Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
24/07/2024, 19:55
General
- Target a4ef531f35ec95d7ea3310eb9a2ded322d2cdbf57eabe96aa491b8202a420c24.exe
- Size 348KB
- Sample240724-ym4xesxcle
- SHA256 a4ef531f35ec95d7ea3310eb9a2ded322d2cdbf57eabe96aa491b8202a420c24
Malware Config
Extracted
-
sality
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
-
http://www.klkjwre9fqwieluoi.info/
-
http://kukutrustnet777888.info/
Signatures
- Modifies firewall policy service 3 TTPs 6 IoCs
- Sality
Sality is backdoor written in C++, first discovered in 2003.
- UAC bypass 3 TTPs 2 IoCs
- Windows security bypass 2 TTPs 12 IoCs
- Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
- Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
- Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
- Executes dropped EXE 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- UPX packed file 19 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Windows security modification 2 TTPs 14 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Network Service Discovery 1 TTPs 1 IoCs
Attempt to gather information on host's network.
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Enumerates processes with tasklist 1 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Drops file in Windows directory 1 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
- System Location Discovery: System Language Discovery 1 TTPs 47 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Connections Discovery 1 TTPs 1 IoCs
Attempt to get a listing of network connections.
- Discovers systems in the same network 1 TTPs 1 IoCs
- Gathers network information 2 TTPs 3 IoCs
Uses commandline utility to view network configuration.
- Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
- Runs net.exe
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\a4ef531f35ec95d7ea3310eb9a2ded322d2cdbf57eabe96aa491b8202a420c24.exe"C:\Users\Admin\AppData\Local\Temp\a4ef531f35ec95d7ea3310eb9a2ded322d2cdbf57eabe96aa491b8202a420c24.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\a4ef531f35ec95d7ea3310eb9a2ded322d2cdbf57eabe96aa491b8202a420c24.exeC:\Users\Admin\AppData\Local\Temp\a4ef531f35ec95d7ea3310eb9a2ded322d2cdbf57eabe96aa491b8202a420c24.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Application Data\wmimgmt.exe"C:\ProgramData\Application Data\wmimgmt.exe"4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\ProgramData\Application Data\wmimgmt.exe"C:\ProgramData\Application Data\wmimgmt.exe"5⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /v:on /c "C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\ghi.bat"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\findstr.exefindstr /s "YM.CGP_" "C:\Users\Admin"\..\*.txt7⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\chcp.comchcp7⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\net.exenet user7⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 user8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exenet localgroup administrators7⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup administrators8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\tasklist.exetasklist7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\systeminfo.exesysteminfo7⤵
- System Location Discovery: System Language Discovery
- Gathers system information
-
-
C:\Windows\SysWOW64\reg.exereg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer"7⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\find.exefind "REG_"7⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg query HKEY_CURRENT_USER\Software\Microsoft\Office7⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg query HKEY_CURRENT_USER\Software\Microsoft\Office\8.0\Common\UserInfo7⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg query HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Common\UserInfo7⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg query HKEY_CURRENT_USER\Software\Microsoft\Office\10.0\Common\UserInfo7⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg query HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Common\UserInfo7⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg query HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\UserInfo7⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg query HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Common\UserInfo7⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /all7⤵
- System Location Discovery: System Language Discovery
- Gathers network information
-
-
C:\Windows\SysWOW64\NETSTAT.EXEnetstat -ano7⤵
- System Location Discovery: System Language Discovery
- System Network Connections Discovery
- Gathers network information
-
-
C:\Windows\SysWOW64\ARP.EXEarp -a7⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\NETSTAT.EXEnetstat -r7⤵
- System Location Discovery: System Language Discovery
- Gathers network information
