Analysis

  • max time kernel
    27s
  • max time network
    18s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    04/11/2024, 02:58

General

  • Target

    e1483fd2a8a670c00ed419aea7fcdf4c9059a8f35c6f3056bb62d2240ae891f1N.dll

  • Size

    120KB

  • MD5

    6937fa79db7cab7e8b43946d9dfd4da0

  • SHA1

    c100a86b70a8a0d68d1f644eb2f9f7fef2e818ed

  • SHA256

    e1483fd2a8a670c00ed419aea7fcdf4c9059a8f35c6f3056bb62d2240ae891f1

  • SHA512

    00267a6f7c62ba3eabb2767217b24710450d1f1ac2d818e0e41ce3ee67097ad15b622318758071a13223b11b55eb55775c67c162beabe21f674d7d26dc63bda6

  • SSDEEP

    1536:M02ILRJhGXK9AqRoKREO1i+FCCbFCzB4R7d2byqZ8YSO1VzBE5A6vQGAZUE1:M07RJ8GAq6djgbkzB4+nGY14v/AKW

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

  • Modifies firewall policy service 3 TTPs 6 IoCs
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

  • Sality family
  • UAC bypass 3 TTPs 2 IoCs
  • Windows security bypass 2 TTPs 12 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • Windows security modification 2 TTPs 14 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 15 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file 24 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs
  • System policy modification 1 TTPs 2 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1112
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1168
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
          PID:1208
          • C:\Windows\system32\rundll32.exe
            rundll32.exe C:\Users\Admin\AppData\Local\Temp\e1483fd2a8a670c00ed419aea7fcdf4c9059a8f35c6f3056bb62d2240ae891f1N.dll,#1
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:1804
            • C:\Windows\SysWOW64\rundll32.exe
              rundll32.exe C:\Users\Admin\AppData\Local\Temp\e1483fd2a8a670c00ed419aea7fcdf4c9059a8f35c6f3056bb62d2240ae891f1N.dll,#1
              3⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2192
              • C:\Users\Admin\AppData\Local\Temp\f76955d.exe
                C:\Users\Admin\AppData\Local\Temp\f76955d.exe
                4⤵
                • Modifies firewall policy service
                • UAC bypass
                • Windows security bypass
                • Executes dropped EXE
                • Windows security modification
                • Checks whether UAC is enabled
                • Enumerates connected drives
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:2112
              • C:\Users\Admin\AppData\Local\Temp\f7698c6.exe
                C:\Users\Admin\AppData\Local\Temp\f7698c6.exe
                4⤵
                • Executes dropped EXE
                PID:2828
              • C:\Users\Admin\AppData\Local\Temp\f76b0b9.exe
                C:\Users\Admin\AppData\Local\Temp\f76b0b9.exe
                4⤵
                • Modifies firewall policy service
                • UAC bypass
                • Windows security bypass
                • Executes dropped EXE
                • Windows security modification
                • Checks whether UAC is enabled
                • Enumerates connected drives
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:2716
        • C:\Windows\system32\DllHost.exe
          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
          1⤵
            PID:1268

          Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Windows\SYSTEM.INI

                  Filesize

                  257B

                  MD5

                  e3d0f50afa3c5c1dcfea5ac798bd3eab

                  SHA1

                  2beed7f2624767bdee8d469faf4a4fa6c0ec8a65

                  SHA256

                  26d7398736b1e19275e28721a38bfaabd92d08ac45cd92021f9694993c4558c0

                  SHA512

                  ccbd5275d9f5cf283c2831b9444521b1c3d4059d7480bc851b3c563a410f7f2f09f7baa4fd998800db4c0d6f8820d9fb48941d11e9f6324f9d8d6f3bb9127a25

                • \Users\Admin\AppData\Local\Temp\f76955d.exe

                  Filesize

                  97KB

                  MD5

                  236c7418d5409697603b140fc21a8e69

                  SHA1

                  15c39e1637ff8968ce187e305320820ae9ce03a6

                  SHA256

                  b6d02eab6acbeb5720cef53b569adbbae263aaf2ab9320c7a11751176e0f7ba6

                  SHA512

                  7d798a7f4551047f65dfb84ad425cedb833c2e4e1aec3dfe6df50e56fcc630e27b9b296dc0e9eee41f534486d7564a3c5899c343d9d66cf84d79df05d85d0baf

                • memory/1112-30-0x00000000001E0000-0x00000000001E2000-memory.dmp

                  Filesize

                  8KB

                • memory/2112-63-0x0000000000590000-0x000000000164A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2112-52-0x00000000017E0000-0x00000000017E2000-memory.dmp

