Analysis

  • max time kernel
    91s
  • max time network
    96s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-09-2024 12:18

General

  • Target

    ea9fc82a8e9f6a12d560abd29ce254f0N.dll

  • Size

    120KB

  • MD5

    ea9fc82a8e9f6a12d560abd29ce254f0

  • SHA1

    460369833910f1e9c57bb23f7143f4175c5a3367

  • SHA256

    b05f557767f39cab362f088c7544a50475a9c4900889da75791a0f9bbf5eb430

  • SHA512

    9a4f10c5087268cf98413d63c2a529507682fb51a47a955ecd3bf164137b8bc9d6c3c129720809912bf520403039f229363cfca10f09d4b0ad54e2cf76ca9db6

  • SSDEEP

    3072:Hq3rcWdKuU90PBdBXOroxc4Ls1oLMtkEb0i:KQWUyXBXOelfAtkU

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

  • Modifies firewall policy service 3 TTPs 6 IoCs
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

  • UAC bypass 3 TTPs 2 IoCs
  • Windows security bypass 2 TTPs 12 IoCs
  • Executes dropped EXE 3 IoCs
  • UPX packed file 31 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Windows security modification 2 TTPs 14 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 12 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 53 IoCs
  • System policy modification 1 TTPs 2 IoCs

Processes

  • C:\Windows\system32\fontdrvhost.exe
    "fontdrvhost.exe"
    1⤵
      PID:780
    • C:\Windows\system32\fontdrvhost.exe
      "fontdrvhost.exe"
      1⤵
        PID:788
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        1⤵
          PID:380
        • C:\Windows\system32\sihost.exe
          sihost.exe
          1⤵
            PID:2512
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
            1⤵
              PID:2536
            • C:\Windows\system32\taskhostw.exe
              taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
              1⤵
                PID:2640
              • C:\Windows\Explorer.EXE
                C:\Windows\Explorer.EXE
                1⤵
                  PID:3368
                  • C:\Windows\system32\rundll32.exe
                    rundll32.exe C:\Users\Admin\AppData\Local\Temp\ea9fc82a8e9f6a12d560abd29ce254f0N.dll,#1
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:988
                    • C:\Windows\SysWOW64\rundll32.exe
                      rundll32.exe C:\Users\Admin\AppData\Local\Temp\ea9fc82a8e9f6a12d560abd29ce254f0N.dll,#1
                      3⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:2216
                      • C:\Users\Admin\AppData\Local\Temp\e57bff4.exe
                        C:\Users\Admin\AppData\Local\Temp\e57bff4.exe
                        4⤵
                        • Modifies firewall policy service
                        • UAC bypass
                        • Windows security bypass
                        • Executes dropped EXE
                        • Windows security modification
                        • Checks whether UAC is enabled
                        • Enumerates connected drives
                        • Drops file in Program Files directory
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        • System policy modification
                        PID:4548
                      • C:\Users\Admin\AppData\Local\Temp\e57c15c.exe
                        C:\Users\Admin\AppData\Local\Temp\e57c15c.exe
                        4⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:1588
                      • C:\Users\Admin\AppData\Local\Temp\e57e3f7.exe
                        C:\Users\Admin\AppData\Local\Temp\e57e3f7.exe
                        4⤵
                        • Modifies firewall policy service
                        • UAC bypass
                        • Windows security bypass
                        • Executes dropped EXE
                        • Windows security modification
                        • Checks whether UAC is enabled
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        • System policy modification
                        PID:4704
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                  1⤵
                    PID:3628
                  • C:\Windows\system32\DllHost.exe
                    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                    1⤵
                      PID:3800
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:3916
                      • C:\Windows\System32\RuntimeBroker.exe
                        C:\Windows\System32\RuntimeBroker.exe -Embedding
                        1⤵
                          PID:3980
                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                          1⤵
                            PID:4068
                          • C:\Windows\System32\RuntimeBroker.exe
                            C:\Windows\System32\RuntimeBroker.exe -Embedding
                            1⤵
                              PID:3552
                            • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
                              "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
                              1⤵
                                PID:2604
                              • C:\Windows\System32\RuntimeBroker.exe
                                C:\Windows\System32\RuntimeBroker.exe -Embedding
                                1⤵
                                  PID:456
                                • C:\Windows\system32\backgroundTaskHost.exe
                                  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                  1⤵
                                    PID:2992
                                  • C:\Windows\System32\RuntimeBroker.exe
                                    C:\Windows\System32\RuntimeBroker.exe -Embedding
                                    1⤵
                                      PID:2212
                                    • C:\Windows\System32\RuntimeBroker.exe
                                      C:\Windows\System32\RuntimeBroker.exe -Embedding
                                      1⤵
                                        PID:4236

