Analysis

  • max time kernel
    95s
  • max time network
    97s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-12-2024 01:01

General

  • Target

    22319862d0a20d4c7eaf9a4bf5f826ed6750785fcc71dd72ac0279c9c8330670N.dll

  • Size

    120KB

  • MD5

    f999f2886d00aac478e482d2ed69f1c0

  • SHA1

    8a619ef2c1b337114c86ea513126bc59a9eb3fb2

  • SHA256

    22319862d0a20d4c7eaf9a4bf5f826ed6750785fcc71dd72ac0279c9c8330670

  • SHA512

    e4097640d62e74801e42b54264e695a647922baf03e1933f03d9219d8ace490e11b66b3ee9f92eed4778bb65589ef4c3db3fca0acd93dc86fcb702a06225a1b9

  • SSDEEP

    3072:WsewQHr+MZe1+g3ZlL966xqy6LcvpCnRN48iH:Ws2r+rDL0AqyCMuRN48i

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

  • Modifies firewall policy service 3 TTPs 3 IoCs
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

  • Sality family
  • UAC bypass 3 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 6 IoCs
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 7 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 15 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file 32 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 49 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Windows\system32\fontdrvhost.exe
    "fontdrvhost.exe"
    1⤵
      PID:792
    • C:\Windows\system32\fontdrvhost.exe
      "fontdrvhost.exe"
      1⤵
        PID:800
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        1⤵
          PID:380
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
          1⤵
            PID:2600
          • C:\Windows\system32\sihost.exe
            sihost.exe
            1⤵
              PID:2612
            • C:\Windows\system32\taskhostw.exe
              taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
              1⤵
                PID:2728
              • C:\Windows\Explorer.EXE
                C:\Windows\Explorer.EXE
                1⤵
                  PID:3448
                  • C:\Windows\system32\rundll32.exe
                    rundll32.exe C:\Users\Admin\AppData\Local\Temp\22319862d0a20d4c7eaf9a4bf5f826ed6750785fcc71dd72ac0279c9c8330670N.dll,#1
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3972
                    • C:\Windows\SysWOW64\rundll32.exe
                      rundll32.exe C:\Users\Admin\AppData\Local\Temp\22319862d0a20d4c7eaf9a4bf5f826ed6750785fcc71dd72ac0279c9c8330670N.dll,#1
                      3⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:4928
                      • C:\Users\Admin\AppData\Local\Temp\e57782d.exe
                        C:\Users\Admin\AppData\Local\Temp\e57782d.exe
                        4⤵
                        • Modifies firewall policy service
                        • UAC bypass
                        • Windows security bypass
                        • Executes dropped EXE
                        • Windows security modification
                        • Checks whether UAC is enabled
                        • Enumerates connected drives
                        • Drops file in Program Files directory
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        • System policy modification
                        PID:888
                      • C:\Users\Admin\AppData\Local\Temp\e577985.exe
                        C:\Users\Admin\AppData\Local\Temp\e577985.exe
                        4⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:3404
                      • C:\Users\Admin\AppData\Local\Temp\e5793b4.exe
                        C:\Users\Admin\AppData\Local\Temp\e5793b4.exe
                        4⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:2384
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                  1⤵
                    PID:3576
                  • C:\Windows\system32\DllHost.exe
                    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                    1⤵
                      PID:3768
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:3888
                      • C:\Windows\System32\RuntimeBroker.exe
                        C:\Windows\System32\RuntimeBroker.exe -Embedding
                        1⤵
                          PID:3952
                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                          1⤵
                            PID:4036
                          • C:\Windows\System32\RuntimeBroker.exe
                            C:\Windows\System32\RuntimeBroker.exe -Embedding
                            1⤵
                              PID:4152
                            • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
                              "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
                              1⤵
                                PID:5040
                              • C:\Windows\System32\RuntimeBroker.exe
                                C:\Windows\System32\RuntimeBroker.exe -Embedding
                                1⤵
                                  PID:4468