                  Filesize

                  8KB

                • memory/2112-13-0x0000000000400000-0x0000000000412000-memory.dmp

                  Filesize

                  72KB

                • memory/2112-64-0x0000000000590000-0x000000000164A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2112-17-0x0000000000590000-0x000000000164A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2112-14-0x0000000000590000-0x000000000164A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2112-20-0x0000000000590000-0x000000000164A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2112-23-0x0000000000590000-0x000000000164A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2112-18-0x0000000000590000-0x000000000164A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2112-21-0x0000000000590000-0x000000000164A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2112-16-0x0000000000590000-0x000000000164A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2112-24-0x0000000000590000-0x000000000164A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2112-22-0x0000000000590000-0x000000000164A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2112-152-0x0000000000590000-0x000000000164A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2112-19-0x0000000000590000-0x000000000164A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2112-153-0x0000000000400000-0x0000000000412000-memory.dmp

                  Filesize

                  72KB

                • memory/2112-90-0x0000000000590000-0x000000000164A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2112-89-0x0000000000590000-0x000000000164A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2112-85-0x0000000000590000-0x000000000164A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2112-50-0x00000000017E0000-0x00000000017E2000-memory.dmp

                  Filesize

                  8KB

                • memory/2112-49-0x0000000004230000-0x0000000004231000-memory.dmp

                  Filesize

                  4KB

                • memory/2112-65-0x0000000000590000-0x000000000164A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2112-84-0x0000000000590000-0x000000000164A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2112-70-0x0000000000590000-0x000000000164A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2112-69-0x0000000000590000-0x000000000164A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2112-66-0x0000000000590000-0x000000000164A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2112-67-0x0000000000590000-0x000000000164A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2192-11-0x0000000000110000-0x0000000000122000-memory.dmp

                  Filesize

                  72KB

                • memory/2192-78-0x00000000001F0000-0x00000000001F2000-memory.dmp

                  Filesize

                  8KB

                • memory/2192-1-0x0000000010000000-0x0000000010020000-memory.dmp

                  Filesize

                  128KB

                • memory/2192-3-0x0000000010000000-0x0000000010020000-memory.dmp

                  Filesize

                  128KB

                • memory/2192-38-0x00000000001F0000-0x00000000001F2000-memory.dmp

                  Filesize

                  8KB

                • memory/2192-39-0x0000000000200000-0x0000000000201000-memory.dmp

                  Filesize

                  4KB

                • memory/2192-82-0x0000000000110000-0x0000000000112000-memory.dmp

                  Filesize

                  8KB

                • memory/2192-6-0x0000000000110000-0x0000000000122000-memory.dmp

                  Filesize

                  72KB

                • memory/2192-0-0x0000000010000000-0x0000000010020000-memory.dmp

                  Filesize

                  128KB

                • memory/2192-41-0x0000000000200000-0x0000000000201000-memory.dmp

                  Filesize

                  4KB

                • memory/2192-51-0x00000000001F0000-0x00000000001F2000-memory.dmp

                  Filesize

                  8KB

                • memory/2192-60-0x00000000009A0000-0x00000000009B2000-memory.dmp

                  Filesize

                  72KB

                • memory/2192-61-0x00000000009A0000-0x00000000009B2000-memory.dmp

                  Filesize

                  72KB

                • memory/2192-42-0x00000000001F0000-0x00000000001F2000-memory.dmp

                  Filesize

                  8KB

                • memory/2716-112-0x0000000000360000-0x0000000000362000-memory.dmp

                  Filesize

                  8KB

                • memory/2716-111-0x00000000003F0000-0x00000000003F1000-memory.dmp

                  Filesize

                  4KB

                • memory/2716-83-0x0000000000400000-0x0000000000412000-memory.dmp

                  Filesize

                  72KB

                • memory/2716-182-0x0000000000920000-0x00000000019DA000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2716-208-0x0000000000400000-0x0000000000412000-memory.dmp

                  Filesize

                  72KB

                • memory/2716-207-0x0000000000920000-0x00000000019DA000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2828-105-0x0000000000360000-0x0000000000362000-memory.dmp

                  Filesize

                  8KB

                • memory/2828-102-0x0000000000360000-0x0000000000362000-memory.dmp

                  Filesize

                  8KB

                • memory/2828-101-0x0000000000370000-0x0000000000371000-memory.dmp

                  Filesize

                  4KB

                • memory/2828-131-0x0000000000360000-0x0000000000362000-memory.dmp

                  Filesize

                  8KB

                • memory/2828-62-0x0000000000400000-0x0000000000412000-memory.dmp

                  Filesize

                  72KB

                • memory/2828-157-0x0000000000400000-0x0000000000412000-memory.dmp

                  Filesize

                  72KB