Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
15-12-2024 21:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
33505769ab40185e0892bf5c8b96c01a1ef51bd47fa270556019944903d22834.dll
Resource
win7-20241023-en
windows7-x64
17 signatures
150 seconds
General
-
Target
33505769ab40185e0892bf5c8b96c01a1ef51bd47fa270556019944903d22834.dll
-
Size
120KB
-
MD5
63a27f322463a693bdec9657d250a1dc
-
SHA1
d0e9c42ee85cb816369329cf6460a5e31dfa6fd8
-
SHA256
33505769ab40185e0892bf5c8b96c01a1ef51bd47fa270556019944903d22834
-
SHA512
909e6effffc73d871c0a09421a1d7de071950bdcbd0639708f02b13e4f5285f8fe5994d2ac9add625c4b73dd3873627faf6c7deec94a51898646748e30a7e7de
-
SSDEEP
3072:eWtJeK1Sze8VZjBId7QfhfK1em9v2kOb+gU4:e2UKNWZ9/hfij9v2kOb1/
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76d00b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76d00b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76eba6.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76eba6.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76eba6.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76d00b.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76d00b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76eba6.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76d00b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76d00b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76eba6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76eba6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76eba6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76eba6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76d00b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76d00b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76d00b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76d00b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76eba6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76eba6.exe -
Executes dropped EXE 3 IoCs
pid Process 2044 f76d00b.exe 2700 f76d4fb.exe 2768 f76eba6.exe -
Loads dropped DLL 6 IoCs
pid Process 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76d00b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76d00b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76eba6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76d00b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76d00b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76eba6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76eba6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76eba6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76eba6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76eba6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76d00b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76d00b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76d00b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76eba6.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76d00b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76eba6.exe -
Enumerates connected drives 3 TTPs 14 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: f76d00b.exe File opened (read-only) \??\G: f76d00b.exe File opened (read-only) \??\J: f76d00b.exe File opened (read-only) \??\L: f76d00b.exe File opened (read-only) \??\E: f76eba6.exe File opened (read-only) \??\E: f76d00b.exe File opened (read-only) \??\H: f76d00b.exe File opened (read-only) \??\P: f76d00b.exe File opened (read-only) \??\Q: f76d00b.exe File opened (read-only) \??\I: f76d00b.exe File opened (read-only) \??\K: f76d00b.exe File opened (read-only) \??\M: f76d00b.exe File opened (read-only) \??\N: f76d00b.exe File opened (read-only) \??\O: f76d00b.exe -
resource yara_rule behavioral1/memory/2044-13-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/2044-20-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/2044-15-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/2044-22-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/2044-23-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/2044-19-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/2044-17-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/2044-21-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/2044-16-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/2044-18-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/2044-62-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/2044-63-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/2044-64-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/2044-65-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/2044-67-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/2044-66-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/2044-69-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/2044-83-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/2044-84-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/2044-87-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/2044-90-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/2044-151-0x0000000000660000-0x000000000171A000-memory.dmp upx behavioral1/memory/2768-167-0x0000000000920000-0x00000000019DA000-memory.dmp upx behavioral1/memory/2768-206-0x0000000000920000-0x00000000019DA000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\f772443 f76eba6.exe File created C:\Windows\f76d088 f76d00b.exe File opened for modification C:\Windows\SYSTEM.INI f76d00b.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76d00b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76eba6.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2044 f76d00b.exe 2044 f76d00b.exe 2768 f76eba6.