Analysis

  • max time kernel
    27s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    07/11/2024, 03:36

General

  • Target

    ac287ce5d3b1ab3e0a5849cea18c94b18405b7e4fbca8ab54bfc7f0fdf5d41edN.dll

  • Size

    120KB

  • MD5

    2b81d539bf2999905b2f078159b60b50

  • SHA1

    c75a7f4976b566bae810b8e0242ccf3a5fbb1e71

  • SHA256

    ac287ce5d3b1ab3e0a5849cea18c94b18405b7e4fbca8ab54bfc7f0fdf5d41ed

  • SHA512

    fd02617215ab2a87714cfe3741f3e97caac4e2159534f70653d6fdfcb3e60781e54fe158d29aa2f3de9208f4e75dd2588d73e638f97e3bd73b7d7963b250ed85

  • SSDEEP

    3072:vKu8S8NeoQqnCZtQ21syk4SjOdRkLmF7DVyiEy:vKumQqb2iaSjMmyF7DVyit

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

  • Modifies firewall policy service 3 TTPs 6 IoCs
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

  • Sality family
  • UAC bypass 3 TTPs 2 IoCs
  • Windows security bypass 2 TTPs 12 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • Windows security modification 2 TTPs 14 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 14 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file 24 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs
  • System policy modification 1 TTPs 2 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1116
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1180
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
          PID:1256
          • C:\Windows\system32\rundll32.exe
            rundll32.exe C:\Users\Admin\AppData\Local\Temp\ac287ce5d3b1ab3e0a5849cea18c94b18405b7e4fbca8ab54bfc7f0fdf5d41edN.dll,#1
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2340
            • C:\Windows\SysWOW64\rundll32.exe
              rundll32.exe C:\Users\Admin\AppData\Local\Temp\ac287ce5d3b1ab3e0a5849cea18c94b18405b7e4fbca8ab54bfc7f0fdf5d41edN.dll,#1
              3⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2368
              • C:\Users\Admin\AppData\Local\Temp\f76c39d.exe
                C:\Users\Admin\AppData\Local\Temp\f76c39d.exe
                4⤵
                • Modifies firewall policy service
                • UAC bypass
                • Windows security bypass
                • Executes dropped EXE
                • Windows security modification
                • Checks whether UAC is enabled
                • Enumerates connected drives
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:2056
              • C:\Users\Admin\AppData\Local\Temp\f76c948.exe
                C:\Users\Admin\AppData\Local\Temp\f76c948.exe
                4⤵
                • Executes dropped EXE
                PID:2844
              • C:\Users\Admin\AppData\Local\Temp\f76df76.exe
                C:\Users\Admin\AppData\Local\Temp\f76df76.exe
                4⤵
                • Modifies firewall policy service
                • UAC bypass
                • Windows security bypass
                • Executes dropped EXE
                • Windows security modification
                • Checks whether UAC is enabled
                • Enumerates connected drives
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:2592
        • C:\Windows\system32\DllHost.exe
          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
          1⤵
            PID:1328

          Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\f76c39d.exe

                  Filesize

                  97KB

                  MD5

                  ef12d3e8a6497f39758698927b4e5923

                  SHA1

                  f4178987a21f73b3577e6dea3bcabcbda5f5927c

                  SHA256

                  e83e6f4c004ad1fbf7977a859753f121d1a462079cb7952ba33947739f076b33

                  SHA512

                  79f29c442c41c464da94bcd8f079b61dc533917886bea9c5c707c23dc96212bd5ccd4fafa55c904cf325425962c8f8ab0750c065bfbcd8182972a9ffe72962f5

                • C:\Windows\SYSTEM.INI

                  Filesize

                  257B

                  MD5

                  f4067fa178e8e0568675e65141cdd52c

                  SHA1

                  d15a78cf559296b8b807c7a3ebe5322461dbf135

                  SHA256

                  6fc2c9d7047a730764d9949d879ac5c2053dd2db60015af1fd1fe884ea504970

                  SHA512

                  1bf2bf08a0c7e0fac42c609819b1082ca05b71124f75d862ee39a769ed4f7f16b7734ec0384aed29c6a0cd0d23fa0e30b394aeb5cd330fd172c77312023c6b3b