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print8⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\ROUTE.EXEC:\Windows\system32\route.exe print9⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\net.exenet start7⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exenet use7⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo n"7⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\net.exenet share7⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 share8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exenet view /domain7⤵
- System Location Discovery: System Language Discovery
- Discovers systems in the same network
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\\s.log "7⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\find.exefind /i /v "------"7⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\\t.log "7⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\find.exefind /i /v "domain"7⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\\s.log "7⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\find.exefind /i /v "¬A╛╣"7⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\\t.log "7⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\find.exefind /i /v "░⌡ªµª¿"7⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\\s.log "7⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\find.exefind /i /v "├ⁿ┴ε"7⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\MICROS~1\Windows\INETCA~1\\t.log "7⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\find.exefind /i /v "completed successfully"7⤵
- System Location Discovery: System Language Discovery
-
-
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Account Manipulation
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Account Manipulation
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
6Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Network Service Discovery
1Network Share Discovery
1Peripheral Device Discovery
1Permission Groups Discovery
1Local Groups
1Process Discovery
1Query Registry
1Remote System Discovery
1System Information Discovery
4System Location Discovery
1System Language Discovery
1System Network Connections Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
wmimgmt.exe
INFO.TXT
INFO.TXT
drivers.p
ghi.bat
INFO.TXT
INFO.TXT
AC#EA6F.tmp
SYSTEM.INI
memory/664-4-0x00000000023C0000-0x000000000344E000-memory.dmp
memory/664-6-0x00000000023C0000-0x000000000344E000-memory.dmp
memory/664-7-0x00000000023C0000-0x000000000344E000-memory.dmp
memory/664-3-0x00000000023C0000-0x000000000344E000-memory.dmp
memory/664-0-0x0000000000400000-0x0000000000450000-memory.dmp
memory/664-1-0x00000000023C0000-0x000000000344E000-memory.dmp
memory/664-8-0x00000000023C0000-0x000000000344E000-memory.dmp
memory/664-5-0x00000000023C0000-0x000000000344E000-memory.dmp
memory/664-10-0x0000000004660000-0x0000000004661000-memory.dmp
memory/664-14-0x0000000004510000-0x0000000004512000-memory.dmp
memory/664-26-0x0000000000400000-0x0000000000450000-memory.dmp
memory/664-23-0x00000000023C0000-0x000000000344E000-memory.dmp
memory/664-9-0x0000000004510000-0x0000000004512000-memory.dmp
memory/664-12-0x00000000023C0000-0x000000000344E000-memory.dmp
memory/664-11-0x0000000004510000-0x0000000004512000-memory.dmp
memory/1412-42-0x0000000002260000-0x00000000032EE000-memory.dmp
memory/1412-49-0x0000000000400000-0x0000000000450000-memory.dmp
memory/1412-52-0x0000000003C90000-0x0000000003C92000-memory.dmp
memory/1412-48-0x0000000003C90000-0x0000000003C92000-memory.dmp
memory/1412-47-0x00000000042F0000-0x00000000042F1000-memory.dmp
memory/1412-46-0x0000000003C90000-0x0000000003C92000-memory.dmp
memory/1412-44-0x0000000002260000-0x00000000032EE000-memory.dmp
memory/1412-43-0x0000000002260000-0x00000000032EE000-memory.dmp
memory/1412-38-0x0000000002260000-0x00000000032EE000-memory.dmp
memory/1412-37-0x0000000002260000-0x00000000032EE000-memory.dmp
memory/1412-39-0x0000000000400000-0x0000000000450000-memory.dmp
memory/1412-35-0x0000000002260000-0x00000000032EE000-memory.dmp
memory/1412-34-0x0000000000400000-0x0000000000450000-memory.dmp
memory/1412-62-0x0000000000400000-0x0000000000450000-memory.dmp
memory/1412-60-0x0000000002260000-0x00000000032EE000-memory.dmp
memory/1412-45-0x0000000002260000-0x00000000032EE000-memory.dmp
memory/1412-41-0x0000000002260000-0x00000000032EE000-memory.dmp
memory/1412-40-0x0000000002260000-0x00000000032EE000-memory.dmp
memory/4244-92-0x0000000000400000-0x0000000000424000-memory.dmp
memory/4244-95-0x0000000000400000-0x0000000000424000-memory.dmp
memory/4244-96-0x0000000000400000-0x0000000000424000-memory.dmp
memory/4244-97-0x0000000000400000-0x0000000000424000-memory.dmp
memory/4244-98-0x0000000000400000-0x0000000000424000-memory.dmp
memory/4244-105-0x0000000000400000-0x0000000000424000-memory.dmp
memory/4244-107-0x0000000000400000-0x0000000000424000-memory.dmp
memory/4244-110-0x0000000000400000-0x0000000000424000-memory.dmp
memory/4244-113-0x0000000000400000-0x0000000000424000-memory.dmp
memory/4244-116-0x0000000000400000-0x0000000000424000-memory.dmp
memory/4824-24-0x0000000000400000-0x0000000000450000-memory.dmp
memory/4824-33-0x0000000000400000-0x0000000000424000-memory.dmp