Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
17-12-2024 03:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e4732d5bbde347680770d26049295ad7ac58b6c92cb481112262ff9fe296cb5f.dll
Resource
win7-20240903-en
windows7-x64
17 signatures
120 seconds
General
-
Target
e4732d5bbde347680770d26049295ad7ac58b6c92cb481112262ff9fe296cb5f.dll
-
Size
120KB
-
MD5
4c80fc7a52d0c19ad035e07ea1f742bf
-
SHA1
5ecebdd9344d52dab544d67e514a05b03a5f0e1d
-
SHA256
e4732d5bbde347680770d26049295ad7ac58b6c92cb481112262ff9fe296cb5f
-
SHA512
ddb461df6a52642841adf30c5c25cf40e1260713f7819ac587e2566c2850ca6d78b2bfdf305a2ce1ce8544937be67a95153b0bf99006a3c5b8ba306a879f959d
-
SSDEEP
1536:QrQJm49UoWHAKZw73UTIMA1OyJGuXjj5Nv5kaw4/KtY2ldPBZx/K5V+MRUYr25P/:Q5QUo6A3tJGuXjlTl/Kt9HZZBK2r
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76cfbd.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76cfbd.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76cfbd.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76eb87.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76eb87.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76eb87.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76cfbd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76eb87.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76eb87.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76eb87.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76eb87.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76cfbd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76cfbd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76cfbd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76cfbd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76eb87.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76eb87.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76cfbd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76cfbd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76eb87.exe -
Executes dropped EXE 3 IoCs
pid Process 2876 f76cfbd.exe 2856 f76d182.exe 2324 f76eb87.exe -
Loads dropped DLL 6 IoCs
pid Process 1632 rundll32.exe 1632 rundll32.exe 1632 rundll32.exe 1632 rundll32.exe 1632 rundll32.exe 1632 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76cfbd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76eb87.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76eb87.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76eb87.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76eb87.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76cfbd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76cfbd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76eb87.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76cfbd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76cfbd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76eb87.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76cfbd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76eb87.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76cfbd.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76eb87.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76cfbd.exe -
Enumerates connected drives 3 TTPs 17 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: f76cfbd.exe File opened (read-only) \??\P: f76cfbd.exe File opened (read-only) \??\T: f76cfbd.exe File opened (read-only) \??\G: f76cfbd.exe File opened (read-only) \??\H: f76cfbd.exe File opened (read-only) \??\I: f76cfbd.exe File opened (read-only) \??\R: f76cfbd.exe File opened (read-only) \??\K: f76cfbd.exe File opened (read-only) \??\N: f76cfbd.exe File opened (read-only) \??\Q: f76cfbd.exe File opened (read-only) \??\E: f76eb87.exe File opened (read-only) \??\O: f76cfbd.exe File opened (read-only) \??\S: f76cfbd.exe File opened (read-only) \??\G: f76eb87.exe File opened (read-only) \??\E: f76cfbd.exe File opened (read-only) \??\J: f76cfbd.exe File opened (read-only) \??\L: f76cfbd.exe -
resource yara_rule behavioral1/memory/2876-15-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2876-19-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2876-22-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2876-17-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2876-18-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2876-24-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2876-25-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2876-21-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2876-23-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2876-20-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2876-65-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2876-66-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2876-67-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2876-69-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2876-68-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2876-72-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2876-85-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2876-86-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2876-88-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2876-90-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2876-158-0x0000000000620000-0x00000000016DA000-memory.dmp upx behavioral1/memory/2324-172-0x0000000000930000-0x00000000019EA000-memory.dmp upx behavioral1/memory/2324-214-0x0000000000930000-0x00000000019EA000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\f76d02b f76cfbd.exe File opened for modification C:\Windows\SYSTEM.INI f76cfbd.exe File created C:\Windows\f77200e f76eb87.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76cfbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76eb87.