Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
16-12-2024 23:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a9918aef775c477acdbb0a9ec35c1fcd843feeec97d8ea74b67d771ab46395a2N.dll
Resource
win7-20240903-en
windows7-x64
17 signatures
120 seconds
General
-
Target
a9918aef775c477acdbb0a9ec35c1fcd843feeec97d8ea74b67d771ab46395a2N.dll
-
Size
120KB
-
MD5
45ed632c5a5bd3d21c796625496b8ad0
-
SHA1
a38d1a725cd53bc232d6229ca5c6648ffde3d0c0
-
SHA256
a9918aef775c477acdbb0a9ec35c1fcd843feeec97d8ea74b67d771ab46395a2
-
SHA512
0f0aac942eea42bbb985a740986071d78e5bfbdefdd1733f83fb98da5eb7a83776d097c72e11569159b849020632572054b23870b2aa7f2df63faf30dce207f2
-
SSDEEP
3072:2xMmFcHmvcN6OzxwU0SlXsAPwUGwa7BHoMU9:wJF2cCwU05awaaZjU9
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f769b94.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f769b94.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f769b94.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76bb34.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76bb34.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76bb34.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f769b94.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76bb34.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f769b94.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f769b94.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f769b94.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f769b94.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f769b94.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76bb34.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76bb34.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76bb34.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76bb34.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f769b94.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76bb34.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76bb34.exe -
Executes dropped EXE 3 IoCs
pid Process 2484 f769b94.exe 2816 f769d87.exe 2176 f76bb34.exe -
Loads dropped DLL 6 IoCs
pid Process 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f769b94.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f769b94.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76bb34.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f769b94.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f769b94.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76bb34.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76bb34.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f769b94.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76bb34.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76bb34.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76bb34.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f769b94.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76bb34.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f769b94.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f769b94.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76bb34.exe -
Enumerates connected drives 3 TTPs 17 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: f769b94.exe File opened (read-only) \??\H: f769b94.exe File opened (read-only) \??\I: f769b94.exe File opened (read-only) \??\J: f769b94.exe File opened (read-only) \??\O: f769b94.exe File opened (read-only) \??\S: f769b94.exe File opened (read-only) \??\H: f76bb34.exe File opened (read-only) \??\K: f769b94.exe File opened (read-only) \??\M: f769b94.exe File opened (read-only) \??\N: f769b94.exe File opened (read-only) \??\Q: f769b94.exe File opened (read-only) \??\E: f769b94.exe File opened (read-only) \??\L: f769b94.exe File opened (read-only) \??\P: f769b94.exe File opened (read-only) \??\G: f76bb34.exe File opened (read-only) \??\G: f769b94.exe File opened (read-only) \??\E: f76bb34.exe -
resource yara_rule behavioral1/memory/2484-18-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2484-21-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2484-24-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2484-22-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2484-20-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2484-17-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2484-23-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2484-19-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2484-16-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2484-25-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2484-66-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2484-65-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2484-64-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2484-67-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2484-68-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2484-70-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2484-71-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2484-72-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2484-73-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2484-89-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2484-90-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2484-150-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2176-162-0x0000000000A80000-0x0000000001B3A000-memory.dmp upx behavioral1/memory/2176-206-0x0000000000A80000-0x0000000001B3A000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\f76ebb6 f76bb34.exe File created C:\Windows\f769c20 f769b94.exe File opened for modification C:\Windows\SYSTEM.INI f769b94.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f769b94.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76bb34.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2484 f769b94.exe 2484 f769b94.exe 2176 f76bb34.