Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    04/11/2024, 04:47

General

  • Target

    b748c37f4e969aef69a2e4efff322dcd47d15ffba51b12e8e68800709d3ad9b1N.exe

  • Size

    169KB

  • MD5

    d07164118c47eb4f0a26edbb70894ee0

  • SHA1

    4f7d43a41509cf185941c8057e33941dd3dbaa4d

  • SHA256

    b748c37f4e969aef69a2e4efff322dcd47d15ffba51b12e8e68800709d3ad9b1

  • SHA512

    3cfb80e478d36bd0be5bef949d115daa722b91ff2d0f07653890deef9e1c40b1f7cbc128315878233cad17b8895f1267deed106ea8f0326ab78a019c7ef58a88

  • SSDEEP

    3072:0vgmJAIlSPxX/ZWOFr4JxRRd8KEiPkrMLgGk0Yg1iAQbFJB0sLb:rvIAPxBWOFU/RRdIgXLgGkE/UJBVLb

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Signatures

  • Modifies firewall policy service 3 TTPs 3 IoCs
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

  • Sality family
  • UAC bypass 3 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 6 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Disables Task Manager via registry modification
  • Windows security modification 2 TTPs 7 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • UPX packed file 29 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 5 IoCs
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 32 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 49 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1060
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1116
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
          PID:1148
          • C:\Windows\System32\dzuhbf.exe
            "C:\Windows\System32\dzuhbf.exe"
            2⤵
              PID:1484
            • C:\Users\Admin\AppData\Local\Temp\b748c37f4e969aef69a2e4efff322dcd47d15ffba51b12e8e68800709d3ad9b1N.exe
              "C:\Users\Admin\AppData\Local\Temp\b748c37f4e969aef69a2e4efff322dcd47d15ffba51b12e8e68800709d3ad9b1N.exe"
              2⤵
              • Modifies firewall policy service
              • UAC bypass
              • Windows security bypass
              • Disables RegEdit via registry modification
              • Windows security modification
              • Checks whether UAC is enabled
              • Enumerates connected drives
              • Drops autorun.inf file
              • Drops file in Program Files directory
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:2736
          • C:\Windows\system32\DllHost.exe
            C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
            1⤵
              PID:2040

            Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • F:\fjjio.exe

                    Filesize

                    100KB

                    MD5

                    3e9cc69a59f7299a04e8d8a577f02563

                    SHA1

                    e0910d4106a9a852f5a33cfa0dd68b3c8e94584a

                    SHA256

                    94833a02e690670b3804a2bcb579e7c4b25c0ec79d901bd37e336255b33044f9

                    SHA512

                    3b87d739f74eee31a11b0fbdcb1320cbdbbfd7305a60a49b612f3ee7d15e4044c3cc3c92dfadae9f7759ad4521c4d7767be427dacab2c587da3383096a2443f7