                                Network

                                • flag-us
                                  DNS
                                  8.8.8.8.in-addr.arpa
                                  Remote address:
                                  8.8.8.8:53
                                  Request
                                  8.8.8.8.in-addr.arpa
                                  IN PTR
                                  Response
                                  8.8.8.8.in-addr.arpa
                                  IN PTR
                                  dnsgoogle
                                • flag-us
                                  DNS
                                  28.118.140.52.in-addr.arpa
                                  Remote address:
                                  8.8.8.8:53
                                  Request
                                  28.118.140.52.in-addr.arpa
                                  IN PTR
                                  Response
                                • flag-us
                                  DNS
                                  20.49.80.91.in-addr.arpa
                                  Remote address:
                                  8.8.8.8:53
                                  Request
                                  20.49.80.91.in-addr.arpa
                                  IN PTR
                                  Response
                                • flag-us
                                  DNS
                                  71.31.126.40.in-addr.arpa
                                  Remote address:
                                  8.8.8.8:53
                                  Request
                                  71.31.126.40.in-addr.arpa
                                  IN PTR
                                  Response
                                • flag-us
                                  DNS
                                  95.221.229.192.in-addr.arpa
                                  Remote address:
                                  8.8.8.8:53
                                  Request
                                  95.221.229.192.in-addr.arpa
                                  IN PTR
                                  Response
                                • flag-us
                                  DNS
                                  104.219.191.52.in-addr.arpa
                                  Remote address:
                                  8.8.8.8:53
                                  Request
                                  104.219.191.52.in-addr.arpa
                                  IN PTR
                                  Response
                                • flag-us
                                  DNS
                                  50.23.12.20.in-addr.arpa
                                  Remote address:
                                  8.8.8.8:53
                                  Request
                                  50.23.12.20.in-addr.arpa
                                  IN PTR
                                  Response
                                • flag-us
                                  DNS
                                  171.39.242.20.in-addr.arpa
                                  Remote address:
                                  8.8.8.8:53
                                  Request
                                  171.39.242.20.in-addr.arpa
                                  IN PTR
                                  Response
                                • flag-us
                                  DNS
                                  172.210.232.199.in-addr.arpa
                                  Remote address:
                                  8.8.8.8:53
                                  Request
                                  172.210.232.199.in-addr.arpa
                                  IN PTR
                                  Response
                                • flag-us
                                  DNS
                                  133.130.81.91.in-addr.arpa
                                  Remote address:
                                  8.8.8.8:53
                                  Request
                                  133.130.81.91.in-addr.arpa
                                  IN PTR
                                  Response
                                • flag-us
                                  DNS
                                  11.227.111.52.in-addr.arpa
                                  Remote address:
                                  8.8.8.8:53
                                  Request
                                  11.227.111.52.in-addr.arpa
                                  IN PTR
                                  Response
                                No results found
                                • 8.8.8.8:53
                                  8.8.8.8.in-addr.arpa
                                  dns
                                  66 B
                                  90 B
                                  1
                                  1

                                  DNS Request

                                  8.8.8.8.in-addr.arpa

                                • 8.8.8.8:53
                                  28.118.140.52.in-addr.arpa
                                  dns
                                  72 B
                                  158 B
                                  1
                                  1

                                  DNS Request

                                  28.118.140.52.in-addr.arpa

                                • 8.8.8.8:53
                                  20.49.80.91.in-addr.arpa
                                  dns
                                  70 B
                                  145 B
                                  1
                                  1

                                  DNS Request

                                  20.49.80.91.in-addr.arpa

                                • 8.8.8.8:53
                                  71.31.126.40.in-addr.arpa
                                  dns
                                  71 B
                                  157 B
                                  1
                                  1

                                  DNS Request

                                  71.31.126.40.in-addr.arpa

                                • 8.8.8.8:53
                                  95.221.229.192.in-addr.arpa
                                  dns
                                  73 B
                                  144 B
                                  1
                                  1

                                  DNS Request

                                  95.221.229.192.in-addr.arpa

                                • 8.8.8.8:53
                                  104.219.191.52.in-addr.arpa
                                  dns
                                  73 B
                                  147 B
                                  1
                                  1

                                  DNS Request

                                  104.219.191.52.in-addr.arpa

                                • 8.8.8.8:53
                                  50.23.12.20.in-addr.arpa
                                  dns
                                  70 B
                                  156 B
                                  1
                                  1

                                  DNS Request

                                  50.23.12.20.in-addr.arpa

                                • 8.8.8.8:53
                                  171.39.242.20.in-addr.arpa
                                  dns
                                  72 B
                                  158 B
                                  1
                                  1

                                  DNS Request

                                  171.39.242.20.in-addr.arpa

                                • 8.8.8.8:53
                                  172.210.232.199.in-addr.arpa
                                  dns
                                  74 B
                                  128 B
                                  1
                                  1

                                  DNS Request

                                  172.210.232.199.in-addr.arpa

                                • 8.8.8.8:53
                                  133.130.81.91.in-addr.arpa
                                  dns
                                  72 B
                                  147 B
                                  1
                                  1

                                  DNS Request

                                  133.130.81.91.in-addr.arpa

                                • 8.8.8.8:53
                                  11.227.111.52.in-addr.arpa
                                  dns
                                  72 B
                                  158 B
                                  1
                                  1