                                      Network

                                      • flag-us
                                        DNS
                                        8.8.8.8.in-addr.arpa
                                        Remote address:
                                        8.8.8.8:53
                                        Request
                                        8.8.8.8.in-addr.arpa
                                        IN PTR
                                        Response
                                        8.8.8.8.in-addr.arpa
                                        IN PTR
                                        dnsgoogle
                                      • flag-us
                                        DNS
                                        228.249.119.40.in-addr.arpa
                                        Remote address:
                                        8.8.8.8:53
                                        Request
                                        228.249.119.40.in-addr.arpa
                                        IN PTR
                                        Response
                                      • flag-us
                                        DNS
                                        172.210.232.199.in-addr.arpa
                                        Remote address:
                                        8.8.8.8:53
                                        Request
                                        172.210.232.199.in-addr.arpa
                                        IN PTR
                                        Response
                                      • flag-us
                                        DNS
                                        95.221.229.192.in-addr.arpa
                                        Remote address:
                                        8.8.8.8:53
                                        Request
                                        95.221.229.192.in-addr.arpa
                                        IN PTR
                                        Response
                                      • flag-us
                                        DNS
                                        68.159.190.20.in-addr.arpa
                                        Remote address:
                                        8.8.8.8:53
                                        Request
                                        68.159.190.20.in-addr.arpa
                                        IN PTR
                                        Response
                                      • flag-us
                                        DNS
                                        241.150.49.20.in-addr.arpa
                                        Remote address:
                                        8.8.8.8:53
                                        Request
                                        241.150.49.20.in-addr.arpa
                                        IN PTR
                                        Response
                                      • flag-us
                                        DNS
                                        183.59.114.20.in-addr.arpa
                                        Remote address:
                                        8.8.8.8:53
                                        Request
                                        183.59.114.20.in-addr.arpa
                                        IN PTR
                                        Response
                                      • flag-us
                                        DNS
                                        15.164.165.52.in-addr.arpa
                                        Remote address:
                                        8.8.8.8:53
                                        Request
                                        15.164.165.52.in-addr.arpa
                                        IN PTR
                                        Response
                                      • flag-us
                                        DNS
                                        172.214.232.199.in-addr.arpa
                                        Remote address:
                                        8.8.8.8:53
                                        Request
                                        172.214.232.199.in-addr.arpa
                                        IN PTR
                                        Response
                                      • flag-us
                                        DNS
                                        73.144.22.2.in-addr.arpa
                                        Remote address:
                                        8.8.8.8:53
                                        Request
                                        73.144.22.2.in-addr.arpa
                                        IN PTR
                                        Response
                                        73.144.22.2.in-addr.arpa
                                        IN PTR
                                        a2-22-144-73deploystaticakamaitechnologiescom
                                      • flag-us
                                        DNS
                                        22.236.111.52.in-addr.arpa
                                        Remote address:
                                        8.8.8.8:53
                                        Request
                                        22.236.111.52.in-addr.arpa
                                        IN PTR
                                        Response
                                      No results found
                                      • 8.8.8.8:53
                                        8.8.8.8.in-addr.arpa
                                        dns
                                        66 B
                                        90 B
                                        1
                                        1

                                        DNS Request

                                        8.8.8.8.in-addr.arpa

                                      • 8.8.8.8:53
                                        228.249.119.40.in-addr.arpa
                                        dns
                                        73 B
                                        159 B
                                        1
                                        1

                                        DNS Request

                                        228.249.119.40.in-addr.arpa

                                      • 8.8.8.8:53
                                        172.210.232.199.in-addr.arpa
                                        dns
                                        74 B
                                        128 B
                                        1
                                        1

                                        DNS Request

                                        172.210.232.199.in-addr.arpa

                                      • 8.8.8.8:53
                                        95.221.229.192.in-addr.arpa
                                        dns
                                        73 B
                                        144 B
                                        1
                                        1

                                        DNS Request

                                        95.221.229.192.in-addr.arpa

                                      • 8.8.8.8:53
                                        68.159.190.20.in-addr.arpa
                                        dns
                                        72 B
                                        158 B
                                        1
                                        1

                                        DNS Request

                                        68.159.190.20.in-addr.arpa

                                      • 8.8.8.8:53
                                        241.150.49.20.in-addr.arpa
                                        dns
                                        72 B
                                        158 B
                                        1
                                        1