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 2044 f76d00b.exe Token: SeDebugPrivilege 2044 f76d00b.exe Token: SeDebugPrivilege 2044 f76d00b.exe Token: SeDebugPrivilege 2044 f76d00b.exe Token: SeDebugPrivilege 2044 f76d00b.exe Token: SeDebugPrivilege 2044 f76d00b.exe Token: SeDebugPrivilege 2044 f76d00b.exe Token: SeDebugPrivilege 2044 f76d00b.exe Token: SeDebugPrivilege 2044 f76d00b.exe Token: SeDebugPrivilege 2044 f76d00b.exe Token: SeDebugPrivilege 2044 f76d00b.exe Token: SeDebugPrivilege 2044 f76d00b.exe Token: SeDebugPrivilege 2044 f76d00b.exe Token: SeDebugPrivilege 2044 f76d00b.exe Token: SeDebugPrivilege 2044 f76d00b.exe Token: SeDebugPrivilege 2044 f76d00b.exe Token: SeDebugPrivilege 2044 f76d00b.exe Token: SeDebugPrivilege 2044 f76d00b.exe Token: SeDebugPrivilege 2044 f76d00b.exe Token: SeDebugPrivilege 2044 f76d00b.exe Token: SeDebugPrivilege 2044 f76d00b.exe Token: SeDebugPrivilege 2044 f76d00b.exe Token: SeDebugPrivilege 2044 f76d00b.exe Token: SeDebugPrivilege 2044 f76d00b.exe Token: SeDebugPrivilege 2768 f76eba6.exe Token: SeDebugPrivilege 2768 f76eba6.exe Token: SeDebugPrivilege 2768 f76eba6.exe Token: SeDebugPrivilege 2768 f76eba6.exe Token: SeDebugPrivilege 2768 f76eba6.exe Token: SeDebugPrivilege 2768 f76eba6.exe Token: SeDebugPrivilege 2768 f76eba6.exe Token: SeDebugPrivilege 2768 f76eba6.exe Token: SeDebugPrivilege 2768 f76eba6.exe Token: SeDebugPrivilege 2768 f76eba6.exe Token: SeDebugPrivilege 2768 f76eba6.exe Token: SeDebugPrivilege 2768 f76eba6.exe Token: SeDebugPrivilege 2768 f76eba6.exe Token: SeDebugPrivilege 2768 f76eba6.exe Token: SeDebugPrivilege 2768 f76eba6.exe Token: SeDebugPrivilege 2768 f76eba6.exe Token: SeDebugPrivilege 2768 f76eba6.exe Token: SeDebugPrivilege 2768 f76eba6.exe Token: SeDebugPrivilege 2768 f76eba6.exe Token: SeDebugPrivilege 2768 f76eba6.exe Token: SeDebugPrivilege 2768 f76eba6.exe Token: SeDebugPrivilege 2768 f76eba6.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2360 wrote to memory of 1204 2360 rundll32.exe 31 PID 2360 wrote to memory of 1204 2360 rundll32.exe 31 PID 2360 wrote to memory of 1204 2360 rundll32.exe 31 PID 2360 wrote to memory of 1204 2360 rundll32.exe 31 PID 2360 wrote to memory of 1204 2360 rundll32.exe 31 PID 2360 wrote to memory of 1204 2360 rundll32.exe 31 PID 2360 wrote to memory of 1204 2360 rundll32.exe 31 PID 1204 wrote to memory of 2044 1204 rundll32.exe 32 PID 1204 wrote to memory of 2044 1204 rundll32.exe 32 PID 1204 wrote to memory of 2044 1204 rundll32.exe 32 PID 1204 wrote to memory of 2044 1204 rundll32.exe 32 PID 2044 wrote to memory of 1124 2044 f76d00b.exe 19 PID 2044 wrote to memory of 1176 2044 f76d00b.exe 20 PID 2044 wrote to memory of 1212 2044 f76d00b.exe 21 PID 2044 wrote to memory of 672 2044 f76d00b.exe 25 PID 2044 wrote to memory of 2360 2044 f76d00b.exe 30 PID 2044 wrote to memory of 1204 2044 f76d00b.exe 31 PID 2044 wrote to memory of 1204 2044 f76d00b.exe 31 PID 1204 wrote to memory of 2700 1204 rundll32.exe 33 PID 1204 wrote to memory of 2700 1204 rundll32.exe 33 PID 1204 wrote to memory of 2700 1204 rundll32.exe 33 PID 1204 wrote to memory of 2700 1204 rundll32.exe 33 PID 1204 wrote to memory of 2768 1204 rundll32.exe 34 PID 1204 wrote to memory of 2768 1204 rundll32.exe 34 PID 1204 wrote to memory of 2768 1204 rundll32.exe 34 PID 1204 wrote to memory of 2768 1204 rundll32.exe 34 PID 2044 wrote to memory of 1124 2044 f76d00b.exe 19 PID 2044 wrote to memory of 1176 2044 f76d00b.exe 20 PID 2044 wrote to memory of 1212 2044 f76d00b.exe 21 PID 2044 wrote to memory of 672 2044 f76d00b.exe 25 PID 2044 wrote to memory of 2700 2044 f76d00b.exe 33 PID 2044 wrote to memory of 2700 2044 f76d00b.exe 33 PID 2044 wrote to memory of 2768 2044 f76d00b.exe 34 PID 2044 wrote to memory of 2768 2044 f76d00b.exe 34 PID 2768 wrote to memory of 1124 2768 f76eba6.exe 19 PID 2768 wrote to memory of 1176 2768 f76eba6.exe 20 PID 2768 wrote to memory of 1212 2768 f76eba6.exe 21 PID 2768 wrote to memory of 672 2768 f76eba6.exe 25 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76d00b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76eba6.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1124
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1176
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1212
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\33505769ab40185e0892bf5c8b96c01a1ef51bd47fa270556019944903d22834.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\33505769ab40185e0892bf5c8b96c01a1ef51bd47fa270556019944903d22834.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\f76d00b.exeC:\Users\Admin\AppData\Local\Temp\f76d00b.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2044
-
-
C:\Users\Admin\AppData\Local\Temp\f76d4fb.exeC:\Users\Admin\AppData\Local\Temp\f76d4fb.exe4⤵
- Executes dropped EXE
PID:2700
-
-
C:\Users\Admin\AppData\Local\Temp\f76eba6.exeC:\Users\Admin\AppData\Local\Temp\f76eba6.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2768
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:672
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD53a9708de0742b0d81d3b736b5325f451
SHA1b17281f0797239c46cf49ee4b7b8e653e712505f
SHA2564eb86f0dfcaa4a7bff3ca0e844b2807c5ab89ee7f7dfeb450283b61c903bde12
SHA5120e1fa1595eb5b07ac8db1a4d44467f17deb126de206dfcd4cc15ab124b120fc14dbe59f79c201c74b31df53708f9d0fe37a254f0d0d93d44cb8f14e12c059775
-
Filesize
97KB
MD50a0f2e0059440bdb5e6530fecd720ef5
SHA1c96df4406c78ac56b6bba67fb5bc2f1eef9dd354
SHA256e89c3c7f2356c7ae1e7b52b312de199f5751e04cc88a144d57338d09083651d3
SHA512a51ceebf1f7ac16b0e44def0f1fd60c4cf2b93526aca981ac5b156ea2ee36c95500499a61fa00aa4c9890789bffb93ba8f72f37aa9f9a22305808742bb1a5058