                                  DNS Request

                                  11.227.111.52.in-addr.arpa

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\Local\Temp\e57782d.exe

                                  Filesize

                                  97KB

                                  MD5

                                  c0b4e1661853a3da097f4ba48aa32700

                                  SHA1

                                  d58a4071ad522b6b68dce1b533829246e3d27cfa

                                  SHA256

                                  b1f80258801bea1e201fd0f7f25ad6fafa287b71524e0881ca7b356b01ab41a6

                                  SHA512

                                  918892c38b1ec3806ab7dade6c736be0383b08d5b91cfa1495dd0cc3fa47f31762f284ce40239415ce178c04a6acbdf27b0fe9e5eb7510dbc0e6a62c77be6bb6

                                • memory/888-43-0x00000000007B0000-0x000000000186A000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/888-107-0x0000000000400000-0x0000000000412000-memory.dmp

                                  Filesize

                                  72KB

                                • memory/888-6-0x00000000007B0000-0x000000000186A000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/888-11-0x00000000007B0000-0x000000000186A000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/888-10-0x00000000007B0000-0x000000000186A000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/888-87-0x00000000007B0000-0x000000000186A000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/888-27-0x00000000007B0000-0x000000000186A000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/888-33-0x00000000007B0000-0x000000000186A000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/888-28-0x00000000007B0000-0x000000000186A000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/888-18-0x00000000007B0000-0x000000000186A000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/888-89-0x00000000007B0000-0x000000000186A000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/888-34-0x0000000001B70000-0x0000000001B72000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/888-12-0x00000000007B0000-0x000000000186A000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/888-96-0x0000000001B70000-0x0000000001B72000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/888-23-0x0000000003FB0000-0x0000000003FB1000-memory.dmp

                                  Filesize

                                  4KB

                                • memory/888-29-0x0000000001B70000-0x0000000001B72000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/888-85-0x00000000007B0000-0x000000000186A000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/888-19-0x00000000007B0000-0x000000000186A000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/888-82-0x00000000007B0000-0x000000000186A000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/888-8-0x00000000007B0000-0x000000000186A000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/888-9-0x00000000007B0000-0x000000000186A000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/888-36-0x00000000007B0000-0x000000000186A000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/888-42-0x00000000007B0000-0x000000000186A000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/888-38-0x00000000007B0000-0x000000000186A000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/888-40-0x00000000007B0000-0x000000000186A000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/888-39-0x00000000007B0000-0x000000000186A000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/888-37-0x00000000007B0000-0x000000000186A000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/888-4-0x0000000000400000-0x0000000000412000-memory.dmp

                                  Filesize

                                  72KB

                                • memory/888-66-0x00000000007B0000-0x000000000186A000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/888-51-0x00000000007B0000-0x000000000186A000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/888-55-0x00000000007B0000-0x000000000186A000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/888-56-0x00000000007B0000-0x000000000186A000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/888-80-0x00000000007B0000-0x000000000186A000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/888-76-0x00000000007B0000-0x000000000186A000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/888-75-0x00000000007B0000-0x000000000186A000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/888-73-0x00000000007B0000-0x000000000186A000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/888-72-0x00000000007B0000-0x000000000186A000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/888-67-0x00000000007B0000-0x000000000186A000-memory.dmp

                                  Filesize

                                  16.7MB

                                • memory/2384-65-0x00000000001E0000-0x00000000001E2000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/2384-86-0x00000000001E0000-0x00000000001E2000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/2384-52-0x0000000000400000-0x0000000000412000-memory.dmp

                                  Filesize

                                  72KB

                                • memory/2384-115-0x0000000000400000-0x0000000000412000-memory.dmp

                                  Filesize

                                  72KB

                                • memory/2384-63-0x00000000001F0000-0x00000000001F1000-memory.dmp

                                  Filesize

                                  4KB

                                • memory/2384-64-0x00000000001E0000-0x00000000001E2000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/3404-59-0x00000000004F0000-0x00000000004F1000-memory.dmp

                                  Filesize

                                  4KB

                                • memory/3404-61-0x00000000001C0000-0x00000000001C2000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/3404-60-0x00000000001C0000-0x00000000001C2000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/3404-111-0x0000000000400000-0x0000000000412000-memory.dmp

                                  Filesize

                                  72KB

                                • memory/3404-35-0x0000000000400000-0x0000000000412000-memory.dmp

                                  Filesize

                                  72KB

                                • memory/3404-81-0x00000000001C0000-0x00000000001C2000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/4928-21-0x00000000040F0000-0x00000000040F1000-memory.dmp

                                  Filesize

                                  4KB

                                • memory/4928-20-0x00000000040E0000-0x00000000040E2000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/4928-24-0x00000000040E0000-0x00000000040E2000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/4928-32-0x00000000040E0000-0x00000000040E2000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/4928-0-0x0000000010000000-0x0000000010020000-memory.dmp

                                  Filesize

                                  128KB

                                We care about your privacy.

                                This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.