                • memory/1116-28-0x00000000002D0000-0x00000000002D2000-memory.dmp

                  Filesize

                  8KB

                • memory/2056-89-0x0000000000660000-0x000000000171A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2056-65-0x0000000000660000-0x000000000171A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2056-15-0x0000000000660000-0x000000000171A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2056-14-0x0000000000660000-0x000000000171A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2056-17-0x0000000000660000-0x000000000171A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2056-22-0x0000000000660000-0x000000000171A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2056-16-0x0000000000660000-0x000000000171A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2056-21-0x0000000000660000-0x000000000171A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2056-20-0x0000000000660000-0x000000000171A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2056-18-0x0000000000660000-0x000000000171A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2056-13-0x0000000000660000-0x000000000171A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2056-10-0x0000000000400000-0x0000000000412000-memory.dmp

                  Filesize

                  72KB

                • memory/2056-67-0x0000000000660000-0x000000000171A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2056-84-0x0000000000660000-0x000000000171A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2056-158-0x0000000000660000-0x000000000171A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2056-64-0x00000000003F0000-0x00000000003F2000-memory.dmp

                  Filesize

                  8KB

                • memory/2056-48-0x00000000017A0000-0x00000000017A1000-memory.dmp

                  Filesize

                  4KB

                • memory/2056-50-0x0000000000660000-0x000000000171A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2056-66-0x0000000000660000-0x000000000171A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2056-53-0x0000000000660000-0x000000000171A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2056-62-0x00000000003F0000-0x00000000003F2000-memory.dmp

                  Filesize

                  8KB

                • memory/2056-90-0x0000000000660000-0x000000000171A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2056-87-0x0000000000660000-0x000000000171A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2056-86-0x0000000000660000-0x000000000171A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2056-19-0x0000000000660000-0x000000000171A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2056-157-0x0000000000400000-0x0000000000412000-memory.dmp

                  Filesize

                  72KB

                • memory/2056-85-0x00000000003F0000-0x00000000003F2000-memory.dmp

                  Filesize

                  8KB

                • memory/2368-38-0x0000000000280000-0x0000000000281000-memory.dmp

                  Filesize

                  4KB

                • memory/2368-80-0x00000000002C0000-0x00000000002D2000-memory.dmp

                  Filesize

                  72KB

                • memory/2368-79-0x00000000002C0000-0x00000000002D2000-memory.dmp

                  Filesize

                  72KB

                • memory/2368-77-0x00000000001E0000-0x00000000001E2000-memory.dmp

                  Filesize

                  8KB

                • memory/2368-41-0x0000000000280000-0x0000000000281000-memory.dmp

                  Filesize

                  4KB

                • memory/2368-81-0x0000000000400000-0x0000000000412000-memory.dmp

                  Filesize

                  72KB

                • memory/2368-8-0x0000000000400000-0x0000000000412000-memory.dmp

                  Filesize

                  72KB

                • memory/2368-58-0x00000000001E0000-0x00000000001E2000-memory.dmp

                  Filesize

                  8KB

                • memory/2368-59-0x00000000002A0000-0x00000000002B2000-memory.dmp

                  Filesize

                  72KB

                • memory/2368-1-0x0000000010000000-0x0000000010020000-memory.dmp

                  Filesize

                  128KB

                • memory/2368-60-0x00000000001E0000-0x00000000001E2000-memory.dmp

                  Filesize

                  8KB

                • memory/2368-37-0x00000000001E0000-0x00000000001E2000-memory.dmp

                  Filesize

                  8KB

                • memory/2592-113-0x00000000001B0000-0x00000000001B2000-memory.dmp

                  Filesize

                  8KB

                • memory/2592-109-0x00000000001C0000-0x00000000001C1000-memory.dmp

                  Filesize

                  4KB

                • memory/2592-160-0x00000000001B0000-0x00000000001B2000-memory.dmp

                  Filesize

                  8KB

                • memory/2592-83-0x0000000000400000-0x0000000000412000-memory.dmp

                  Filesize

                  72KB

                • memory/2592-189-0x0000000000920000-0x00000000019DA000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2592-215-0x0000000000920000-0x00000000019DA000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2592-214-0x0000000000400000-0x0000000000412000-memory.dmp

                  Filesize

                  72KB

                • memory/2844-112-0x0000000000260000-0x0000000000262000-memory.dmp

                  Filesize

                  8KB

                • memory/2844-110-0x0000000000260000-0x0000000000262000-memory.dmp

                  Filesize

                  8KB

                • memory/2844-63-0x0000000000400000-0x0000000000412000-memory.dmp

                  Filesize

                  72KB

                • memory/2844-103-0x00000000002B0000-0x00000000002B1000-memory.dmp

                  Filesize

                  4KB

                • memory/2844-159-0x0000000000260000-0x0000000000262000-memory.dmp

                  Filesize

                  8KB

                • memory/2844-164-0x0000000000400000-0x0000000000412000-memory.dmp

                  Filesize

                  72KB