Analysis
-
max time kernel
27s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
02/08/2024, 17:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
be1bc781ba7fac26f40298af2c3e7b00N.dll
Resource
win7-20240729-en
windows7-x64
16 signatures
120 seconds
General
-
Target
be1bc781ba7fac26f40298af2c3e7b00N.dll
-
Size
120KB
-
MD5
be1bc781ba7fac26f40298af2c3e7b00
-
SHA1
637b7d8d29c795f4bfbf20009c8cc02b611ef345
-
SHA256
be45855e87d3c3fec4ed0148f3fb955c053f47a9b1b2aad029f857067ae82c61
-
SHA512
1de9143f7acf66f497bda881e51bbc7f2d65e1c89c0130e8ba0b6cbf6549cb26e23a93009f452e340dd9286d3771f7af1d49b9a8138b937303577ef6e76b7cab
-
SSDEEP
1536:wShaYElzLxpA89GQZKsfsQQO99ckOF9wOM+OSOMq1ftnK3R4ZnOg+B:wSoYSQbssQlJCqmJq1ftno4ZnOg+B
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f779a2d.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f779a2d.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f779a2d.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f779c11.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f779c11.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f779c11.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f779a2d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f779c11.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f779a2d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f779a2d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f779a2d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f779c11.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f779c11.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f779c11.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f779c11.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f779a2d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f779a2d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f779a2d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f779c11.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f779c11.exe -
Executes dropped EXE 3 IoCs
pid Process 1880 f779a2d.exe 2808 f779c11.exe 1504 f77b5e7.exe -
Loads dropped DLL 6 IoCs
pid Process 1932 rundll32.exe 1932 rundll32.exe 1932 rundll32.exe 1932 rundll32.exe 1932 rundll32.exe 1932 rundll32.exe -
resource yara_rule behavioral1/memory/1880-15-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/1880-17-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/1880-19-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/1880-22-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/1880-14-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/1880-23-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/1880-21-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/1880-20-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/1880-18-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/1880-16-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/1880-61-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/1880-62-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/1880-63-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/1880-64-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/1880-65-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/1880-67-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/1880-68-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/1880-81-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/1880-84-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/1880-85-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/1880-87-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/1880-150-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/2808-163-0x0000000000A10000-0x0000000001ACA000-memory.dmp upx behavioral1/memory/2808-186-0x0000000000A10000-0x0000000001ACA000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f779c11.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f779c11.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f779c11.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f779c11.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f779a2d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f779a2d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f779a2d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f779a2d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f779a2d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f779a2d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f779c11.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f779a2d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f779c11.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f779c11.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f779c11.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f779a2d.exe -
Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: f779a2d.exe File opened (read-only) \??\R: f779a2d.exe File opened (read-only) \??\E: f779a2d.exe File opened (read-only) \??\H: f779a2d.exe File opened (read-only) \??\J: f779a2d.exe File opened (read-only) \??\L: f779a2d.exe File opened (read-only) \??\I: f779a2d.exe File opened (read-only) \??\K: f779a2d.exe File opened (read-only) \??\N: f779a2d.exe File opened (read-only) \??\G: f779a2d.exe File opened (read-only) \??\M: f779a2d.exe File opened (read-only) \??\O: f779a2d.exe File opened (read-only) \??\Q: f779a2d.exe File opened (read-only) \??\S: f779a2d.exe File opened (read-only) \??\T: f779a2d.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI f779a2d.exe File created C:\Windows\f77eaeb f779c11.exe File created C:\Windows\f779a9a f779a2d.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f779a2d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f779c11.