Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
16-12-2024 05:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5a2a08239255b4fb72978a36c942631b4a2b364b8942d173e29cc766ca8fc9e1N.dll
Resource
win7-20240903-en
windows7-x64
17 signatures
120 seconds
General
-
Target
5a2a08239255b4fb72978a36c942631b4a2b364b8942d173e29cc766ca8fc9e1N.dll
-
Size
120KB
-
MD5
da51137d80cd735cb921143734f0c8f0
-
SHA1
5074659d49b5f8ff626b68dc8fdf5b6ccda810da
-
SHA256
5a2a08239255b4fb72978a36c942631b4a2b364b8942d173e29cc766ca8fc9e1
-
SHA512
94aa177726963665fd077921302700e41310ecae880fe0727a311298c1ae5a78a029fba8ea2a9ef6fc5ac5f8b046f111ee22fd8d7341b1cb6b863676cb0142f7
-
SSDEEP
3072:+dBN2V1GRinXMGSDDOLEG5Xa3kSrga/m:+diW8XMRP8EUXcDra
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76a68c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76a4a8.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76a4a8.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76a4a8.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76a68c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76a68c.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76a4a8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76a68c.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76a68c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76a68c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76a4a8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76a4a8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76a4a8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76a4a8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76a68c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76a68c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76a68c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76a68c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76a4a8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76a4a8.exe -
Executes dropped EXE 3 IoCs
pid Process 2052 f76a4a8.exe 2736 f76a68c.exe 2636 f76c0fe.exe -
Loads dropped DLL 6 IoCs
pid Process 2056 rundll32.exe 2056 rundll32.exe 2056 rundll32.exe 2056 rundll32.exe 2056 rundll32.exe 2056 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76a4a8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76a68c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76a68c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76a4a8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76a68c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76a68c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76a68c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76a68c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76a68c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76a4a8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76a4a8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76a4a8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76a4a8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76a4a8.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76a4a8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76a68c.exe -
Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: f76a4a8.exe File opened (read-only) \??\I: f76a4a8.exe File opened (read-only) \??\S: f76a4a8.exe File opened (read-only) \??\T: f76a4a8.exe File opened (read-only) \??\E: f76a4a8.exe File opened (read-only) \??\P: f76a4a8.exe File opened (read-only) \??\R: f76a4a8.exe File opened (read-only) \??\G: f76a4a8.exe File opened (read-only) \??\K: f76a4a8.exe File opened (read-only) \??\M: f76a4a8.exe File opened (read-only) \??\N: f76a4a8.exe File opened (read-only) \??\J: f76a4a8.exe File opened (read-only) \??\L: f76a4a8.exe File opened (read-only) \??\O: f76a4a8.exe File opened (read-only) \??\Q: f76a4a8.exe -
resource yara_rule behavioral1/memory/2052-15-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2052-18-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2052-22-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2052-16-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2052-14-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2052-21-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2052-20-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2052-19-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2052-17-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2052-13-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2052-60-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2052-62-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2052-61-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2052-63-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2052-65-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2052-66-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2052-67-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2052-81-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2052-82-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2052-85-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2052-86-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2052-156-0x00000000006C0000-0x000000000177A000-memory.dmp upx behavioral1/memory/2736-165-0x0000000000950000-0x0000000001A0A000-memory.dmp upx behavioral1/memory/2736-194-0x0000000000950000-0x0000000001A0A000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\f76a515 f76a4a8.exe File opened for modification C:\Windows\SYSTEM.INI f76a4a8.exe File created C:\Windows\f76f595 f76a68c.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76a68c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76a4a8.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2052 f76a4a8.exe 2052 f76a4a8.exe 2736 f76a68c.