                                        DNS Request

                                        241.150.49.20.in-addr.arpa

                                      • 8.8.8.8:53
                                        183.59.114.20.in-addr.arpa
                                        dns
                                        72 B
                                        158 B
                                        1
                                        1

                                        DNS Request

                                        183.59.114.20.in-addr.arpa

                                      • 8.8.8.8:53
                                        15.164.165.52.in-addr.arpa
                                        dns
                                        72 B
                                        146 B
                                        1
                                        1

                                        DNS Request

                                        15.164.165.52.in-addr.arpa

                                      • 8.8.8.8:53
                                        172.214.232.199.in-addr.arpa
                                        dns
                                        74 B
                                        128 B
                                        1
                                        1

                                        DNS Request

                                        172.214.232.199.in-addr.arpa

                                      • 8.8.8.8:53
                                        73.144.22.2.in-addr.arpa
                                        dns
                                        70 B
                                        133 B
                                        1
                                        1

                                        DNS Request

                                        73.144.22.2.in-addr.arpa

                                      • 8.8.8.8:53
                                        22.236.111.52.in-addr.arpa
                                        dns
                                        72 B
                                        158 B
                                        1
                                        1

                                        DNS Request

                                        22.236.111.52.in-addr.arpa

                                      MITRE ATT&CK Enterprise v15

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Users\Admin\AppData\Local\Temp\e57bff4.exe

                                        Filesize

                                        97KB

                                        MD5

                                        7dcfddf2762f2ebb16c6000f9b7aaad5

                                        SHA1

                                        eb8f85d171c080bf9e4654aa50b00da342a5d8f9

                                        SHA256

                                        16a6ac8deb5f9e0cfc20b3a07d073bd77c67456ff955188fbacbe997e8c77304

                                        SHA512

                                        feb3cb55026915e715c845fab315900d693283ff89f3f5436b8414ae8c5ed34369424ea8bb36b0f0dee422627597d7b94ed3fd07f960f24f54bded64467e01f6

                                      • C:\Windows\SYSTEM.INI

                                        Filesize

                                        257B

                                        MD5

                                        e51bc22eef364a4a1e5b418ebdde8a58

                                        SHA1

                                        507a8ac4c5087f3446fbeb5eb146bfd4c8e47365

                                        SHA256

                                        40c5ee117a8a4eaa2cf41229c1ebe4a18d92d03d2f8280319cf3a681a30332c4

                                        SHA512

                                        4cdbff9fa39fea5299547acfc117dfc3d4050c9f87fb2b874049eb486af62c654e1cbc38b2d8e83ab39953a63d4497d61055447d554cc5d91cabc43d9d4a7aca

                                      • memory/1588-53-0x00000000001F0000-0x00000000001F1000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/1588-107-0x0000000000400000-0x0000000000412000-memory.dmp

                                        Filesize

                                        72KB

                                      • memory/1588-59-0x00000000001E0000-0x00000000001E2000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/1588-56-0x00000000001E0000-0x00000000001E2000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/1588-34-0x0000000000400000-0x0000000000412000-memory.dmp

                                        Filesize

                                        72KB

                                      • memory/2216-14-0x0000000000E40000-0x0000000000E41000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/2216-46-0x0000000000DB0000-0x0000000000DB2000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/2216-1-0x0000000010000000-0x0000000010020000-memory.dmp

                                        Filesize

                                        128KB

                                      • memory/2216-28-0x0000000000DB0000-0x0000000000DB2000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/2216-24-0x0000000000DB0000-0x0000000000DB2000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/2216-13-0x0000000000DB0000-0x0000000000DB2000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/4548-39-0x0000000000890000-0x000000000194A000-memory.dmp

                                        Filesize

                                        16.7MB

                                      • memory/4548-8-0x0000000000890000-0x000000000194A000-memory.dmp

                                        Filesize

                                        16.7MB

                                      • memory/4548-12-0x0000000000890000-0x000000000194A000-memory.dmp

                                        Filesize

                                        16.7MB

                                      • memory/4548-25-0x0000000000780000-0x0000000000782000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/4548-23-0x0000000000890000-0x000000000194A000-memory.dmp

