Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
07-12-2024 08:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d6d55d6d424913a1c4f6f6d54424bdb065a31338fe03440e25831d626b308309N.dll
Resource
win7-20241023-en
windows7-x64
17 signatures
120 seconds
General
-
Target
d6d55d6d424913a1c4f6f6d54424bdb065a31338fe03440e25831d626b308309N.dll
-
Size
120KB
-
MD5
c2432307489522d0a27b5fa55f801d30
-
SHA1
6fe8a2a16c54134fbb282ce8c09a0b10210a2c0a
-
SHA256
d6d55d6d424913a1c4f6f6d54424bdb065a31338fe03440e25831d626b308309
-
SHA512
6cab26fe48f6b5e278a6265b4ee58c60bb3a19cdf39899fa2e43350cfb713fe1a41a035fd8c0020d95d2f1e617cd39c80b62152defcd7068b2789cb8c3d0214e
-
SSDEEP
1536:HyaY0I1kmuiqf4DWpHjkLuV6tIBKaliimyCBXllZYPKzw8Gpt0hb:SwHmUfScHjQ4Ka8BbjYPKzwbpCb
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76a3be.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76a3be.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76bf88.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76bf88.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76bf88.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76a3be.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76a3be.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76bf88.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76bf88.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76a3be.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76a3be.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76bf88.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76bf88.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76bf88.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76bf88.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76bf88.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76a3be.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76a3be.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76a3be.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76a3be.exe -
Executes dropped EXE 3 IoCs
pid Process 1704 f76a3be.exe 2916 f76a5a2.exe 2752 f76bf88.exe -
Loads dropped DLL 6 IoCs
pid Process 2628 rundll32.exe 2628 rundll32.exe 2628 rundll32.exe 2628 rundll32.exe 2628 rundll32.exe 2628 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76a3be.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76bf88.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76a3be.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76a3be.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76a3be.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76bf88.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76bf88.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76a3be.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76a3be.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76bf88.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76bf88.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76bf88.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76a3be.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76bf88.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76a3be.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76bf88.exe -
Enumerates connected drives 3 TTPs 16 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: f76a3be.exe File opened (read-only) \??\G: f76a3be.exe File opened (read-only) \??\K: f76a3be.exe File opened (read-only) \??\Q: f76a3be.exe File opened (read-only) \??\E: f76bf88.exe File opened (read-only) \??\G: f76bf88.exe File opened (read-only) \??\J: f76a3be.exe File opened (read-only) \??\N: f76a3be.exe File opened (read-only) \??\O: f76a3be.exe File opened (read-only) \??\S: f76a3be.exe File opened (read-only) \??\I: f76a3be.exe File opened (read-only) \??\M: f76a3be.exe File opened (read-only) \??\R: f76a3be.exe File opened (read-only) \??\H: f76a3be.exe File opened (read-only) \??\L: f76a3be.exe File opened (read-only) \??\P: f76a3be.exe -
resource yara_rule behavioral1/memory/1704-14-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/1704-18-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/1704-15-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/1704-21-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/1704-19-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/1704-17-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/1704-16-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/1704-13-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/1704-20-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/1704-11-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/1704-60-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/1704-61-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/1704-62-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/1704-63-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/1704-64-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/1704-66-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/1704-67-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/1704-83-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/1704-84-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/1704-87-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/1704-106-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/1704-107-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/1704-148-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2752-160-0x0000000000920000-0x00000000019DA000-memory.dmp upx behavioral1/memory/2752-202-0x0000000000920000-0x00000000019DA000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\f76a42b f76a3be.exe File opened for modification C:\Windows\SYSTEM.INI f76a3be.exe File created C:\Windows\f76f3d1 f76bf88.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76a3be.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76bf88.