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 2052 f76a4a8.exe Token: SeDebugPrivilege 2052 f76a4a8.exe Token: SeDebugPrivilege 2052 f76a4a8.exe Token: SeDebugPrivilege 2052 f76a4a8.exe Token: SeDebugPrivilege 2052 f76a4a8.exe Token: SeDebugPrivilege 2052 f76a4a8.exe Token: SeDebugPrivilege 2052 f76a4a8.exe Token: SeDebugPrivilege 2052 f76a4a8.exe Token: SeDebugPrivilege 2052 f76a4a8.exe Token: SeDebugPrivilege 2052 f76a4a8.exe Token: SeDebugPrivilege 2052 f76a4a8.exe Token: SeDebugPrivilege 2052 f76a4a8.exe Token: SeDebugPrivilege 2052 f76a4a8.exe Token: SeDebugPrivilege 2052 f76a4a8.exe Token: SeDebugPrivilege 2052 f76a4a8.exe Token: SeDebugPrivilege 2052 f76a4a8.exe Token: SeDebugPrivilege 2052 f76a4a8.exe Token: SeDebugPrivilege 2052 f76a4a8.exe Token: SeDebugPrivilege 2052 f76a4a8.exe Token: SeDebugPrivilege 2052 f76a4a8.exe Token: SeDebugPrivilege 2052 f76a4a8.exe Token: SeDebugPrivilege 2052 f76a4a8.exe Token: SeDebugPrivilege 2052 f76a4a8.exe Token: SeDebugPrivilege 2736 f76a68c.exe Token: SeDebugPrivilege 2736 f76a68c.exe Token: SeDebugPrivilege 2736 f76a68c.exe Token: SeDebugPrivilege 2736 f76a68c.exe Token: SeDebugPrivilege 2736 f76a68c.exe Token: SeDebugPrivilege 2736 f76a68c.exe Token: SeDebugPrivilege 2736 f76a68c.exe Token: SeDebugPrivilege 2736 f76a68c.exe Token: SeDebugPrivilege 2736 f76a68c.exe Token: SeDebugPrivilege 2736 f76a68c.exe Token: SeDebugPrivilege 2736 f76a68c.exe Token: SeDebugPrivilege 2736 f76a68c.exe Token: SeDebugPrivilege 2736 f76a68c.exe Token: SeDebugPrivilege 2736 f76a68c.exe Token: SeDebugPrivilege 2736 f76a68c.exe Token: SeDebugPrivilege 2736 f76a68c.exe Token: SeDebugPrivilege 2736 f76a68c.exe Token: SeDebugPrivilege 2736 f76a68c.exe Token: SeDebugPrivilege 2736 f76a68c.exe Token: SeDebugPrivilege 2736 f76a68c.exe Token: SeDebugPrivilege 2736 f76a68c.exe Token: SeDebugPrivilege 2736 f76a68c.exe Token: SeDebugPrivilege 2736 f76a68c.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2420 wrote to memory of 2056 2420 rundll32.exe 30 PID 2420 wrote to memory of 2056 2420 rundll32.exe 30 PID 2420 wrote to memory of 2056 2420 rundll32.exe 30 PID 2420 wrote to memory of 2056 2420 rundll32.exe 30 PID 2420 wrote to memory of 2056 2420 rundll32.exe 30 PID 2420 wrote to memory of 2056 2420 rundll32.exe 30 PID 2420 wrote to memory of 2056 2420 rundll32.exe 30 PID 2056 wrote to memory of 2052 2056 rundll32.exe 31 PID 2056 wrote to memory of 2052 2056 rundll32.exe 31 PID 2056 wrote to memory of 2052 2056 rundll32.exe 31 PID 2056 wrote to memory of 2052 2056 rundll32.exe 31 PID 2052 wrote to memory of 1124 2052 f76a4a8.exe 19 PID 2052 wrote to memory of 1180 2052 f76a4a8.exe 20 PID 2052 wrote to memory of 1244 2052 f76a4a8.exe 21 PID 2052 wrote to memory of 112 2052 f76a4a8.exe 25 PID 2052 wrote to memory of 2420 2052 f76a4a8.exe 29 PID 2052 wrote to memory of 2056 2052 f76a4a8.exe 30 PID 2052 wrote to memory of 2056 2052 f76a4a8.exe 30 PID 2056 wrote to memory of 2736 2056 rundll32.exe 32 PID 2056 wrote to memory of 2736 2056 rundll32.exe 32 PID 2056 wrote to memory of 2736 2056 rundll32.exe 32 PID 2056 wrote to memory of 2736 2056 rundll32.exe 32 PID 2056 wrote to memory of 2636 2056 rundll32.exe 33 PID 2056 wrote to memory of 2636 2056 rundll32.exe 33 PID 2056 wrote to memory of 2636 2056 rundll32.exe 33 PID 2056 wrote to memory of 2636 2056 rundll32.exe 33 PID 2052 wrote to memory of 1124 2052 f76a4a8.exe 19 PID 2052 wrote to memory of 1180 2052 f76a4a8.exe 20 PID 2052 wrote to memory of 1244 2052 f76a4a8.exe 21 PID 2052 wrote to memory of 112 2052 f76a4a8.exe 25 PID 2052 wrote to memory of 2736 2052 f76a4a8.exe 32 PID 2052 wrote to memory of 2736 2052 f76a4a8.exe 32 PID 2052 wrote to memory of 2636 2052 f76a4a8.exe 33 PID 2052 wrote to memory of 2636 2052 f76a4a8.exe 33 PID 2736 wrote to memory of 1124 2736 f76a68c.exe 19 PID 2736 wrote to memory of 1180 2736 f76a68c.exe 20 PID 2736 wrote to memory of 1244 2736 f76a68c.exe 21 PID 2736 wrote to memory of 112 2736 f76a68c.exe 25 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76a4a8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76a68c.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1124
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1180
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1244
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5a2a08239255b4fb72978a36c942631b4a2b364b8942d173e29cc766ca8fc9e1N.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5a2a08239255b4fb72978a36c942631b4a2b364b8942d173e29cc766ca8fc9e1N.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\f76a4a8.exeC:\Users\Admin\AppData\Local\Temp\f76a4a8.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2052
-
-
C:\Users\Admin\AppData\Local\Temp\f76a68c.exeC:\Users\Admin\AppData\Local\Temp\f76a68c.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2736
-
-
C:\Users\Admin\AppData\Local\Temp\f76c0fe.exeC:\Users\Admin\AppData\Local\Temp\f76c0fe.exe4⤵
- Executes dropped EXE
PID:2636
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:112
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD52ee273ba01c636638050d3c417362e4f
SHA1c5a9a7e3887a3cd8e965fefdb9add371663a8c39
SHA256fb045142c434935580d78b615862ac54a52314f8f7b547b3ad9f6779ba742d7e
SHA512be1a98423d4152ed86db545bf3734c11230429d106e86ceeb069a431f464f5259b214108ed06f18751f7e32d55962ace8b0f850abf6c05bd629a56a55e2e5b85
-
Filesize
256B
MD57dbc9553f8367f5ffad74b7267e91781
SHA189bc93ea97f13ef75c75c6a99f358a6dcda6f206
SHA25623064aa1801f9bbca9d40695c513bdcc748bce7d5fda454e6f2d85d0d32310e4
SHA512e5fafe1867846454cb1ef80edc04d821ca8adc8491f1c953b98b500ab63e654e5e25e5fabae5892331cf08e9b8d858366aa8854796c834de3eb5369ff42cd3a8