Analysis

  • max time kernel
    71s
  • max time network
    18s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    07/11/2024, 08:09

General

  • Target

    5bf5496d1a4b920e2a6638a7aec7d698735034a31f14caa0a9c0c4910af66d96N.dll

  • Size

    120KB

  • MD5

    da5df45ef173a25286f94ff388046260

  • SHA1

    797fbbffc4e3b893f558cbac204efeb90b11615c

  • SHA256

    5bf5496d1a4b920e2a6638a7aec7d698735034a31f14caa0a9c0c4910af66d96

  • SHA512

    276d0f59787012ac89d6dfe6de18b7c702b8cb3c48f46ce6026f8d11e7799f3b760bad180a4cd24a792f9ee29566f7ab988e1f74b12fe1c25e4fbc5669dba54b

  • SSDEEP

    1536:cddxGEUt+Rdk0lKP4G5lH9Q3KVAuCsX+hFJLuM2nu04Ncp+88JMu7rL3ZxjFjCD:cdxGE++vkIY4MHdtXA9uM2uF886wLjG

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

  • Modifies firewall policy service 3 TTPs 6 IoCs
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

  • Sality family
  • UAC bypass 3 TTPs 2 IoCs
  • Windows security bypass 2 TTPs 12 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • Windows security modification 2 TTPs 14 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 9 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file 25 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs
  • System policy modification 1 TTPs 2 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1096
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1164
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
          PID:1204
          • C:\Windows\system32\rundll32.exe
            rundll32.exe C:\Users\Admin\AppData\Local\Temp\5bf5496d1a4b920e2a6638a7aec7d698735034a31f14caa0a9c0c4910af66d96N.dll,#1
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2484
            • C:\Windows\SysWOW64\rundll32.exe
              rundll32.exe C:\Users\Admin\AppData\Local\Temp\5bf5496d1a4b920e2a6638a7aec7d698735034a31f14caa0a9c0c4910af66d96N.dll,#1
              3⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2748
              • C:\Users\Admin\AppData\Local\Temp\f774808.exe
                C:\Users\Admin\AppData\Local\Temp\f774808.exe
                4⤵
                • Modifies firewall policy service
                • UAC bypass
                • Windows security bypass
                • Executes dropped EXE
                • Windows security modification
                • Checks whether UAC is enabled
                • Enumerates connected drives
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:2832
              • C:\Users\Admin\AppData\Local\Temp\f774ae5.exe
                C:\Users\Admin\AppData\Local\Temp\f774ae5.exe
                4⤵
                • Modifies firewall policy service
                • UAC bypass
                • Windows security bypass
                • Executes dropped EXE
                • Windows security modification
                • Checks whether UAC is enabled
                • Drops file in Windows directory
                • System policy modification
                PID:2664
              • C:\Users\Admin\AppData\Local\Temp\f77625b.exe
                C:\Users\Admin\AppData\Local\Temp\f77625b.exe
                4⤵
                • Executes dropped EXE
                PID:1672
        • C:\Windows\system32\DllHost.exe
          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
          1⤵
            PID:1508

          Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Windows\SYSTEM.INI

                  Filesize

                  257B

                  MD5

                  768936674c6e046ce5babf298d564abe

                  SHA1

                  43901b1e34acaa0986a137649050edc94d5638ee

                  SHA256

                  905a8ccef3cdbf90a4cc3de598985e2946f8ccb27ff9b3c8049636f388cb0aa7

                  SHA512

                  94b53614edd6eb854cc75cbb05a4a49d17e25412d3ed6703c3440b23e56d72959efdf275544e581e756eeda96c0eb354a24fc4602f8a13da053f50dd6e347cfc

                • \Users\Admin\AppData\Local\Temp\f774808.exe

                  Filesize

                  97KB

                  MD5

                  4295ae0c4ec24a93fac3f81dfb71a631

                  SHA1

                  2f6be4826fcf19f690de3cdf95a33e8ccbe09732

                  SHA256

                  d9d3c6c0301fd38bedc655c9e65620b592bd5382d6021547daf1afab6d9d35fe

                  SHA512

                  9c304bee06d4639a0f9b09d9403302f26ed216866fdca4df3dc619f73d05089402651922d8f5339af5dbdba5a7696be9547952bdcbdcb5509e5fc838e61c0fcd

