Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    12/11/2024, 21:36

General

  • Target

    4471ec4b2b6280b130c29c74c6438b61cc4eac5411cbb7984177e64f382e0be4.dll

  • Size

    120KB

  • MD5

    569dbc3e62f64310d59e8feb04e67efa

  • SHA1

    78207b8218f357a31cc489b1bcc43273211ee09b

  • SHA256

    4471ec4b2b6280b130c29c74c6438b61cc4eac5411cbb7984177e64f382e0be4

  • SHA512

    e0804d23fcab2576e422cd06e4cf6aed634ddcce8e0e74de7826d1078af402bb7c2e536dc2a659bcae0279846cb556016ba7bccb4dc2355a34f0b0c2138d1adc

  • SSDEEP

    3072:IArJjMrZDYiin0kCKBXcbbAZ13quJCbT:IeJjMrxYfM0MXAJEbT

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

  • Modifies firewall policy service 3 TTPs 6 IoCs
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

  • Sality family
  • UAC bypass 3 TTPs 2 IoCs
  • Windows security bypass 2 TTPs 12 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • Windows security modification 2 TTPs 14 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 17 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file 25 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs
  • System policy modification 1 TTPs 2 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1072
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1120
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
          PID:1184
          • C:\Windows\system32\rundll32.exe
            rundll32.exe C:\Users\Admin\AppData\Local\Temp\4471ec4b2b6280b130c29c74c6438b61cc4eac5411cbb7984177e64f382e0be4.dll,#1
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:1808
            • C:\Windows\SysWOW64\rundll32.exe
              rundll32.exe C:\Users\Admin\AppData\Local\Temp\4471ec4b2b6280b130c29c74c6438b61cc4eac5411cbb7984177e64f382e0be4.dll,#1
              3⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1872
              • C:\Users\Admin\AppData\Local\Temp\f767e92.exe
                C:\Users\Admin\AppData\Local\Temp\f767e92.exe
                4⤵
                • Modifies firewall policy service
                • UAC bypass
                • Windows security bypass
                • Executes dropped EXE
                • Windows security modification
                • Checks whether UAC is enabled
                • Enumerates connected drives
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:1888
              • C:\Users\Admin\AppData\Local\Temp\f7680d3.exe
                C:\Users\Admin\AppData\Local\Temp\f7680d3.exe
                4⤵
                • Executes dropped EXE
                PID:2640
              • C:\Users\Admin\AppData\Local\Temp\f769a6b.exe
                C:\Users\Admin\AppData\Local\Temp\f769a6b.exe
                4⤵
                • Modifies firewall policy service
                • UAC bypass
                • Windows security bypass
                • Executes dropped EXE
                • Windows security modification
                • Checks whether UAC is enabled
                • Enumerates connected drives
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:2172
        • C:\Windows\system32\DllHost.exe
          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
          1⤵
            PID:324

          Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Windows\SYSTEM.INI

                  Filesize

                  257B

                  MD5

                  228991b851fc71a311d7584bee489d67

                  SHA1

                  9740469e8ef56eb1908dc4bb9c7ed691f8b2a7db

                  SHA256

                  056ffc495a0d14538384a1117bc77e8b07485381f1450c9a5b67bc28ca5923cd

                  SHA512

                  b556dd5e58001554d5cf9789a5ca16de614233a7916747d96c2f673a077cf41a8e7e78b07737fa4e04bc6dfea01584124e514b43353fbca57b720e551f56d605

                • \Users\Admin\AppData\Local\Temp\f767e92.exe

                  Filesize

                  97KB

                  MD5

                  f9dc17f6dc60b9a74244a6b0dc8ebfaf

                  SHA1

                  b788caa75bfd264448b450ac5c627e28d311afae

                  SHA256

                  ac57e444c06e5b6c52c238879aa530f5ca07dab8edb52680cc5b28acf36411cc

                  SHA512

                  2e41d6e385e7048b2dee0a335551695032b47ed94a0a7d069e8fdacad763a0aa3f805ebfcd5bc563195b4cd5e2304d5fdcb316efed507fed9f37c0becbcc3f18

