Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
11-12-2024 12:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c616342b114fb246feb3738e4d6a1063c2c45a135049e2af0813dc5e66f37a9f.dll
Resource
win7-20241010-en
windows7-x64
17 signatures
150 seconds
General
-
Target
c616342b114fb246feb3738e4d6a1063c2c45a135049e2af0813dc5e66f37a9f.dll
-
Size
120KB
-
MD5
a3e40271f9faeba6b652ba7399b53ede
-
SHA1
35374b92f6852c01cc392878e12f72ddec5c9980
-
SHA256
c616342b114fb246feb3738e4d6a1063c2c45a135049e2af0813dc5e66f37a9f
-
SHA512
d6eea494bde08e652ba7836ee4b6c9073732f13c50d5e8b8e231c230a588cb730d45240afb522361a525d419df675041d14cc059c953a31cc7f01ef609a58c37
-
SSDEEP
3072:H4ED4SV/+F4K3ILR16YK83eDs67Pu4n6WWR:H4EN4F4qILRRK8p67Vn/w
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76a4b8.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76a4b8.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76a4b8.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f7688fe.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f7688fe.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f7688fe.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7688fe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76a4b8.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7688fe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7688fe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76a4b8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76a4b8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7688fe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7688fe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7688fe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7688fe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76a4b8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76a4b8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76a4b8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76a4b8.exe -
Executes dropped EXE 3 IoCs
pid Process 2084 f7688fe.exe 2852 f768ec8.exe 2804 f76a4b8.exe -
Loads dropped DLL 6 IoCs
pid Process 2376 rundll32.exe 2376 rundll32.exe 2376 rundll32.exe 2376 rundll32.exe 2376 rundll32.exe 2376 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7688fe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7688fe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7688fe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f7688fe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76a4b8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76a4b8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7688fe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76a4b8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76a4b8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76a4b8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76a4b8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7688fe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7688fe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76a4b8.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76a4b8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7688fe.exe -
Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: f7688fe.exe File opened (read-only) \??\E: f76a4b8.exe File opened (read-only) \??\I: f7688fe.exe File opened (read-only) \??\L: f7688fe.exe File opened (read-only) \??\Q: f7688fe.exe File opened (read-only) \??\S: f7688fe.exe File opened (read-only) \??\H: f7688fe.exe File opened (read-only) \??\K: f7688fe.exe File opened (read-only) \??\E: f7688fe.exe File opened (read-only) \??\G: f7688fe.exe File opened (read-only) \??\J: f7688fe.exe File opened (read-only) \??\M: f7688fe.exe File opened (read-only) \??\N: f7688fe.exe File opened (read-only) \??\P: f7688fe.exe File opened (read-only) \??\R: f7688fe.exe -
resource yara_rule behavioral1/memory/2084-13-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2084-17-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2084-20-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2084-21-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2084-22-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2084-19-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2084-18-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2084-16-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2084-15-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2084-14-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2084-59-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2084-60-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2084-61-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2084-62-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2084-63-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2084-65-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2084-80-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2084-82-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2084-83-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2084-85-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2084-87-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2084-88-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2084-152-0x00000000005E0000-0x000000000169A000-memory.dmp upx behavioral1/memory/2804-170-0x0000000000990000-0x0000000001A4A000-memory.dmp upx behavioral1/memory/2804-204-0x0000000000990000-0x0000000001A4A000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\f76dde1 f76a4b8.exe File created C:\Windows\f76896b f7688fe.exe File opened for modification C:\Windows\SYSTEM.INI f7688fe.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f7688fe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76a4b8.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2084 f7688fe.exe 2084 f7688fe.exe 2804 f76a4b8.