                                        Filesize

                                        16.7MB

                                      • memory/4548-22-0x0000000000890000-0x000000000194A000-memory.dmp

                                        Filesize

                                        16.7MB

                                      • memory/4548-30-0x0000000000890000-0x000000000194A000-memory.dmp

                                        Filesize

                                        16.7MB

                                      • memory/4548-35-0x0000000000890000-0x000000000194A000-memory.dmp

                                        Filesize

                                        16.7MB

                                      • memory/4548-31-0x0000000000890000-0x000000000194A000-memory.dmp

                                        Filesize

                                        16.7MB

                                      • memory/4548-36-0x0000000000890000-0x000000000194A000-memory.dmp

                                        Filesize

                                        16.7MB

                                      • memory/4548-37-0x0000000000890000-0x000000000194A000-memory.dmp

                                        Filesize

                                        16.7MB

                                      • memory/4548-38-0x0000000000890000-0x000000000194A000-memory.dmp

                                        Filesize

                                        16.7MB

                                      • memory/4548-10-0x0000000000890000-0x000000000194A000-memory.dmp

                                        Filesize

                                        16.7MB

                                      • memory/4548-41-0x0000000000890000-0x000000000194A000-memory.dmp

                                        Filesize

                                        16.7MB

                                      • memory/4548-11-0x0000000000890000-0x000000000194A000-memory.dmp

                                        Filesize

                                        16.7MB

                                      • memory/4548-4-0x0000000000400000-0x0000000000412000-memory.dmp

                                        Filesize

                                        72KB

                                      • memory/4548-50-0x0000000000890000-0x000000000194A000-memory.dmp

                                        Filesize

                                        16.7MB

                                      • memory/4548-6-0x0000000000890000-0x000000000194A000-memory.dmp

                                        Filesize

                                        16.7MB

                                      • memory/4548-16-0x0000000003E70000-0x0000000003E71000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/4548-51-0x0000000000890000-0x000000000194A000-memory.dmp

                                        Filesize

                                        16.7MB

                                      • memory/4548-103-0x0000000000400000-0x0000000000412000-memory.dmp

                                        Filesize

                                        72KB

                                      • memory/4548-29-0x0000000000780000-0x0000000000782000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/4548-61-0x0000000000780000-0x0000000000782000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/4548-99-0x0000000000890000-0x000000000194A000-memory.dmp

                                        Filesize

                                        16.7MB

                                      • memory/4548-9-0x0000000000890000-0x000000000194A000-memory.dmp

                                        Filesize

                                        16.7MB

                                      • memory/4548-62-0x0000000000890000-0x000000000194A000-memory.dmp

                                        Filesize

                                        16.7MB

                                      • memory/4548-63-0x0000000000890000-0x000000000194A000-memory.dmp

                                        Filesize

                                        16.7MB

                                      • memory/4548-65-0x0000000000890000-0x000000000194A000-memory.dmp

                                        Filesize

                                        16.7MB

                                      • memory/4548-68-0x0000000000890000-0x000000000194A000-memory.dmp

                                        Filesize

                                        16.7MB

                                      • memory/4548-69-0x0000000000890000-0x000000000194A000-memory.dmp

                                        Filesize

                                        16.7MB

                                      • memory/4548-71-0x0000000000890000-0x000000000194A000-memory.dmp

                                        Filesize

                                        16.7MB

                                      • memory/4548-77-0x0000000000890000-0x000000000194A000-memory.dmp

                                        Filesize

                                        16.7MB

                                      • memory/4548-78-0x0000000000890000-0x000000000194A000-memory.dmp

                                        Filesize

                                        16.7MB

                                      • memory/4548-81-0x0000000000890000-0x000000000194A000-memory.dmp

                                        Filesize

                                        16.7MB

                                      • memory/4548-83-0x0000000000890000-0x000000000194A000-memory.dmp

                                        Filesize

                                        16.7MB

                                      • memory/4704-60-0x00000000001E0000-0x00000000001E2000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/4704-57-0x00000000001E0000-0x00000000001E2000-memory.dmp

                                        Filesize

                                        8KB

                                      • memory/4704-55-0x00000000001F0000-0x00000000001F1000-memory.dmp

                                        Filesize

                                        4KB

                                      • memory/4704-49-0x0000000000400000-0x0000000000412000-memory.dmp

                                        Filesize

                                        72KB

                                      • memory/4704-120-0x0000000000400000-0x0000000000412000-memory.dmp

                                        Filesize

                                        72KB

                                      • memory/4704-118-0x0000000000B60000-0x0000000001C1A000-memory.dmp

                                        Filesize

                                        16.7MB

                                      • memory/4704-121-0x0000000000B60000-0x0000000001C1A000-memory.dmp

                                        Filesize

                                        16.7MB

                                      We care about your privacy.

                                      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.