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2876 f76cfbd.exe 2876 f76cfbd.exe 2324 f76eb87.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 2876 f76cfbd.exe Token: SeDebugPrivilege 2876 f76cfbd.exe Token: SeDebugPrivilege 2876 f76cfbd.exe Token: SeDebugPrivilege 2876 f76cfbd.exe Token: SeDebugPrivilege 2876 f76cfbd.exe Token: SeDebugPrivilege 2876 f76cfbd.exe Token: SeDebugPrivilege 2876 f76cfbd.exe Token: SeDebugPrivilege 2876 f76cfbd.exe Token: SeDebugPrivilege 2876 f76cfbd.exe Token: SeDebugPrivilege 2876 f76cfbd.exe Token: SeDebugPrivilege 2876 f76cfbd.exe Token: SeDebugPrivilege 2876 f76cfbd.exe Token: SeDebugPrivilege 2876 f76cfbd.exe Token: SeDebugPrivilege 2876 f76cfbd.exe Token: SeDebugPrivilege 2876 f76cfbd.exe Token: SeDebugPrivilege 2876 f76cfbd.exe Token: SeDebugPrivilege 2876 f76cfbd.exe Token: SeDebugPrivilege 2876 f76cfbd.exe Token: SeDebugPrivilege 2876 f76cfbd.exe Token: SeDebugPrivilege 2876 f76cfbd.exe Token: SeDebugPrivilege 2876 f76cfbd.exe Token: SeDebugPrivilege 2876 f76cfbd.exe Token: SeDebugPrivilege 2876 f76cfbd.exe Token: SeDebugPrivilege 2876 f76cfbd.exe Token: SeDebugPrivilege 2324 f76eb87.exe Token: SeDebugPrivilege 2324 f76eb87.exe Token: SeDebugPrivilege 2324 f76eb87.exe Token: SeDebugPrivilege 2324 f76eb87.exe Token: SeDebugPrivilege 2324 f76eb87.exe Token: SeDebugPrivilege 2324 f76eb87.exe Token: SeDebugPrivilege 2324 f76eb87.exe Token: SeDebugPrivilege 2324 f76eb87.exe Token: SeDebugPrivilege 2324 f76eb87.exe Token: SeDebugPrivilege 2324 f76eb87.exe Token: SeDebugPrivilege 2324 f76eb87.exe Token: SeDebugPrivilege 2324 f76eb87.exe Token: SeDebugPrivilege 2324 f76eb87.exe Token: SeDebugPrivilege 2324 f76eb87.exe Token: SeDebugPrivilege 2324 f76eb87.exe Token: SeDebugPrivilege 2324 f76eb87.exe Token: SeDebugPrivilege 2324 f76eb87.exe Token: SeDebugPrivilege 2324 f76eb87.exe Token: SeDebugPrivilege 2324 f76eb87.exe Token: SeDebugPrivilege 2324 f76eb87.exe Token: SeDebugPrivilege 2324 f76eb87.exe Token: SeDebugPrivilege 2324 f76eb87.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2056 wrote to memory of 1632 2056 rundll32.exe 30 PID 2056 wrote to memory of 1632 2056 rundll32.exe 30 PID 2056 wrote to memory of 1632 2056 rundll32.exe 30 PID 2056 wrote to memory of 1632 2056 rundll32.exe 30 PID 2056 wrote to memory of 1632 2056 rundll32.exe 30 PID 2056 wrote to memory of 1632 2056 rundll32.exe 30 PID 2056 wrote to memory of 1632 2056 rundll32.exe 30 PID 1632 wrote to memory of 2876 1632 rundll32.exe 31 PID 1632 wrote to memory of 2876 1632 rundll32.exe 31 PID 1632 wrote to memory of 2876 1632 rundll32.exe 31 PID 1632 wrote to memory of 2876 1632 rundll32.exe 31 PID 2876 wrote to memory of 1064 2876 f76cfbd.exe 18 PID 2876 wrote to memory of 1164 2876 f76cfbd.exe 20 PID 2876 wrote to memory of 1188 2876 f76cfbd.exe 21 PID 2876 wrote to memory of 1428 2876 f76cfbd.exe 25 PID 2876 wrote to memory of 2056 2876 f76cfbd.exe 29 PID 2876 wrote to memory of 1632 2876 f76cfbd.exe 30 PID 2876 wrote to memory of 1632 2876 f76cfbd.exe 30 PID 1632 wrote to memory of 2856 1632 rundll32.exe 32 PID 1632 wrote to memory of 2856 1632 rundll32.exe 32 PID 1632 wrote to memory of 2856 1632 rundll32.exe 32 PID 1632 wrote to memory of 2856 1632 rundll32.exe 32 PID 1632 wrote to memory of 2324 1632 rundll32.exe 34 PID 1632 wrote to memory of 2324 1632 rundll32.exe 34 PID 1632 wrote to memory of 2324 1632 rundll32.exe 34 PID 1632 wrote to memory of 2324 1632 rundll32.exe 34 PID 2876 wrote to memory of 1064 2876 f76cfbd.exe 18 PID 2876 wrote to memory of 1164 2876 f76cfbd.exe 20 PID 2876 wrote to memory of 1188 2876 f76cfbd.exe 21 PID 2876 wrote to memory of 1428 2876 f76cfbd.exe 25 PID 2876 wrote to memory of 2856 2876 f76cfbd.exe 32 PID 2876 wrote to memory of 2856 2876 f76cfbd.exe 32 PID 2876 wrote to memory of 2324 2876 f76cfbd.exe 34 PID 2876 wrote to memory of 2324 2876 f76cfbd.exe 34 PID 2324 wrote to memory of 1064 2324 f76eb87.exe 18 PID 2324 wrote to memory of 1164 2324 f76eb87.exe 20 PID 2324 wrote to memory of 1188 2324 f76eb87.exe 21 PID 2324 wrote to memory of 1428 2324 f76eb87.exe 25 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76cfbd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76eb87.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1064
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1164
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1188
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e4732d5bbde347680770d26049295ad7ac58b6c92cb481112262ff9fe296cb5f.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e4732d5bbde347680770d26049295ad7ac58b6c92cb481112262ff9fe296cb5f.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\f76cfbd.exeC:\Users\Admin\AppData\Local\Temp\f76cfbd.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2876
-
-
C:\Users\Admin\AppData\Local\Temp\f76d182.exeC:\Users\Admin\AppData\Local\Temp\f76d182.exe4⤵
- Executes dropped EXE
PID:2856
-
-
C:\Users\Admin\AppData\Local\Temp\f76eb87.exeC:\Users\Admin\AppData\Local\Temp\f76eb87.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2324
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1428
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD55c6e526edde9bfc2ce86eae255224f67
SHA17651792f266128196c0debab1d11dc27ec507278
SHA2564a8501e78943f259916596323ffe5546c9f18171d6a3c013321bdc64cdb27ac9
SHA5122531e8df41ae7ab55f9851b3a2af9156e409cced3402ce4a1d49c2d0ff1c35fe00a86bb93ac5e8200ea299f05c57bad90d9c51861580563094db4dc9ad016814
-
Filesize
97KB
MD5b0417b4d17e1f18ec2a20fb3c9bc18a2
SHA1dde8ca65b2aa9f4b004f36cbddf667ddf024298b
SHA2566be88d3c2324d53a0722206eb08f9315328e4b448446f7f411f38ff06aeafb1a
SHA5120bfa2278c87ec1adca3b5116a5dda6d27c1373cda4ff6b9ed8b3ecfd6c2fa596f71b26c1b33140701c3abc004e80bfaa6ad9533bf2d9d47166387f2c8dd0e1f1