Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04/10/2024, 09:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2b6299ed051392c0ad1244244967ac1bf42a7743d07567887e9dc18352e76492.dll
Resource
win7-20240903-en
windows7-x64
16 signatures
150 seconds
General
-
Target
2b6299ed051392c0ad1244244967ac1bf42a7743d07567887e9dc18352e76492.dll
-
Size
120KB
-
MD5
80affcdccc25797af3deadac82bae480
-
SHA1
016be339264ba6056fef53bf793b44ecf7c6ce46
-
SHA256
2b6299ed051392c0ad1244244967ac1bf42a7743d07567887e9dc18352e76492
-
SHA512
db94d62f52787778cb48a08d7062ec107b0440170c31bc0d1c37c7ee1aefddfa9d49258f1ec3a342caf36d9b6f1b683951cfeda1d9247c4e37ccc139e0039034
-
SSDEEP
1536:JUVYLyOUVTfcWpUSKABHmqBfQdcU8lTihWk/NdB/1BWo3ALvNMIsf:JqOUVrbUSDBqsWhvt/1VKGIs
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76e9b3.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76e9b3.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76e9b3.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f77055e.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f77055e.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f77055e.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76e9b3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f77055e.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f77055e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f77055e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76e9b3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76e9b3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76e9b3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f77055e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f77055e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f77055e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f77055e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76e9b3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76e9b3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76e9b3.exe -
Executes dropped EXE 3 IoCs
pid Process 2780 f76e9b3.exe 2980 f76eb58.exe 2404 f77055e.exe -
Loads dropped DLL 6 IoCs
pid Process 2692 rundll32.exe 2692 rundll32.exe 2692 rundll32.exe 2692 rundll32.exe 2692 rundll32.exe 2692 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76e9b3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76e9b3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76e9b3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76e9b3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f77055e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76e9b3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f77055e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f77055e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f77055e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f77055e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76e9b3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f77055e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f77055e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76e9b3.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76e9b3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f77055e.exe -
Enumerates connected drives 3 TTPs 17 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: f76e9b3.exe File opened (read-only) \??\M: f76e9b3.exe File opened (read-only) \??\E: f77055e.exe File opened (read-only) \??\G: f77055e.exe File opened (read-only) \??\G: f76e9b3.exe File opened (read-only) \??\J: f76e9b3.exe File opened (read-only) \??\Q: f76e9b3.exe File opened (read-only) \??\T: f76e9b3.exe File opened (read-only) \??\I: f76e9b3.exe File opened (read-only) \??\K: f76e9b3.exe File opened (read-only) \??\L: f76e9b3.exe File opened (read-only) \??\N: f76e9b3.exe File opened (read-only) \??\O: f76e9b3.exe File opened (read-only) \??\R: f76e9b3.exe File opened (read-only) \??\S: f76e9b3.exe File opened (read-only) \??\E: f76e9b3.exe File opened (read-only) \??\P: f76e9b3.exe -
resource yara_rule behavioral1/memory/2780-12-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2780-16-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2780-14-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2780-17-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2780-20-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2780-19-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2780-15-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2780-22-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2780-21-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2780-18-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2780-63-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2780-64-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2780-65-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2780-67-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2780-66-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2780-70-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2780-71-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2780-86-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2780-88-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2780-90-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2780-162-0x0000000000690000-0x000000000174A000-memory.dmp upx behavioral1/memory/2404-181-0x0000000000910000-0x00000000019CA000-memory.dmp upx behavioral1/memory/2404-218-0x0000000000910000-0x00000000019CA000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\f76ea20 f76e9b3.exe File opened for modification C:\Windows\SYSTEM.INI f76e9b3.exe File created C:\Windows\f773a52 f77055e.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76e9b3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f77055e.