                • memory/1096-23-0x0000000001B40000-0x0000000001B42000-memory.dmp

                  Filesize

                  8KB

                • memory/1672-159-0x0000000000360000-0x0000000000362000-memory.dmp

                  Filesize

                  8KB

                • memory/1672-177-0x0000000000400000-0x0000000000412000-memory.dmp

                  Filesize

                  72KB

                • memory/1672-79-0x0000000000400000-0x0000000000412000-memory.dmp

                  Filesize

                  72KB

                • memory/1672-106-0x0000000000360000-0x0000000000362000-memory.dmp

                  Filesize

                  8KB

                • memory/1672-104-0x00000000003F0000-0x00000000003F1000-memory.dmp

                  Filesize

                  4KB

                • memory/2664-172-0x0000000000920000-0x00000000019DA000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2664-156-0x0000000000920000-0x00000000019DA000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2664-95-0x00000000001C0000-0x00000000001C1000-memory.dmp

                  Filesize

                  4KB

                • memory/2664-173-0x0000000000400000-0x0000000000412000-memory.dmp

                  Filesize

                  72KB

                • memory/2664-103-0x00000000001B0000-0x00000000001B2000-memory.dmp

                  Filesize

                  8KB

                • memory/2664-102-0x00000000001B0000-0x00000000001B2000-memory.dmp

                  Filesize

                  8KB

                • memory/2664-62-0x0000000000400000-0x0000000000412000-memory.dmp

                  Filesize

                  72KB

                • memory/2664-122-0x00000000001B0000-0x00000000001B2000-memory.dmp

                  Filesize

                  8KB

                • memory/2748-1-0x0000000010000000-0x0000000010020000-memory.dmp

                  Filesize

                  128KB

                • memory/2748-76-0x00000000001B0000-0x00000000001B2000-memory.dmp

                  Filesize

                  8KB

                • memory/2748-42-0x00000000001C0000-0x00000000001C1000-memory.dmp

                  Filesize

                  4KB

                • memory/2748-32-0x00000000001C0000-0x00000000001C1000-memory.dmp

                  Filesize

                  4KB

                • memory/2748-61-0x00000000001B0000-0x00000000001B2000-memory.dmp

                  Filesize

                  8KB

                • memory/2748-58-0x00000000001B0000-0x00000000001B2000-memory.dmp

                  Filesize

                  8KB

                • memory/2748-31-0x00000000001B0000-0x00000000001B2000-memory.dmp

                  Filesize

                  8KB

                • memory/2748-9-0x0000000000190000-0x00000000001A2000-memory.dmp

                  Filesize

                  72KB

                • memory/2748-60-0x00000000001D0000-0x00000000001E2000-memory.dmp

                  Filesize

                  72KB

                • memory/2748-69-0x0000000000230000-0x0000000000242000-memory.dmp

                  Filesize

                  72KB

                • memory/2748-10-0x0000000000190000-0x00000000001A2000-memory.dmp

                  Filesize

                  72KB

                • memory/2748-75-0x0000000000230000-0x0000000000242000-memory.dmp

                  Filesize

                  72KB

                • memory/2832-20-0x00000000006E0000-0x000000000179A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2832-85-0x00000000006E0000-0x000000000179A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2832-64-0x00000000006E0000-0x000000000179A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2832-16-0x00000000006E0000-0x000000000179A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2832-80-0x00000000004B0000-0x00000000004B2000-memory.dmp

                  Filesize

                  8KB

                • memory/2832-81-0x00000000006E0000-0x000000000179A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2832-63-0x00000000006E0000-0x000000000179A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2832-17-0x00000000006E0000-0x000000000179A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2832-82-0x00000000006E0000-0x000000000179A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2832-83-0x00000000006E0000-0x000000000179A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2832-44-0x00000000004C0000-0x00000000004C1000-memory.dmp

                  Filesize

                  4KB

                • memory/2832-21-0x00000000006E0000-0x000000000179A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2832-22-0x00000000006E0000-0x000000000179A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2832-51-0x00000000004B0000-0x00000000004B2000-memory.dmp

                  Filesize

                  8KB

                • memory/2832-18-0x00000000006E0000-0x000000000179A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2832-65-0x00000000006E0000-0x000000000179A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2832-107-0x00000000006E0000-0x000000000179A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2832-108-0x00000000006E0000-0x000000000179A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2832-110-0x00000000006E0000-0x000000000179A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2832-112-0x00000000006E0000-0x000000000179A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2832-19-0x00000000006E0000-0x000000000179A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2832-145-0x0000000000400000-0x0000000000412000-memory.dmp

                  Filesize

                  72KB

                • memory/2832-146-0x00000000006E0000-0x000000000179A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2832-41-0x00000000006E0000-0x000000000179A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2832-49-0x00000000004B0000-0x00000000004B2000-memory.dmp

                  Filesize

                  8KB

                • memory/2832-12-0x00000000006E0000-0x000000000179A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2832-15-0x00000000006E0000-0x000000000179A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2832-14-0x00000000006E0000-0x000000000179A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2832-11-0x0000000000400000-0x0000000000412000-memory.dmp

                  Filesize

                  72KB