Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
09-12-2024 03:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e069bfa3e09ad06aabbc6b759779004f6617925df8192dcf3e20a85f9fd67f2f.dll
Resource
win7-20240729-en
windows7-x64
17 signatures
150 seconds
General
-
Target
e069bfa3e09ad06aabbc6b759779004f6617925df8192dcf3e20a85f9fd67f2f.dll
-
Size
120KB
-
MD5
db76e3e707cbf4b4a48b72920287d912
-
SHA1
e8c9dec393821ea344e8d1f7d5fb75afe764aaf7
-
SHA256
e069bfa3e09ad06aabbc6b759779004f6617925df8192dcf3e20a85f9fd67f2f
-
SHA512
e6d826d2bc62882947ca32bf1835bf8d7f77bb5112295d4ffce52f8d83a14335f00bd02e912e0628f09b5ccbb120c75df31f60173f7fa8d1f9f4ba4b7562e6a2
-
SSDEEP
1536:1qbD03V9xQFXJo5SkkXmQlSUKcsA50T06pkpOYZD9DKylP74jlTodWBjW4w42S:G0MXyMZmrcB7SYvOSP74+4wJS
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f773794.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f773794.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f773794.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f771bbb.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f771bbb.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f771bbb.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f771bbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f773794.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f771bbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f773794.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f773794.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f773794.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f773794.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f773794.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f771bbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f771bbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f771bbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f773794.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f771bbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f771bbb.exe -
Executes dropped EXE 3 IoCs
pid Process 2228 f771bbb.exe 2652 f771d70.exe 1740 f773794.exe -
Loads dropped DLL 6 IoCs
pid Process 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f773794.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f771bbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f771bbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f771bbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f773794.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f773794.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f771bbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f771bbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f773794.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f773794.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f773794.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f771bbb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f773794.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f771bbb.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f773794.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f771bbb.exe -
Enumerates connected drives 3 TTPs 17 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: f771bbb.exe File opened (read-only) \??\P: f771bbb.exe File opened (read-only) \??\Q: f771bbb.exe File opened (read-only) \??\R: f771bbb.exe File opened (read-only) \??\K: f771bbb.exe File opened (read-only) \??\S: f771bbb.exe File opened (read-only) \??\E: f771bbb.exe File opened (read-only) \??\G: f771bbb.exe File opened (read-only) \??\L: f771bbb.exe File opened (read-only) \??\O: f771bbb.exe File opened (read-only) \??\G: f773794.exe File opened (read-only) \??\H: f771bbb.exe File opened (read-only) \??\I: f771bbb.exe File opened (read-only) \??\J: f771bbb.exe File opened (read-only) \??\M: f771bbb.exe File opened (read-only) \??\T: f771bbb.exe File opened (read-only) \??\E: f773794.exe -
resource yara_rule behavioral1/memory/2228-16-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2228-19-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2228-23-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2228-22-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2228-21-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2228-18-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2228-24-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2228-17-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2228-15-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2228-20-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2228-62-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2228-61-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2228-63-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2228-64-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2228-66-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2228-67-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2228-68-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2228-81-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2228-82-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2228-84-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2228-86-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2228-106-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2228-155-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/1740-170-0x00000000009B0000-0x0000000001A6A000-memory.dmp upx behavioral1/memory/1740-211-0x00000000009B0000-0x0000000001A6A000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI f771bbb.exe File created C:\Windows\f776c3b f773794.exe File created C:\Windows\f771c09 f771bbb.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f771bbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f773794.