Analysis
-
max time kernel
78s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
17-12-2024 01:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
22319862d0a20d4c7eaf9a4bf5f826ed6750785fcc71dd72ac0279c9c8330670N.dll
Resource
win7-20241010-en
windows7-x64
17 signatures
120 seconds
General
-
Target
22319862d0a20d4c7eaf9a4bf5f826ed6750785fcc71dd72ac0279c9c8330670N.dll
-
Size
120KB
-
MD5
f999f2886d00aac478e482d2ed69f1c0
-
SHA1
8a619ef2c1b337114c86ea513126bc59a9eb3fb2
-
SHA256
22319862d0a20d4c7eaf9a4bf5f826ed6750785fcc71dd72ac0279c9c8330670
-
SHA512
e4097640d62e74801e42b54264e695a647922baf03e1933f03d9219d8ace490e11b66b3ee9f92eed4778bb65589ef4c3db3fca0acd93dc86fcb702a06225a1b9
-
SSDEEP
3072:WsewQHr+MZe1+g3ZlL966xqy6LcvpCnRN48iH:Ws2r+rDL0AqyCMuRN48i
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76f019.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76f019.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76d4ad.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76d4ad.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76d4ad.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76f019.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76d4ad.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76f019.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76d4ad.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76d4ad.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76d4ad.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76d4ad.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76f019.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76f019.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76f019.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76d4ad.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76d4ad.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76f019.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76f019.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76f019.exe -
Executes dropped EXE 3 IoCs
pid Process 2728 f76d4ad.exe 2904 f76d8f1.exe 2708 f76f019.exe -
Loads dropped DLL 6 IoCs
pid Process 1812 rundll32.exe 1812 rundll32.exe 1812 rundll32.exe 1812 rundll32.exe 1812 rundll32.exe 1812 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76f019.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76f019.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76d4ad.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76d4ad.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76d4ad.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76d4ad.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76d4ad.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76f019.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76f019.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76f019.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76f019.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76d4ad.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76d4ad.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76f019.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76d4ad.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76f019.exe -
Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: f76d4ad.exe File opened (read-only) \??\R: f76d4ad.exe File opened (read-only) \??\G: f76d4ad.exe File opened (read-only) \??\H: f76d4ad.exe File opened (read-only) \??\J: f76d4ad.exe File opened (read-only) \??\E: f76d4ad.exe File opened (read-only) \??\L: f76d4ad.exe File opened (read-only) \??\O: f76d4ad.exe File opened (read-only) \??\Q: f76d4ad.exe File opened (read-only) \??\I: f76d4ad.exe File opened (read-only) \??\K: f76d4ad.exe File opened (read-only) \??\M: f76d4ad.exe File opened (read-only) \??\N: f76d4ad.exe File opened (read-only) \??\S: f76d4ad.exe File opened (read-only) \??\E: f76f019.exe -
resource yara_rule behavioral1/memory/2728-11-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2728-14-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2728-13-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2728-21-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2728-20-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2728-19-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2728-18-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2728-17-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2728-16-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2728-15-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2728-62-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2728-61-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2728-63-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2728-64-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2728-65-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2728-67-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2728-80-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2728-82-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2728-85-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2728-86-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2728-154-0x00000000005F0000-0x00000000016AA000-memory.dmp upx behavioral1/memory/2708-170-0x0000000000920000-0x00000000019DA000-memory.dmp upx behavioral1/memory/2708-210-0x0000000000920000-0x00000000019DA000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\f76d559 f76d4ad.exe File opened for modification C:\Windows\SYSTEM.INI f76d4ad.exe File created C:\Windows\f77281a f76f019.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76f019.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76d4ad.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2728 f76d4ad.exe 2728 f76d4ad.exe 2708 f76f019.