7aed4808a2c80cad99b26b8be984350aeeee2b48

                SHA512

                236360097d9fe4f693a17d4b7e9d08d4f017019eba021e17217ba1486a6ecaa1a1ad54c93a3819d84b5af2bbeb3096b81ef8e055fd973954323cfcd7107f7dc2

                Download Submit

              • F:\$RECYCLE.BIN\S-1-5-21-3434294380-2554721341-1919518612-1000\_desktop.ini
                Filesize

                9B

                MD5

                1368e4d784ef82633de86fa6bc6e37f9

                SHA1

                77c7384e886b27647bb4f2fd364e7947e7b6abc6

                SHA256

                57507bed6cf91d70e66bd4cc287634889ef30b648cb7c44a4edec0e2cb68b772

                SHA512

                3cb7168e776eb564768e30eba43174014a85108ab306a7c07a1522fb42173c381a5bff9ac10944fd345dd5308061cbe2878c60d1e878f8768281c1adcf5dd85b

                Download Submit

              • F:\qntblr.exe
                Filesize

                97KB

                MD5

                71c4d7e44d3104b275662933281fbd2d

                SHA1

                70cb9735b37358fdda5c3611e45aae01000abfb9

                SHA256

                6dc400b2ec641fadeee15b17804e20b598973059927870b435781bc31516db96

                SHA512

                a84bb6bd11892e254491fecf2b9ddb2942affb89752d9003684af97493eb515999b54da1829a81969fa0cb934cd08acb4342db632db47c365bef83437f894297