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 2084 f7688fe.exe Token: SeDebugPrivilege 2084 f7688fe.exe Token: SeDebugPrivilege 2084 f7688fe.exe Token: SeDebugPrivilege 2084 f7688fe.exe Token: SeDebugPrivilege 2084 f7688fe.exe Token: SeDebugPrivilege 2084 f7688fe.exe Token: SeDebugPrivilege 2084 f7688fe.exe Token: SeDebugPrivilege 2084 f7688fe.exe Token: SeDebugPrivilege 2084 f7688fe.exe Token: SeDebugPrivilege 2084 f7688fe.exe Token: SeDebugPrivilege 2084 f7688fe.exe Token: SeDebugPrivilege 2084 f7688fe.exe Token: SeDebugPrivilege 2084 f7688fe.exe Token: SeDebugPrivilege 2084 f7688fe.exe Token: SeDebugPrivilege 2084 f7688fe.exe Token: SeDebugPrivilege 2084 f7688fe.exe Token: SeDebugPrivilege 2084 f7688fe.exe Token: SeDebugPrivilege 2084 f7688fe.exe Token: SeDebugPrivilege 2084 f7688fe.exe Token: SeDebugPrivilege 2084 f7688fe.exe Token: SeDebugPrivilege 2084 f7688fe.exe Token: SeDebugPrivilege 2084 f7688fe.exe Token: SeDebugPrivilege 2084 f7688fe.exe Token: SeDebugPrivilege 2804 f76a4b8.exe Token: SeDebugPrivilege 2804 f76a4b8.exe Token: SeDebugPrivilege 2804 f76a4b8.exe Token: SeDebugPrivilege 2804 f76a4b8.exe Token: SeDebugPrivilege 2804 f76a4b8.exe Token: SeDebugPrivilege 2804 f76a4b8.exe Token: SeDebugPrivilege 2804 f76a4b8.exe Token: SeDebugPrivilege 2804 f76a4b8.exe Token: SeDebugPrivilege 2804 f76a4b8.exe Token: SeDebugPrivilege 2804 f76a4b8.exe Token: SeDebugPrivilege 2804 f76a4b8.exe Token: SeDebugPrivilege 2804 f76a4b8.exe Token: SeDebugPrivilege 2804 f76a4b8.exe Token: SeDebugPrivilege 2804 f76a4b8.exe Token: SeDebugPrivilege 2804 f76a4b8.exe Token: SeDebugPrivilege 2804 f76a4b8.exe Token: SeDebugPrivilege 2804 f76a4b8.exe Token: SeDebugPrivilege 2804 f76a4b8.exe Token: SeDebugPrivilege 2804 f76a4b8.exe Token: SeDebugPrivilege 2804 f76a4b8.exe Token: SeDebugPrivilege 2804 f76a4b8.exe Token: SeDebugPrivilege 2804 f76a4b8.exe Token: SeDebugPrivilege 2804 f76a4b8.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2568 wrote to memory of 2376 2568 rundll32.exe 30 PID 2568 wrote to memory of 2376 2568 rundll32.exe 30 PID 2568 wrote to memory of 2376 2568 rundll32.exe 30 PID 2568 wrote to memory of 2376 2568 rundll32.exe 30 PID 2568 wrote to memory of 2376 2568 rundll32.exe 30 PID 2568 wrote to memory of 2376 2568 rundll32.exe 30 PID 2568 wrote to memory of 2376 2568 rundll32.exe 30 PID 2376 wrote to memory of 2084 2376 rundll32.exe 31 PID 2376 wrote to memory of 2084 2376 rundll32.exe 31 PID 2376 wrote to memory of 2084 2376 rundll32.exe 31 PID 2376 wrote to memory of 2084 2376 rundll32.exe 31 PID 2084 wrote to memory of 1108 2084 f7688fe.exe 19 PID 2084 wrote to memory of 1168 2084 f7688fe.exe 20 PID 2084 wrote to memory of 1204 2084 f7688fe.exe 21 PID 2084 wrote to memory of 844 2084 f7688fe.exe 23 PID 2084 wrote to memory of 2568 2084 f7688fe.exe 29 PID 2084 wrote to memory of 2376 2084 f7688fe.exe 30 PID 2084 wrote to memory of 2376 2084 f7688fe.exe 30 PID 2376 wrote to memory of 2852 2376 rundll32.exe 32 PID 2376 wrote to memory of 2852 2376 rundll32.exe 32 PID 2376 wrote to memory of 2852 2376 rundll32.exe 32 PID 2376 wrote to memory of 2852 2376 rundll32.exe 32 PID 2376 wrote to memory of 2804 2376 rundll32.exe 33 PID 2376 wrote to memory of 2804 2376 rundll32.exe 33 PID 2376 wrote to memory of 2804 2376 rundll32.exe 33 PID 2376 wrote to memory of 2804 2376 rundll32.exe 33 PID 2084 wrote to memory of 1108 2084 f7688fe.exe 19 PID 2084 wrote to memory of 1168 2084 f7688fe.exe 20 PID 2084 wrote to memory of 1204 2084 f7688fe.exe 21 PID 2084 wrote to memory of 844 2084 f7688fe.exe 23 PID 2084 wrote to memory of 2852 2084 f7688fe.exe 32 PID 2084 wrote to memory of 2852 2084 f7688fe.exe 32 PID 2084 wrote to memory of 2804 2084 f7688fe.exe 33 PID 2084 wrote to memory of 2804 2084 f7688fe.exe 33 PID 2804 wrote to memory of 1108 2804 f76a4b8.exe 19 PID 2804 wrote to memory of 1168 2804 f76a4b8.exe 20 PID 2804 wrote to memory of 1204 2804 f76a4b8.exe 21 PID 2804 wrote to memory of 844 2804 f76a4b8.exe 23 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7688fe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76a4b8.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1108
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1168
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1204
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c616342b114fb246feb3738e4d6a1063c2c45a135049e2af0813dc5e66f37a9f.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c616342b114fb246feb3738e4d6a1063c2c45a135049e2af0813dc5e66f37a9f.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\f7688fe.exeC:\Users\Admin\AppData\Local\Temp\f7688fe.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2084
-
-
C:\Users\Admin\AppData\Local\Temp\f768ec8.exeC:\Users\Admin\AppData\Local\Temp\f768ec8.exe4⤵
- Executes dropped EXE
PID:2852
-
-
C:\Users\Admin\AppData\Local\Temp\f76a4b8.exeC:\Users\Admin\AppData\Local\Temp\f76a4b8.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2804
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:844
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD5cd189231ba444c373ee1bb19ce4cfbcb
SHA1c40f21eb92e7fb7821f2ca3cd078a9c93f383d1f
SHA256a27256808961a1bca8d7ff46b7c84e2171d513045621baea14ac398f47410377
SHA512f71958636784d1f1e38e6be39ea2d15429781091c2f94d0b236530faf1caa0c3016aa578e0c376008cd6bfa8e304ab576149fbc21c7ea5b15fd513b998f38bb9
-
Filesize
97KB
MD5813f334f46a46c0965563015f27804a8
SHA1983d4ee029fdce7cb63f1640f67e552707c06fff
SHA25696ca6411e3497b20beca3fd62c7e35e23520b7e11c36771ea0ae736c7a5597af
SHA512b9cbc8ef906b7c896c47f68b4581396e5f606c74f58037243e38b3f48a33b4668b44ff39650c5addf583b09061625b813613a3c3f8b5d513c0e2225e75ea2960