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2228 f771bbb.exe 2228 f771bbb.exe 1740 f773794.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeDebugPrivilege 2228 f771bbb.exe Token: SeDebugPrivilege 2228 f771bbb.exe Token: SeDebugPrivilege 2228 f771bbb.exe Token: SeDebugPrivilege 2228 f771bbb.exe Token: SeDebugPrivilege 2228 f771bbb.exe Token: SeDebugPrivilege 2228 f771bbb.exe Token: SeDebugPrivilege 2228 f771bbb.exe Token: SeDebugPrivilege 2228 f771bbb.exe Token: SeDebugPrivilege 2228 f771bbb.exe Token: SeDebugPrivilege 2228 f771bbb.exe Token: SeDebugPrivilege 2228 f771bbb.exe Token: SeDebugPrivilege 2228 f771bbb.exe Token: SeDebugPrivilege 2228 f771bbb.exe Token: SeDebugPrivilege 2228 f771bbb.exe Token: SeDebugPrivilege 2228 f771bbb.exe Token: SeDebugPrivilege 2228 f771bbb.exe Token: SeDebugPrivilege 2228 f771bbb.exe Token: SeDebugPrivilege 2228 f771bbb.exe Token: SeDebugPrivilege 2228 f771bbb.exe Token: SeDebugPrivilege 2228 f771bbb.exe Token: SeDebugPrivilege 2228 f771bbb.exe Token: SeDebugPrivilege 2228 f771bbb.exe Token: SeDebugPrivilege 2228 f771bbb.exe Token: SeDebugPrivilege 1740 f773794.exe Token: SeDebugPrivilege 1740 f773794.exe Token: SeDebugPrivilege 1740 f773794.exe Token: SeDebugPrivilege 1740 f773794.exe Token: SeDebugPrivilege 1740 f773794.exe Token: SeDebugPrivilege 1740 f773794.exe Token: SeDebugPrivilege 1740 f773794.exe Token: SeDebugPrivilege 1740 f773794.exe Token: SeDebugPrivilege 1740 f773794.exe Token: SeDebugPrivilege 1740 f773794.exe Token: SeDebugPrivilege 1740 f773794.exe Token: SeDebugPrivilege 1740 f773794.exe Token: SeDebugPrivilege 1740 f773794.exe Token: SeDebugPrivilege 1740 f773794.exe Token: SeDebugPrivilege 1740 f773794.exe Token: SeDebugPrivilege 1740 f773794.exe Token: SeDebugPrivilege 1740 f773794.exe Token: SeDebugPrivilege 1740 f773794.exe Token: SeDebugPrivilege 1740 f773794.exe Token: SeDebugPrivilege 1740 f773794.exe Token: SeDebugPrivilege 1740 f773794.exe Token: SeDebugPrivilege 1740 f773794.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2264 wrote to memory of 2132 2264 rundll32.exe 30 PID 2264 wrote to memory of 2132 2264 rundll32.exe 30 PID 2264 wrote to memory of 2132 2264 rundll32.exe 30 PID 2264 wrote to memory of 2132 2264 rundll32.exe 30 PID 2264 wrote to memory of 2132 2264 rundll32.exe 30 PID 2264 wrote to memory of 2132 2264 rundll32.exe 30 PID 2264 wrote to memory of 2132 2264 rundll32.exe 30 PID 2132 wrote to memory of 2228 2132 rundll32.exe 31 PID 2132 wrote to memory of 2228 2132 rundll32.exe 31 PID 2132 wrote to memory of 2228 2132 rundll32.exe 31 PID 2132 wrote to memory of 2228 2132 rundll32.exe 31 PID 2228 wrote to memory of 1056 2228 f771bbb.exe 17 PID 2228 wrote to memory of 1072 2228 f771bbb.exe 19 PID 2228 wrote to memory of 1172 2228 f771bbb.exe 21 PID 2228 wrote to memory of 1412 2228 f771bbb.exe 25 PID 2228 wrote to memory of 2264 2228 f771bbb.exe 29 PID 2228 wrote to memory of 2132 2228 f771bbb.exe 30 PID 2228 wrote to memory of 2132 2228 f771bbb.exe 30 PID 2132 wrote to memory of 2652 2132 rundll32.exe 32 PID 2132 wrote to memory of 2652 2132 rundll32.exe 32 PID 2132 wrote to memory of 2652 2132 rundll32.exe 32 PID 2132 wrote to memory of 2652 2132 rundll32.exe 32 PID 2132 wrote to memory of 1740 2132 rundll32.exe 33 PID 2132 wrote to memory of 1740 2132 rundll32.exe 33 PID 2132 wrote to memory of 1740 2132 rundll32.exe 33 PID 2132 wrote to memory of 1740 2132 rundll32.exe 33 PID 2228 wrote to memory of 1056 2228 f771bbb.exe 17 PID 2228 wrote to memory of 1072 2228 f771bbb.exe 19 PID 2228 wrote to memory of 1172 2228 f771bbb.exe 21 PID 2228 wrote to memory of 1412 2228 f771bbb.exe 25 PID 2228 wrote to memory of 2652 2228 f771bbb.exe 32 PID 2228 wrote to memory of 2652 2228 f771bbb.exe 32 PID 2228 wrote to memory of 1740 2228 f771bbb.exe 33 PID 2228 wrote to memory of 1740 2228 f771bbb.exe 33 PID 1740 wrote to memory of 1056 1740 f773794.exe 17 PID 1740 wrote to memory of 1072 1740 f773794.exe 19 PID 1740 wrote to memory of 1172 1740 f773794.exe 21 PID 1740 wrote to memory of 1412 1740 f773794.exe 25 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f771bbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f773794.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1056
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1072
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1172
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e069bfa3e09ad06aabbc6b759779004f6617925df8192dcf3e20a85f9fd67f2f.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e069bfa3e09ad06aabbc6b759779004f6617925df8192dcf3e20a85f9fd67f2f.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\f771bbb.exeC:\Users\Admin\AppData\Local\Temp\f771bbb.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2228
-
-
C:\Users\Admin\AppData\Local\Temp\f771d70.exeC:\Users\Admin\AppData\Local\Temp\f771d70.exe4⤵
- Executes dropped EXE
PID:2652
-
-
C:\Users\Admin\AppData\Local\Temp\f773794.exeC:\Users\Admin\AppData\Local\Temp\f773794.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1740
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1412
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD5e172ea1886b5372359be15ff88950db1
SHA1773b411417f7b830a5703e6419c4d86f54023040
SHA256f812c73ebb809e40ada1d0e3340f6c01d4f67afc4b381f98d928e7a4fa8994e1
SHA5121456ebef2898c4aaa52cfdef6249295c74376bca5b30a9365dfe437040660677a25d5a1fe18a4e78805a63b2bb15d0c9de94f85b58b1eb9ccc375eaab36c29a7
-
Filesize
97KB
MD509843bfb8c0bf2e94df911d2f9a2ea03
SHA1e123b84c3c12623e5fcc04bd6d1662182682ef2f
SHA25621a15683926844f68207fb81bbc8958ea6df3a2eb940224aadb910d07156e995
SHA5127557aecf28f136e04d97c7887254cbf26412ace242abcbbee02214b96f5493cc102910cbe2db3e5abb9caba9ae6da967cfda57a153b6c4f6038f2d5537a7754c