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1704 f76a3be.exe 1704 f76a3be.exe 2752 f76bf88.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 1704 f76a3be.exe Token: SeDebugPrivilege 1704 f76a3be.exe Token: SeDebugPrivilege 1704 f76a3be.exe Token: SeDebugPrivilege 1704 f76a3be.exe Token: SeDebugPrivilege 1704 f76a3be.exe Token: SeDebugPrivilege 1704 f76a3be.exe Token: SeDebugPrivilege 1704 f76a3be.exe Token: SeDebugPrivilege 1704 f76a3be.exe Token: SeDebugPrivilege 1704 f76a3be.exe Token: SeDebugPrivilege 1704 f76a3be.exe Token: SeDebugPrivilege 1704 f76a3be.exe Token: SeDebugPrivilege 1704 f76a3be.exe Token: SeDebugPrivilege 1704 f76a3be.exe Token: SeDebugPrivilege 1704 f76a3be.exe Token: SeDebugPrivilege 1704 f76a3be.exe Token: SeDebugPrivilege 1704 f76a3be.exe Token: SeDebugPrivilege 1704 f76a3be.exe Token: SeDebugPrivilege 1704 f76a3be.exe Token: SeDebugPrivilege 1704 f76a3be.exe Token: SeDebugPrivilege 1704 f76a3be.exe Token: SeDebugPrivilege 1704 f76a3be.exe Token: SeDebugPrivilege 1704 f76a3be.exe Token: SeDebugPrivilege 1704 f76a3be.exe Token: SeDebugPrivilege 1704 f76a3be.exe Token: SeDebugPrivilege 2752 f76bf88.exe Token: SeDebugPrivilege 2752 f76bf88.exe Token: SeDebugPrivilege 2752 f76bf88.exe Token: SeDebugPrivilege 2752 f76bf88.exe Token: SeDebugPrivilege 2752 f76bf88.exe Token: SeDebugPrivilege 2752 f76bf88.exe Token: SeDebugPrivilege 2752 f76bf88.exe Token: SeDebugPrivilege 2752 f76bf88.exe Token: SeDebugPrivilege 2752 f76bf88.exe Token: SeDebugPrivilege 2752 f76bf88.exe Token: SeDebugPrivilege 2752 f76bf88.exe Token: SeDebugPrivilege 2752 f76bf88.exe Token: SeDebugPrivilege 2752 f76bf88.exe Token: SeDebugPrivilege 2752 f76bf88.exe Token: SeDebugPrivilege 2752 f76bf88.exe Token: SeDebugPrivilege 2752 f76bf88.exe Token: SeDebugPrivilege 2752 f76bf88.exe Token: SeDebugPrivilege 2752 f76bf88.exe Token: SeDebugPrivilege 2752 f76bf88.exe Token: SeDebugPrivilege 2752 f76bf88.exe Token: SeDebugPrivilege 2752 f76bf88.exe Token: SeDebugPrivilege 2752 f76bf88.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2372 wrote to memory of 2628 2372 rundll32.exe 30 PID 2372 wrote to memory of 2628 2372 rundll32.exe 30 PID 2372 wrote to memory of 2628 2372 rundll32.exe 30 PID 2372 wrote to memory of 2628 2372 rundll32.exe 30 PID 2372 wrote to memory of 2628 2372 rundll32.exe 30 PID 2372 wrote to memory of 2628 2372 rundll32.exe 30 PID 2372 wrote to memory of 2628 2372 rundll32.exe 30 PID 2628 wrote to memory of 1704 2628 rundll32.exe 31 PID 2628 wrote to memory of 1704 2628 rundll32.exe 31 PID 2628 wrote to memory of 1704 2628 rundll32.exe 31 PID 2628 wrote to memory of 1704 2628 rundll32.exe 31 PID 1704 wrote to memory of 1116 1704 f76a3be.exe 19 PID 1704 wrote to memory of 1176 1704 f76a3be.exe 20 PID 1704 wrote to memory of 1232 1704 f76a3be.exe 21 PID 1704 wrote to memory of 1848 1704 f76a3be.exe 25 PID 1704 wrote to memory of 2372 1704 f76a3be.exe 29 PID 1704 wrote to memory of 2628 1704 f76a3be.exe 30 PID 1704 wrote to memory of 2628 1704 f76a3be.exe 30 PID 2628 wrote to memory of 2916 2628 rundll32.exe 32 PID 2628 wrote to memory of 2916 2628 rundll32.exe 32 PID 2628 wrote to memory of 2916 2628 rundll32.exe 32 PID 2628 wrote to memory of 2916 2628 rundll32.exe 32 PID 2628 wrote to memory of 2752 2628 rundll32.exe 33 PID 2628 wrote to memory of 2752 2628 rundll32.exe 33 PID 2628 wrote to memory of 2752 2628 rundll32.exe 33 PID 2628 wrote to memory of 2752 2628 rundll32.exe 33 PID 1704 wrote to memory of 1116 1704 f76a3be.exe 19 PID 1704 wrote to memory of 1176 1704 f76a3be.exe 20 PID 1704 wrote to memory of 1232 1704 f76a3be.exe 21 PID 1704 wrote to memory of 1848 1704 f76a3be.exe 25 PID 1704 wrote to memory of 2916 1704 f76a3be.exe 32 PID 1704 wrote to memory of 2916 1704 f76a3be.exe 32 PID 1704 wrote to memory of 2752 1704 f76a3be.exe 33 PID 1704 wrote to memory of 2752 1704 f76a3be.exe 33 PID 2752 wrote to memory of 1116 2752 f76bf88.exe 19 PID 2752 wrote to memory of 1176 2752 f76bf88.exe 20 PID 2752 wrote to memory of 1232 2752 f76bf88.exe 21 PID 2752 wrote to memory of 1848 2752 f76bf88.exe 25 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76bf88.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76a3be.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1116
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1176
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1232
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d6d55d6d424913a1c4f6f6d54424bdb065a31338fe03440e25831d626b308309N.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d6d55d6d424913a1c4f6f6d54424bdb065a31338fe03440e25831d626b308309N.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\f76a3be.exeC:\Users\Admin\AppData\Local\Temp\f76a3be.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1704
-
-
C:\Users\Admin\AppData\Local\Temp\f76a5a2.exeC:\Users\Admin\AppData\Local\Temp\f76a5a2.exe4⤵
- Executes dropped EXE
PID:2916
-
-
C:\Users\Admin\AppData\Local\Temp\f76bf88.exeC:\Users\Admin\AppData\Local\Temp\f76bf88.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2752
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1848
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD5d0bc400a0547e6ac7ac4af44446af323
SHA1c9f17fc1ab0d285912536df212132ace103ca43b
SHA2562b3ed9a96bd5493ea0f78b3b93c629a43d82d6d74c511def9ade26f7ef2750f0
SHA512e9abae44d85649d3f388d649a4668b7bb7d8371bcbd223b4e7bf4b90641e93d6007356d8f81151ae2310c65002c2d2199c707ea091294ac7c956c1fa31d8b7b8
-
Filesize
97KB
MD5616115703e16ab8b68bb77ee5b849692
SHA1d8dee58996503bdc5a17c9b03df1a8608f7c8895
SHA25637d123f06302a0adbaf37722eddbd8ee8a26a3839bd38e74a142916fbc947acc
SHA512ed3d7cb7da75f6340a241b82a4aaced1144f27e1a15fd80f6384b61ff7910b0b73627a2f1f742ceee45c06904a7649b6baf9ae928efb899650651a68d76932e1