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1880 f779a2d.exe 1880 f779a2d.exe 2808 f779c11.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeDebugPrivilege 1880 f779a2d.exe Token: SeDebugPrivilege 1880 f779a2d.exe Token: SeDebugPrivilege 1880 f779a2d.exe Token: SeDebugPrivilege 1880 f779a2d.exe Token: SeDebugPrivilege 1880 f779a2d.exe Token: SeDebugPrivilege 1880 f779a2d.exe Token: SeDebugPrivilege 1880 f779a2d.exe Token: SeDebugPrivilege 1880 f779a2d.exe Token: SeDebugPrivilege 1880 f779a2d.exe Token: SeDebugPrivilege 1880 f779a2d.exe Token: SeDebugPrivilege 1880 f779a2d.exe Token: SeDebugPrivilege 1880 f779a2d.exe Token: SeDebugPrivilege 1880 f779a2d.exe Token: SeDebugPrivilege 1880 f779a2d.exe Token: SeDebugPrivilege 1880 f779a2d.exe Token: SeDebugPrivilege 1880 f779a2d.exe Token: SeDebugPrivilege 1880 f779a2d.exe Token: SeDebugPrivilege 1880 f779a2d.exe Token: SeDebugPrivilege 1880 f779a2d.exe Token: SeDebugPrivilege 1880 f779a2d.exe Token: SeDebugPrivilege 1880 f779a2d.exe Token: SeDebugPrivilege 1880 f779a2d.exe Token: SeDebugPrivilege 1880 f779a2d.exe Token: SeDebugPrivilege 2808 f779c11.exe Token: SeDebugPrivilege 2808 f779c11.exe Token: SeDebugPrivilege 2808 f779c11.exe Token: SeDebugPrivilege 2808 f779c11.exe Token: SeDebugPrivilege 2808 f779c11.exe Token: SeDebugPrivilege 2808 f779c11.exe Token: SeDebugPrivilege 2808 f779c11.exe Token: SeDebugPrivilege 2808 f779c11.exe Token: SeDebugPrivilege 2808 f779c11.exe Token: SeDebugPrivilege 2808 f779c11.exe Token: SeDebugPrivilege 2808 f779c11.exe Token: SeDebugPrivilege 2808 f779c11.exe Token: SeDebugPrivilege 2808 f779c11.exe Token: SeDebugPrivilege 2808 f779c11.exe Token: SeDebugPrivilege 2808 f779c11.exe Token: SeDebugPrivilege 2808 f779c11.exe Token: SeDebugPrivilege 2808 f779c11.exe Token: SeDebugPrivilege 2808 f779c11.exe Token: SeDebugPrivilege 2808 f779c11.exe Token: SeDebugPrivilege 2808 f779c11.exe Token: SeDebugPrivilege 2808 f779c11.exe Token: SeDebugPrivilege 2808 f779c11.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2208 wrote to memory of 1932 2208 rundll32.exe 30 PID 2208 wrote to memory of 1932 2208 rundll32.exe 30 PID 2208 wrote to memory of 1932 2208 rundll32.exe 30 PID 2208 wrote to memory of 1932 2208 rundll32.exe 30 PID 2208 wrote to memory of 1932 2208 rundll32.exe 30 PID 2208 wrote to memory of 1932 2208 rundll32.exe 30 PID 2208 wrote to memory of 1932 2208 rundll32.exe 30 PID 1932 wrote to memory of 1880 1932 rundll32.exe 31 PID 1932 wrote to memory of 1880 1932 rundll32.exe 31 PID 1932 wrote to memory of 1880 1932 rundll32.exe 31 PID 1932 wrote to memory of 1880 1932 rundll32.exe 31 PID 1880 wrote to memory of 1304 1880 f779a2d.exe 19 PID 1880 wrote to memory of 1380 1880 f779a2d.exe 20 PID 1880 wrote to memory of 1444 1880 f779a2d.exe 21 PID 1880 wrote to memory of 1664 1880 f779a2d.exe 25 PID 1880 wrote to memory of 2208 1880 f779a2d.exe 29 PID 1880 wrote to memory of 1932 1880 f779a2d.exe 30 PID 1880 wrote to memory of 1932 1880 f779a2d.exe 30 PID 1932 wrote to memory of 2808 1932 rundll32.exe 32 PID 1932 wrote to memory of 2808 1932 rundll32.exe 32 PID 1932 wrote to memory of 2808 1932 rundll32.exe 32 PID 1932 wrote to memory of 2808 1932 rundll32.exe 32 PID 1932 wrote to memory of 1504 1932 rundll32.exe 33 PID 1932 wrote to memory of 1504 1932 rundll32.exe 33 PID 1932 wrote to memory of 1504 1932 rundll32.exe 33 PID 1932 wrote to memory of 1504 1932 rundll32.exe 33 PID 1880 wrote to memory of 1304 1880 f779a2d.exe 19 PID 1880 wrote to memory of 1380 1880 f779a2d.exe 20 PID 1880 wrote to memory of 1444 1880 f779a2d.exe 21 PID 1880 wrote to memory of 1664 1880 f779a2d.exe 25 PID 1880 wrote to memory of 2808 1880 f779a2d.exe 32 PID 1880 wrote to memory of 2808 1880 f779a2d.exe 32 PID 1880 wrote to memory of 1504 1880 f779a2d.exe 33 PID 1880 wrote to memory of 1504 1880 f779a2d.exe 33 PID 2808 wrote to memory of 1304 2808 f779c11.exe 19 PID 2808 wrote to memory of 1380 2808 f779c11.exe 20 PID 2808 wrote to memory of 1444 2808 f779c11.exe 21 PID 2808 wrote to memory of 1664 2808 f779c11.exe 25 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f779a2d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f779c11.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1304
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1380
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1444
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\be1bc781ba7fac26f40298af2c3e7b00N.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\be1bc781ba7fac26f40298af2c3e7b00N.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\f779a2d.exeC:\Users\Admin\AppData\Local\Temp\f779a2d.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1880
-
-
C:\Users\Admin\AppData\Local\Temp\f779c11.exeC:\Users\Admin\AppData\Local\Temp\f779c11.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2808
-
-
C:\Users\Admin\AppData\Local\Temp\f77b5e7.exeC:\Users\Admin\AppData\Local\Temp\f77b5e7.exe4⤵
- Executes dropped EXE
PID:1504
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1664
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD54e1adb83b103fb5a41fc08fe703d1064
SHA1ff6e03372b105ab685387c5fb3580ef81bfc6486
SHA256ba4d5e402a077a7052115a179f6764fbe9fe09879ee5cd0a4936a3d4c0796211
SHA51248a4220133e1de9e0299786fc508fcec535ac5f4a03c5bf94afc2e5d89bc5b2c66cbc7e8bf6d06a747b636a95b655714b82e7845677a55de0d2db60facae3364
-
Filesize
97KB
MD5a7b08177f170b894ff76efd03f0d16e6
SHA1d36e62a135ea4b6572770594732d2698e4cc4cb0
SHA2563a6e834580e370c4bc92ce352b9b8f8da03d76282399a2ff1e9b282334d520eb
SHA512bde86fd2032f99b7561a8388d2ddd2eab64ecbd684d935286ef25c6bce915359ecdd1d703484767b2d95886faeaeac3fc2b6c5be4e42e872fc7b96b4a35a152c