Analysis
-
max time kernel
122s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
13-12-2024 07:20
General
-
Target
6f5810535a71dbfd6b10517a871dfd85e5e5f9c3c504e16910f5c5d97211df0e.exe
-
Size
654KB
-
MD5
7533d0576eead381d2502ad6ba854263
-
SHA1
63b84f4f40172bf6d61884d4739325373a43b93d
-
SHA256
6f5810535a71dbfd6b10517a871dfd85e5e5f9c3c504e16910f5c5d97211df0e
-
SHA512
7b629e3ebe2cca4bbde06c672cfd414883f23f103ff0809b7453a8e873ca3d87ced8597412a7b7a9d5abb6cdfc51c940556ba77eef97e6f21d413d906421ac18
-
SSDEEP
12288:r98rmdR3y4dqXLBzy6LRWohK9v26UrmAP6mY5O95Ev4uuYRY+hSIfiDbZwE:58VXpK9vJk6hO95sDKASIf9E
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
-
Sality
Sality is backdoor written in C++, first discovered in 2003.
-
Sality family
-
UAC bypass 3 TTPs 2 IoCs
-
Windows security bypass 2 TTPs 12 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Windows security modification 2 TTPs 14 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
UPX packed file 25 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 45 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\6f5810535a71dbfd6b10517a871dfd85e5e5f9c3c504e16910f5c5d97211df0e.exe"C:\Users\Admin\AppData\Local\Temp\6f5810535a71dbfd6b10517a871dfd85e5e5f9c3c504e16910f5c5d97211df0e.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\qq_setup_21049\6f5810535a71dbfd6b10517a871dfd85e5e5f9c3c504e16910f5c5d97211df0e.exe"C:\Users\Admin\AppData\Local\Temp\qq_setup_21049\6f5810535a71dbfd6b10517a871dfd85e5e5f9c3c504e16910f5c5d97211df0e.exe" --temp3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD5d05346ddb8a8d1db8cfb05056bfa43e3
SHA1a6ab97e140e4b4ad393207a2eda051b1be3a7fc5
SHA256be17993ab586946706bbc534c2d748a68ffb4d1d37c7bb94cdbfbd378ef25968
SHA512c3946a2b6b4514bdfae26802eb10018f506e550f0886bd8ef570263edcdc374c0660ce9729fa3bc1370aef03447af0240dbc23f205871181495c84d713fdacda
-
Filesize
654KB
MD57533d0576eead381d2502ad6ba854263
SHA163b84f4f40172bf6d61884d4739325373a43b93d
SHA2566f5810535a71dbfd6b10517a871dfd85e5e5f9c3c504e16910f5c5d97211df0e
SHA5127b629e3ebe2cca4bbde06c672cfd414883f23f103ff0809b7453a8e873ca3d87ced8597412a7b7a9d5abb6cdfc51c940556ba77eef97e6f21d413d906421ac18
-
Filesize
8KB
-
Filesize
660KB
-
Filesize
8KB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
4KB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
4KB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
8KB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
660KB
-
Filesize
660KB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
660KB
-
Filesize
4KB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
16.7MB
-
Filesize
8KB
-
Filesize
16.7MB
-
Filesize
660KB