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 2728 f76d4ad.exe Token: SeDebugPrivilege 2728 f76d4ad.exe Token: SeDebugPrivilege 2728 f76d4ad.exe Token: SeDebugPrivilege 2728 f76d4ad.exe Token: SeDebugPrivilege 2728 f76d4ad.exe Token: SeDebugPrivilege 2728 f76d4ad.exe Token: SeDebugPrivilege 2728 f76d4ad.exe Token: SeDebugPrivilege 2728 f76d4ad.exe Token: SeDebugPrivilege 2728 f76d4ad.exe Token: SeDebugPrivilege 2728 f76d4ad.exe Token: SeDebugPrivilege 2728 f76d4ad.exe Token: SeDebugPrivilege 2728 f76d4ad.exe Token: SeDebugPrivilege 2728 f76d4ad.exe Token: SeDebugPrivilege 2728 f76d4ad.exe Token: SeDebugPrivilege 2728 f76d4ad.exe Token: SeDebugPrivilege 2728 f76d4ad.exe Token: SeDebugPrivilege 2728 f76d4ad.exe Token: SeDebugPrivilege 2728 f76d4ad.exe Token: SeDebugPrivilege 2728 f76d4ad.exe Token: SeDebugPrivilege 2728 f76d4ad.exe Token: SeDebugPrivilege 2728 f76d4ad.exe Token: SeDebugPrivilege 2728 f76d4ad.exe Token: SeDebugPrivilege 2728 f76d4ad.exe Token: SeDebugPrivilege 2728 f76d4ad.exe Token: SeDebugPrivilege 2708 f76f019.exe Token: SeDebugPrivilege 2708 f76f019.exe Token: SeDebugPrivilege 2708 f76f019.exe Token: SeDebugPrivilege 2708 f76f019.exe Token: SeDebugPrivilege 2708 f76f019.exe Token: SeDebugPrivilege 2708 f76f019.exe Token: SeDebugPrivilege 2708 f76f019.exe Token: SeDebugPrivilege 2708 f76f019.exe Token: SeDebugPrivilege 2708 f76f019.exe Token: SeDebugPrivilege 2708 f76f019.exe Token: SeDebugPrivilege 2708 f76f019.exe Token: SeDebugPrivilege 2708 f76f019.exe Token: SeDebugPrivilege 2708 f76f019.exe Token: SeDebugPrivilege 2708 f76f019.exe Token: SeDebugPrivilege 2708 f76f019.exe Token: SeDebugPrivilege 2708 f76f019.exe Token: SeDebugPrivilege 2708 f76f019.exe Token: SeDebugPrivilege 2708 f76f019.exe Token: SeDebugPrivilege 2708 f76f019.exe Token: SeDebugPrivilege 2708 f76f019.exe Token: SeDebugPrivilege 2708 f76f019.exe Token: SeDebugPrivilege 2708 f76f019.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2556 wrote to memory of 1812 2556 rundll32.exe 31 PID 2556 wrote to memory of 1812 2556 rundll32.exe 31 PID 2556 wrote to memory of 1812 2556 rundll32.exe 31 PID 2556 wrote to memory of 1812 2556 rundll32.exe 31 PID 2556 wrote to memory of 1812 2556 rundll32.exe 31 PID 2556 wrote to memory of 1812 2556 rundll32.exe 31 PID 2556 wrote to memory of 1812 2556 rundll32.exe 31 PID 1812 wrote to memory of 2728 1812 rundll32.exe 32 PID 1812 wrote to memory of 2728 1812 rundll32.exe 32 PID 1812 wrote to memory of 2728 1812 rundll32.exe 32 PID 1812 wrote to memory of 2728 1812 rundll32.exe 32 PID 2728 wrote to memory of 1048 2728 f76d4ad.exe 17 PID 2728 wrote to memory of 1096 2728 f76d4ad.exe 19 PID 2728 wrote to memory of 1156 2728 f76d4ad.exe 21 PID 2728 wrote to memory of 1016 2728 f76d4ad.exe 25 PID 2728 wrote to memory of 2556 2728 f76d4ad.exe 30 PID 2728 wrote to memory of 1812 2728 f76d4ad.exe 31 PID 2728 wrote to memory of 1812 2728 f76d4ad.exe 31 PID 1812 wrote to memory of 2904 1812 rundll32.exe 33 PID 1812 wrote to memory of 2904 1812 rundll32.exe 33 PID 1812 wrote to memory of 2904 1812 rundll32.exe 33 PID 1812 wrote to memory of 2904 1812 rundll32.exe 33 PID 1812 wrote to memory of 2708 1812 rundll32.exe 34 PID 1812 wrote to memory of 2708 1812 rundll32.exe 34 PID 1812 wrote to memory of 2708 1812 rundll32.exe 34 PID 1812 wrote to memory of 2708 1812 rundll32.exe 34 PID 2728 wrote to memory of 1048 2728 f76d4ad.exe 17 PID 2728 wrote to memory of 1096 2728 f76d4ad.exe 19 PID 2728 wrote to memory of 1156 2728 f76d4ad.exe 21 PID 2728 wrote to memory of 1016 2728 f76d4ad.exe 25 PID 2728 wrote to memory of 2904 2728 f76d4ad.exe 33 PID 2728 wrote to memory of 2904 2728 f76d4ad.exe 33 PID 2728 wrote to memory of 2708 2728 f76d4ad.exe 34 PID 2728 wrote to memory of 2708 2728 f76d4ad.exe 34 PID 2708 wrote to memory of 1048 2708 f76f019.exe 17 PID 2708 wrote to memory of 1096 2708 f76f019.exe 19 PID 2708 wrote to memory of 1156 2708 f76f019.exe 21 PID 2708 wrote to memory of 1016 2708 f76f019.exe 25 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76d4ad.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76f019.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1048
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1096
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1156
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\22319862d0a20d4c7eaf9a4bf5f826ed6750785fcc71dd72ac0279c9c8330670N.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\22319862d0a20d4c7eaf9a4bf5f826ed6750785fcc71dd72ac0279c9c8330670N.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\f76d4ad.exeC:\Users\Admin\AppData\Local\Temp\f76d4ad.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2728
-
-
C:\Users\Admin\AppData\Local\Temp\f76d8f1.exeC:\Users\Admin\AppData\Local\Temp\f76d8f1.exe4⤵
- Executes dropped EXE
PID:2904
-
-
C:\Users\Admin\AppData\Local\Temp\f76f019.exeC:\Users\Admin\AppData\Local\Temp\f76f019.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2708
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1016
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD5878e6b88b7bd8fbfc53a9b90b81efc63
SHA1a75704fdc597cd8b8d095974091a7f2992ce1cb7
SHA2569b8fa69c6956b5e6ac08ba35678bcf2f55fad1e16a3fb8b1b16af1c05b6cacd8
SHA51223f6d149fc9b9f3c3c8ea21c8fbbc3ee34d7a016104041149d47ac04ed023ebc1abd69db8271b584c7ad494f755594b9947c33ed7a1d7ac60b2275ce8b50a9fd
-
Filesize
97KB
MD5c0b4e1661853a3da097f4ba48aa32700
SHA1d58a4071ad522b6b68dce1b533829246e3d27cfa
SHA256b1f80258801bea1e201fd0f7f25ad6fafa287b71524e0881ca7b356b01ab41a6
SHA512918892c38b1ec3806ab7dade6c736be0383b08d5b91cfa1495dd0cc3fa47f31762f284ce40239415ce178c04a6acbdf27b0fe9e5eb7510dbc0e6a62c77be6bb6