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 2484 f769b94.exe Token: SeDebugPrivilege 2484 f769b94.exe Token: SeDebugPrivilege 2484 f769b94.exe Token: SeDebugPrivilege 2484 f769b94.exe Token: SeDebugPrivilege 2484 f769b94.exe Token: SeDebugPrivilege 2484 f769b94.exe Token: SeDebugPrivilege 2484 f769b94.exe Token: SeDebugPrivilege 2484 f769b94.exe Token: SeDebugPrivilege 2484 f769b94.exe Token: SeDebugPrivilege 2484 f769b94.exe Token: SeDebugPrivilege 2484 f769b94.exe Token: SeDebugPrivilege 2484 f769b94.exe Token: SeDebugPrivilege 2484 f769b94.exe Token: SeDebugPrivilege 2484 f769b94.exe Token: SeDebugPrivilege 2484 f769b94.exe Token: SeDebugPrivilege 2484 f769b94.exe Token: SeDebugPrivilege 2484 f769b94.exe Token: SeDebugPrivilege 2484 f769b94.exe Token: SeDebugPrivilege 2484 f769b94.exe Token: SeDebugPrivilege 2484 f769b94.exe Token: SeDebugPrivilege 2484 f769b94.exe Token: SeDebugPrivilege 2484 f769b94.exe Token: SeDebugPrivilege 2484 f769b94.exe Token: SeDebugPrivilege 2176 f76bb34.exe Token: SeDebugPrivilege 2176 f76bb34.exe Token: SeDebugPrivilege 2176 f76bb34.exe Token: SeDebugPrivilege 2176 f76bb34.exe Token: SeDebugPrivilege 2176 f76bb34.exe Token: SeDebugPrivilege 2176 f76bb34.exe Token: SeDebugPrivilege 2176 f76bb34.exe Token: SeDebugPrivilege 2176 f76bb34.exe Token: SeDebugPrivilege 2176 f76bb34.exe Token: SeDebugPrivilege 2176 f76bb34.exe Token: SeDebugPrivilege 2176 f76bb34.exe Token: SeDebugPrivilege 2176 f76bb34.exe Token: SeDebugPrivilege 2176 f76bb34.exe Token: SeDebugPrivilege 2176 f76bb34.exe Token: SeDebugPrivilege 2176 f76bb34.exe Token: SeDebugPrivilege 2176 f76bb34.exe Token: SeDebugPrivilege 2176 f76bb34.exe Token: SeDebugPrivilege 2176 f76bb34.exe Token: SeDebugPrivilege 2176 f76bb34.exe Token: SeDebugPrivilege 2176 f76bb34.exe Token: SeDebugPrivilege 2176 f76bb34.exe Token: SeDebugPrivilege 2176 f76bb34.exe Token: SeDebugPrivilege 2176 f76bb34.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2684 wrote to memory of 2680 2684 rundll32.exe 30 PID 2684 wrote to memory of 2680 2684 rundll32.exe 30 PID 2684 wrote to memory of 2680 2684 rundll32.exe 30 PID 2684 wrote to memory of 2680 2684 rundll32.exe 30 PID 2684 wrote to memory of 2680 2684 rundll32.exe 30 PID 2684 wrote to memory of 2680 2684 rundll32.exe 30 PID 2684 wrote to memory of 2680 2684 rundll32.exe 30 PID 2680 wrote to memory of 2484 2680 rundll32.exe 31 PID 2680 wrote to memory of 2484 2680 rundll32.exe 31 PID 2680 wrote to memory of 2484 2680 rundll32.exe 31 PID 2680 wrote to memory of 2484 2680 rundll32.exe 31 PID 2484 wrote to memory of 1096 2484 f769b94.exe 19 PID 2484 wrote to memory of 1176 2484 f769b94.exe 20 PID 2484 wrote to memory of 1204 2484 f769b94.exe 21 PID 2484 wrote to memory of 884 2484 f769b94.exe 25 PID 2484 wrote to memory of 2684 2484 f769b94.exe 29 PID 2484 wrote to memory of 2680 2484 f769b94.exe 30 PID 2484 wrote to memory of 2680 2484 f769b94.exe 30 PID 2680 wrote to memory of 2816 2680 rundll32.exe 32 PID 2680 wrote to memory of 2816 2680 rundll32.exe 32 PID 2680 wrote to memory of 2816 2680 rundll32.exe 32 PID 2680 wrote to memory of 2816 2680 rundll32.exe 32 PID 2680 wrote to memory of 2176 2680 rundll32.exe 33 PID 2680 wrote to memory of 2176 2680 rundll32.exe 33 PID 2680 wrote to memory of 2176 2680 rundll32.exe 33 PID 2680 wrote to memory of 2176 2680 rundll32.exe 33 PID 2484 wrote to memory of 1096 2484 f769b94.exe 19 PID 2484 wrote to memory of 1176 2484 f769b94.exe 20 PID 2484 wrote to memory of 1204 2484 f769b94.exe 21 PID 2484 wrote to memory of 884 2484 f769b94.exe 25 PID 2484 wrote to memory of 2816 2484 f769b94.exe 32 PID 2484 wrote to memory of 2816 2484 f769b94.exe 32 PID 2484 wrote to memory of 2176 2484 f769b94.exe 33 PID 2484 wrote to memory of 2176 2484 f769b94.exe 33 PID 2176 wrote to memory of 1096 2176 f76bb34.exe 19 PID 2176 wrote to memory of 1176 2176 f76bb34.exe 20 PID 2176 wrote to memory of 1204 2176 f76bb34.exe 21 PID 2176 wrote to memory of 884 2176 f76bb34.exe 25 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f769b94.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76bb34.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1096
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1176
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1204
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9918aef775c477acdbb0a9ec35c1fcd843feeec97d8ea74b67d771ab46395a2N.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a9918aef775c477acdbb0a9ec35c1fcd843feeec97d8ea74b67d771ab46395a2N.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\f769b94.exeC:\Users\Admin\AppData\Local\Temp\f769b94.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2484
-
-
C:\Users\Admin\AppData\Local\Temp\f769d87.exeC:\Users\Admin\AppData\Local\Temp\f769d87.exe4⤵
- Executes dropped EXE
PID:2816
-
-
C:\Users\Admin\AppData\Local\Temp\f76bb34.exeC:\Users\Admin\AppData\Local\Temp\f76bb34.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2176
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:884
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD5c7f62fa56e6c2e39e800830a1545b127
SHA1a9c22aeb7ddec4282e49d115be37ad80c8e0ef3f
SHA2569f6ccbac71c5c0380077befe93c8277690705dae5e0bbd15953b5c6b47f84b1b
SHA5126af11a0191ebb98c3d8aa355cb7378b1106741fcc8fc0b5472f01e6b123e70b05dda762a8dd77aefe53e236d0c0602ef6fc580afbc32d31bbe49adebb0e24e76
-
Filesize
97KB
MD5a68b9133d308e45d9bb4aef54ccfb367
SHA11d59117c49d0a2a76ef2ef4f6765908b814a80ca
SHA2569e8a916a40552853bd8505a4b264ece3d078cde99027342c2ffa222355ecf017
SHA5126f9ecc487b89d94417def4209307d5616312d58da14dda633cbecf9f73044e771650377e4b710078671cfe21945773ebdb5370c0c1f93f40ac5ee0dae1cb5f36