                  • memory/1060-11-0x00000000002A0000-0x00000000002A2000-memory.dmp

                    Filesize

                    8KB

                  • memory/2736-32-0x0000000001DF0000-0x0000000002E7E000-memory.dmp

                    Filesize

                    16.6MB

                  • memory/2736-34-0x0000000001DF0000-0x0000000002E7E000-memory.dmp

                    Filesize

                    16.6MB

                  • memory/2736-10-0x0000000001DF0000-0x0000000002E7E000-memory.dmp

                    Filesize

                    16.6MB

                  • memory/2736-24-0x0000000001C50000-0x0000000001C51000-memory.dmp

                    Filesize

                    4KB

                  • memory/2736-22-0x0000000001C50000-0x0000000001C51000-memory.dmp

                    Filesize

                    4KB

                  • memory/2736-21-0x00000000001F0000-0x00000000001F2000-memory.dmp

                    Filesize

                    8KB

                  • memory/2736-3-0x0000000001DF0000-0x0000000002E7E000-memory.dmp

                    Filesize

                    16.6MB

                  • memory/2736-9-0x0000000001DF0000-0x0000000002E7E000-memory.dmp

                    Filesize

                    16.6MB

                  • memory/2736-6-0x0000000001DF0000-0x0000000002E7E000-memory.dmp

                    Filesize

                    16.6MB

                  • memory/2736-35-0x0000000001DF0000-0x0000000002E7E000-memory.dmp

                    Filesize

                    16.6MB

                  • memory/2736-4-0x0000000001DF0000-0x0000000002E7E000-memory.dmp

                    Filesize

                    16.6MB

                  • memory/2736-7-0x0000000001DF0000-0x0000000002E7E000-memory.dmp

                    Filesize

                    16.6MB

                  • memory/2736-27-0x0000000001C60000-0x0000000001C61000-memory.dmp

                    Filesize

                    4KB

                  • memory/2736-26-0x00000000001F0000-0x00000000001F2000-memory.dmp

                    Filesize

                    8KB

                  • memory/2736-25-0x00000000001F0000-0x00000000001F2000-memory.dmp

                    Filesize

                    8KB

                  • memory/2736-29-0x0000000001DF0000-0x0000000002E7E000-memory.dmp

                    Filesize

                    16.6MB

                  • memory/2736-28-0x0000000001DF0000-0x0000000002E7E000-memory.dmp

                    Filesize

                    16.6MB

                  • memory/2736-30-0x0000000001DF0000-0x0000000002E7E000-memory.dmp

                    Filesize

                    16.6MB

                  • memory/2736-8-0x0000000001DF0000-0x0000000002E7E000-memory.dmp

                    Filesize

                    16.6MB

                  • memory/2736-0-0x0000000000400000-0x0000000000429000-memory.dmp

                    Filesize

                    164KB

                  • memory/2736-5-0x0000000001DF0000-0x0000000002E7E000-memory.dmp

                    Filesize

                    16.6MB

                  • memory/2736-31-0x0000000001DF0000-0x0000000002E7E000-memory.dmp

                    Filesize

                    16.6MB

                  • memory/2736-37-0x0000000001DF0000-0x0000000002E7E000-memory.dmp

                    Filesize

                    16.6MB

                  • memory/2736-36-0x0000000001DF0000-0x0000000002E7E000-memory.dmp

                    Filesize

                    16.6MB

                  • memory/2736-39-0x0000000001DF0000-0x0000000002E7E000-memory.dmp

                    Filesize

                    16.6MB

                  • memory/2736-40-0x00000000001F0000-0x00000000001F2000-memory.dmp

                    Filesize

                    8KB

                  • memory/2736-50-0x0000000001DF0000-0x0000000002E7E000-memory.dmp

                    Filesize

                    16.6MB

                  • memory/2736-51-0x0000000001DF0000-0x0000000002E7E000-memory.dmp

                    Filesize

                    16.6MB

                  • memory/2736-55-0x0000000001DF0000-0x0000000002E7E000-memory.dmp

                    Filesize

                    16.6MB

                  • memory/2736-56-0x0000000001DF0000-0x0000000002E7E000-memory.dmp

                    Filesize

                    16.6MB

                  • memory/2736-59-0x0000000001DF0000-0x0000000002E7E000-memory.dmp

                    Filesize

                    16.6MB

                  • memory/2736-60-0x0000000001DF0000-0x0000000002E7E000-memory.dmp

                    Filesize

                    16.6MB

                  • memory/2736-62-0x0000000001DF0000-0x0000000002E7E000-memory.dmp

                    Filesize

                    16.6MB

                  • memory/2736-64-0x0000000001DF0000-0x0000000002E7E000-memory.dmp

                    Filesize

                    16.6MB

                  • memory/2736-65-0x0000000001DF0000-0x0000000002E7E000-memory.dmp

                    Filesize

                    16.6MB

                  • memory/2736-73-0x0000000001DF0000-0x0000000002E7E000-memory.dmp

                    Filesize

                    16.6MB

                  • memory/2736-1-0x0000000001DF0000-0x0000000002E7E000-memory.dmp

                    Filesize

                    16.6MB

                  • memory/2736-146-0x0000000000400000-0x0000000000429000-memory.dmp

                    Filesize

                    164KB