                Download Submit

              • memory/1116-39-0x0000000002170000-0x0000000002172000-memory.dmp

                Filesize

                8KB

                Download

              • memory/1324-103-0x0000000000980000-0x0000000001A3A000-memory.dmp

                Filesize

                16.7MB

                Download

              • memory/1324-83-0x0000000000980000-0x0000000001A3A000-memory.dmp

                Filesize

                16.7MB

                Download

              • memory/1324-33-0x0000000000400000-0x0000000000412000-memory.dmp

                Filesize

                72KB

                Download

              • memory/1324-61-0x00000000003E0000-0x00000000003E2000-memory.dmp

                Filesize

                8KB

                Download

              • memory/1324-35-0x0000000000980000-0x0000000001A3A000-memory.dmp

                Filesize

                16.7MB

                Download

              • memory/1324-151-0x00000000003E0000-0x00000000003E2000-memory.dmp

                Filesize

                8KB

                Download

              • memory/1324-63-0x00000000003E0000-0x00000000003E2000-memory.dmp

                Filesize

                8KB

                Download

              • memory/1324-60-0x00000000003F0000-0x00000000003F1000-memory.dmp

                Filesize

                4KB

                Download

              • memory/1324-139-0x0000000000980000-0x0000000001A3A000-memory.dmp

                Filesize

                16.7MB

                Download

              • memory/1324-37-0x0000000000980000-0x0000000001A3A000-memory.dmp

                Filesize

                16.7MB

                Download

              • memory/1324-111-0x0000000000980000-0x0000000001A3A000-memory.dmp

                Filesize

                16.7MB

                Download

              • memory/1324-107-0x0000000000980000-0x0000000001A3A000-memory.dmp

                Filesize

                16.7MB

                Download

              • memory/1324-38-0x0000000000980000-0x0000000001A3A000-memory.dmp

                Filesize

                16.7MB

                Download

              • memory/1324-65-0x0000000000980000-0x0000000001A3A000-memory.dmp

                Filesize

                16.7MB

                Download

              • memory/1324-66-0x0000000000980000-0x0000000001A3A000-memory.dmp

                Filesize

                16.7MB

                Download

              • memory/1324-67-0x0000000000980000-0x0000000001A3A000-memory.dmp

                Filesize

                16.7MB

                Download

              • memory/1324-68-0x0000000000980000-0x0000000001A3A000-memory.dmp

                Filesize

                16.7MB

                Download

              • memory/1324-69-0x0000000000980000-0x0000000001A3A000-memory.dmp

                Filesize

                16.7MB

                Download

              • memory/1324-70-0x0000000000980000-0x0000000001A3A000-memory.dmp

                Filesize

                16.7MB

                Download

              • memory/1324-76-0x0000000000980000-0x0000000001A3A000-memory.dmp

                Filesize

                16.7MB

                Download

              • memory/1324-80-0x0000000000980000-0x0000000001A3A000-memory.dmp

                Filesize

                16.7MB

                Download

              • memory/1324-81-0x0000000000980000-0x0000000001A3A000-memory.dmp

                Filesize

                16.7MB

                Download

              • memory/1324-82-0x0000000000980000-0x0000000001A3A000-memory.dmp

                Filesize

                16.7MB

                Download

              • memory/1324-101-0x0000000000980000-0x0000000001A3A000-memory.dmp

                Filesize

                16.7MB

                Download

              • memory/1324-84-0x0000000000980000-0x0000000001A3A000-memory.dmp

                Filesize

                16.7MB

                Download

              • memory/1324-86-0x0000000000980000-0x0000000001A3A000-memory.dmp

                Filesize

                16.7MB

                Download

              • memory/1324-87-0x0000000000980000-0x0000000001A3A000-memory.dmp

                Filesize

                16.7MB

                Download

              • memory/1324-89-0x0000000000980000-0x0000000001A3A000-memory.dmp

                Filesize

                16.7MB

                Download

              • memory/1324-99-0x0000000000980000-0x0000000001A3A000-memory.dmp

                Filesize

                16.7MB

                Download

              • memory/1324-91-0x0000000000980000-0x0000000001A3A000-memory.dmp

                Filesize

                16.7MB

                Download

              • memory/2424-51-0x0000000000220000-0x0000000000222000-memory.dmp

                Filesize

                8KB

                Download

              • memory/2424-53-0x0000000000220000-0x0000000000222000-memory.dmp

                Filesize

                8KB

                Download

              • memory/2424-54-0x0000000000230000-0x0000000000231000-memory.dmp

                Filesize

                4KB

                Download

              • memory/2424-146-0x0000000000220000-0x0000000000222000-memory.dmp

                Filesize

                8KB

                Download

              • memory/2424-90-0x0000000000400000-0x0000000000435000-memory.dmp

                Filesize

                212KB

                Download

              • memory/2424-23-0x0000000000400000-0x0000000000435000-memory.dmp

                Filesize

                212KB

                Download

              • memory/2708-18-0x0000000000270000-0x00000000002A5000-memory.dmp

                Filesize

                212KB

                Download

              • memory/2708-0-0x0000000000400000-0x0000000000435000-memory.dmp

                Filesize

                212KB

                Download

              • memory/2708-17-0x0000000000400000-0x0000000000435000-memory.dmp

                Filesize

                212KB

                Download

              • memory/2708-16-0x0000000000270000-0x00000000002A5000-memory.dmp

                Filesize

                212KB

                Download

              • memory/2748-152-0x0000000000270000-0x0000000000272000-memory.dmp

                Filesize

                8KB

                Download

              • memory/2748-31-0x0000000000270000-0x0000000000282000-memory.dmp

                Filesize

                72KB

                Download

              • memory/2748-32-0x0000000000270000-0x0000000000282000-memory.dmp

                Filesize

                72KB

                Download

              • memory/2748-62-0x0000000000270000-0x0000000000272000-memory.dmp

                Filesize

                8KB

                Download

              • memory/2748-64-0x0000000000270000-0x0000000000272000-memory.dmp

                Filesize

                8KB

                Download

              • memory/2748-46-0x0000000000280000-0x0000000000281000-memory.dmp

                Filesize

                4KB

                Download

              • memory/2748-44-0x0000000000270000-0x0000000000272000-memory.dmp

                Filesize

                8KB

                Download

              • memory/2748-45-0x0000000000280000-0x0000000000281000-memory.dmp

                Filesize

                4KB

                Download