                • memory/1072-29-0x00000000021F0000-0x00000000021F2000-memory.dmp

                  Filesize

                  8KB

                • memory/1872-81-0x00000000000C0000-0x00000000000C2000-memory.dmp

                  Filesize

                  8KB

                • memory/1872-11-0x00000000000C0000-0x00000000000D2000-memory.dmp

                  Filesize

                  72KB

                • memory/1872-10-0x00000000000C0000-0x00000000000D2000-memory.dmp

                  Filesize

                  72KB

                • memory/1872-71-0x00000000001A0000-0x00000000001A2000-memory.dmp

                  Filesize

                  8KB

                • memory/1872-79-0x0000000000250000-0x0000000000262000-memory.dmp

                  Filesize

                  72KB

                • memory/1872-57-0x0000000000250000-0x0000000000262000-memory.dmp

                  Filesize

                  72KB

                • memory/1872-2-0x0000000010000000-0x0000000010020000-memory.dmp

                  Filesize

                  128KB

                • memory/1872-37-0x00000000001A0000-0x00000000001A2000-memory.dmp

                  Filesize

                  8KB

                • memory/1872-38-0x0000000000220000-0x0000000000221000-memory.dmp

                  Filesize

                  4KB

                • memory/1872-40-0x0000000000220000-0x0000000000221000-memory.dmp

                  Filesize

                  4KB

                • memory/1872-55-0x00000000001A0000-0x00000000001A2000-memory.dmp

                  Filesize

                  8KB

                • memory/1872-36-0x00000000001A0000-0x00000000001A2000-memory.dmp

                  Filesize

                  8KB

                • memory/1872-1-0x0000000010000000-0x0000000010020000-memory.dmp

                  Filesize

                  128KB

                • memory/1888-61-0x00000000005A0000-0x000000000165A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/1888-62-0x00000000005A0000-0x000000000165A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/1888-12-0x0000000000400000-0x0000000000412000-memory.dmp

                  Filesize

                  72KB

                • memory/1888-16-0x00000000005A0000-0x000000000165A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/1888-56-0x0000000000490000-0x0000000000492000-memory.dmp

                  Filesize

                  8KB

                • memory/1888-18-0x00000000005A0000-0x000000000165A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/1888-46-0x00000000017F0000-0x00000000017F1000-memory.dmp

                  Filesize

                  4KB

                • memory/1888-20-0x00000000005A0000-0x000000000165A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/1888-22-0x00000000005A0000-0x000000000165A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/1888-21-0x00000000005A0000-0x000000000165A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/1888-23-0x00000000005A0000-0x000000000165A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/1888-60-0x00000000005A0000-0x000000000165A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/1888-19-0x00000000005A0000-0x000000000165A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/1888-149-0x00000000005A0000-0x000000000165A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/1888-63-0x00000000005A0000-0x000000000165A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/1888-64-0x00000000005A0000-0x000000000165A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/1888-66-0x00000000005A0000-0x000000000165A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/1888-67-0x00000000005A0000-0x000000000165A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/1888-17-0x00000000005A0000-0x000000000165A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/1888-48-0x0000000000490000-0x0000000000492000-memory.dmp

                  Filesize

                  8KB

                • memory/1888-15-0x00000000005A0000-0x000000000165A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/1888-13-0x00000000005A0000-0x000000000165A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/1888-83-0x00000000005A0000-0x000000000165A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/1888-85-0x00000000005A0000-0x000000000165A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/1888-88-0x00000000005A0000-0x000000000165A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/1888-89-0x00000000005A0000-0x000000000165A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/1888-90-0x00000000005A0000-0x000000000165A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/1888-148-0x0000000000400000-0x0000000000412000-memory.dmp

                  Filesize

                  72KB

                • memory/2172-82-0x0000000000400000-0x0000000000412000-memory.dmp

                  Filesize

                  72KB

                • memory/2172-105-0x00000000003B0000-0x00000000003B1000-memory.dmp

                  Filesize

                  4KB

                • memory/2172-166-0x0000000000A80000-0x0000000001B3A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2172-167-0x0000000000360000-0x0000000000362000-memory.dmp

                  Filesize

                  8KB

                • memory/2172-206-0x0000000000A80000-0x0000000001B3A000-memory.dmp

                  Filesize

                  16.7MB

                • memory/2172-207-0x0000000000400000-0x0000000000412000-memory.dmp

                  Filesize

                  72KB

                • memory/2640-99-0x0000000000360000-0x0000000000362000-memory.dmp

                  Filesize

                  8KB

                • memory/2640-98-0x00000000003B0000-0x00000000003B1000-memory.dmp

                  Filesize

                  4KB

                • memory/2640-125-0x0000000000360000-0x0000000000362000-memory.dmp

                  Filesize

                  8KB

                • memory/2640-104-0x0000000000360000-0x0000000000362000-memory.dmp

                  Filesize

                  8KB

                • memory/2640-153-0x0000000000400000-0x0000000000412000-memory.dmp

                  Filesize

                  72KB

                • memory/2640-59-0x0000000000400000-0x0000000000412000-memory.dmp

                  Filesize

                  72KB