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2780 f76e9b3.exe 2780 f76e9b3.exe 2404 f77055e.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 2780 f76e9b3.exe Token: SeDebugPrivilege 2780 f76e9b3.exe Token: SeDebugPrivilege 2780 f76e9b3.exe Token: SeDebugPrivilege 2780 f76e9b3.exe Token: SeDebugPrivilege 2780 f76e9b3.exe Token: SeDebugPrivilege 2780 f76e9b3.exe Token: SeDebugPrivilege 2780 f76e9b3.exe Token: SeDebugPrivilege 2780 f76e9b3.exe Token: SeDebugPrivilege 2780 f76e9b3.exe Token: SeDebugPrivilege 2780 f76e9b3.exe Token: SeDebugPrivilege 2780 f76e9b3.exe Token: SeDebugPrivilege 2780 f76e9b3.exe Token: SeDebugPrivilege 2780 f76e9b3.exe Token: SeDebugPrivilege 2780 f76e9b3.exe Token: SeDebugPrivilege 2780 f76e9b3.exe Token: SeDebugPrivilege 2780 f76e9b3.exe Token: SeDebugPrivilege 2780 f76e9b3.exe Token: SeDebugPrivilege 2780 f76e9b3.exe Token: SeDebugPrivilege 2780 f76e9b3.exe Token: SeDebugPrivilege 2780 f76e9b3.exe Token: SeDebugPrivilege 2780 f76e9b3.exe Token: SeDebugPrivilege 2780 f76e9b3.exe Token: SeDebugPrivilege 2780 f76e9b3.exe Token: SeDebugPrivilege 2780 f76e9b3.exe Token: SeDebugPrivilege 2404 f77055e.exe Token: SeDebugPrivilege 2404 f77055e.exe Token: SeDebugPrivilege 2404 f77055e.exe Token: SeDebugPrivilege 2404 f77055e.exe Token: SeDebugPrivilege 2404 f77055e.exe Token: SeDebugPrivilege 2404 f77055e.exe Token: SeDebugPrivilege 2404 f77055e.exe Token: SeDebugPrivilege 2404 f77055e.exe Token: SeDebugPrivilege 2404 f77055e.exe Token: SeDebugPrivilege 2404 f77055e.exe Token: SeDebugPrivilege 2404 f77055e.exe Token: SeDebugPrivilege 2404 f77055e.exe Token: SeDebugPrivilege 2404 f77055e.exe Token: SeDebugPrivilege 2404 f77055e.exe Token: SeDebugPrivilege 2404 f77055e.exe Token: SeDebugPrivilege 2404 f77055e.exe Token: SeDebugPrivilege 2404 f77055e.exe Token: SeDebugPrivilege 2404 f77055e.exe Token: SeDebugPrivilege 2404 f77055e.exe Token: SeDebugPrivilege 2404 f77055e.exe Token: SeDebugPrivilege 2404 f77055e.exe Token: SeDebugPrivilege 2404 f77055e.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 3052 wrote to memory of 2692 3052 rundll32.exe 31 PID 3052 wrote to memory of 2692 3052 rundll32.exe 31 PID 3052 wrote to memory of 2692 3052 rundll32.exe 31 PID 3052 wrote to memory of 2692 3052 rundll32.exe 31 PID 3052 wrote to memory of 2692 3052 rundll32.exe 31 PID 3052 wrote to memory of 2692 3052 rundll32.exe 31 PID 3052 wrote to memory of 2692 3052 rundll32.exe 31 PID 2692 wrote to memory of 2780 2692 rundll32.exe 32 PID 2692 wrote to memory of 2780 2692 rundll32.exe 32 PID 2692 wrote to memory of 2780 2692 rundll32.exe 32 PID 2692 wrote to memory of 2780 2692 rundll32.exe 32 PID 2780 wrote to memory of 1120 2780 f76e9b3.exe 19 PID 2780 wrote to memory of 1160 2780 f76e9b3.exe 20 PID 2780 wrote to memory of 1188 2780 f76e9b3.exe 21 PID 2780 wrote to memory of 1524 2780 f76e9b3.exe 23 PID 2780 wrote to memory of 3052 2780 f76e9b3.exe 30 PID 2780 wrote to memory of 2692 2780 f76e9b3.exe 31 PID 2780 wrote to memory of 2692 2780 f76e9b3.exe 31 PID 2692 wrote to memory of 2980 2692 rundll32.exe 33 PID 2692 wrote to memory of 2980 2692 rundll32.exe 33 PID 2692 wrote to memory of 2980 2692 rundll32.exe 33 PID 2692 wrote to memory of 2980 2692 rundll32.exe 33 PID 2692 wrote to memory of 2404 2692 rundll32.exe 34 PID 2692 wrote to memory of 2404 2692 rundll32.exe 34 PID 2692 wrote to memory of 2404 2692 rundll32.exe 34 PID 2692 wrote to memory of 2404 2692 rundll32.exe 34 PID 2780 wrote to memory of 1120 2780 f76e9b3.exe 19 PID 2780 wrote to memory of 1160 2780 f76e9b3.exe 20 PID 2780 wrote to memory of 1188 2780 f76e9b3.exe 21 PID 2780 wrote to memory of 1524 2780 f76e9b3.exe 23 PID 2780 wrote to memory of 2980 2780 f76e9b3.exe 33 PID 2780 wrote to memory of 2980 2780 f76e9b3.exe 33 PID 2780 wrote to memory of 2404 2780 f76e9b3.exe 34 PID 2780 wrote to memory of 2404 2780 f76e9b3.exe 34 PID 2404 wrote to memory of 1120 2404 f77055e.exe 19 PID 2404 wrote to memory of 1160 2404 f77055e.exe 20 PID 2404 wrote to memory of 1188 2404 f77055e.exe 21 PID 2404 wrote to memory of 1524 2404 f77055e.exe 23 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76e9b3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f77055e.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1120
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1160
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1188
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6299ed051392c0ad1244244967ac1bf42a7743d07567887e9dc18352e76492.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b6299ed051392c0ad1244244967ac1bf42a7743d07567887e9dc18352e76492.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\f76e9b3.exeC:\Users\Admin\AppData\Local\Temp\f76e9b3.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2780
-
-
C:\Users\Admin\AppData\Local\Temp\f76eb58.exeC:\Users\Admin\AppData\Local\Temp\f76eb58.exe4⤵
- Executes dropped EXE
PID:2980
-
-
C:\Users\Admin\AppData\Local\Temp\f77055e.exeC:\Users\Admin\AppData\Local\Temp\f77055e.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2404
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1524
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD584d6ab967e42a403f4520e675668af29
SHA1a01189da4111ca5c8b221472ee7ecb00190134e6
SHA2569ea762db152eb532a870dc8f5e7b77b3e57fc4c1f368ce2e7340ceaf70a45d0d
SHA5125959a0e0e5a1ded48c4540adb8e6e9336cba215b23da1f5f479df04af583bce6c2f69f9fc5de6b9893257b5c75fae91b34cf27776f94c1400d001e67367e7995
-
Filesize
257B
MD540107c956e632cb69b40809d51154889
SHA1b8406c0292c86e26de9eecd3767e4f626ea790d2
SHA2561fca5fe2cb8f1c2d4c84ddd61d25cdbf074a31f52963ddfc969d7a76691d7624
SHA51236cc40c5a1d60f5306bdbefc47817d9ffa6f0e58d95b44ebd671dd7db1f82bc55989f5f1f3a30f4974e93329fb37ad8ebdc03aa51b5b0200de60f8d2f9f3fe37