Analysis
-
max time kernel
27s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
17-12-2024 07:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
de886fe637110e565a4ee69e0df45521be27c425229ff1e98fc2c690289c9eae.dll
Resource
win7-20240903-en
windows7-x64
17 signatures
120 seconds
General
-
Target
de886fe637110e565a4ee69e0df45521be27c425229ff1e98fc2c690289c9eae.dll
-
Size
120KB
-
MD5
4d204aa882f5bebd2c1fc751fcdc021a
-
SHA1
e24d0a815daa3cfd912fcf7df2a5a8a1e37a46c6
-
SHA256
de886fe637110e565a4ee69e0df45521be27c425229ff1e98fc2c690289c9eae
-
SHA512
58437f352335461f96e1d3a130d817a10abf5ff4979407aa4f61b05e1f4a8af75e04fb00ddac7bf02a405a54a498a38b923806c03cbd2eaa0fbce60fc56c8ac3
-
SSDEEP
3072:4rYftpkFXOh0jCJ+CioOANL96TCpjeN2O9u:4r1hO0jCJbidAnIoW23
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76b6e1.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76b6e1.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76d2aa.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76d2aa.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76d2aa.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76b6e1.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b6e1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76d2aa.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76b6e1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76d2aa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76d2aa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76b6e1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76b6e1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76b6e1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76d2aa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76d2aa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76d2aa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76b6e1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76b6e1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76d2aa.exe -
Executes dropped EXE 3 IoCs
pid Process 1704 f76b6e1.exe 2840 f76b847.exe 1648 f76d2aa.exe -
Loads dropped DLL 6 IoCs
pid Process 3064 rundll32.exe 3064 rundll32.exe 3064 rundll32.exe 3064 rundll32.exe 3064 rundll32.exe 3064 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76b6e1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76b6e1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76b6e1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76b6e1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76d2aa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76b6e1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76d2aa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76d2aa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76d2aa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76b6e1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76b6e1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76d2aa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76d2aa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76d2aa.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b6e1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76d2aa.exe -
Enumerates connected drives 3 TTPs 16 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: f76b6e1.exe File opened (read-only) \??\L: f76b6e1.exe File opened (read-only) \??\N: f76b6e1.exe File opened (read-only) \??\O: f76b6e1.exe File opened (read-only) \??\R: f76b6e1.exe File opened (read-only) \??\E: f76d2aa.exe File opened (read-only) \??\Q: f76b6e1.exe File opened (read-only) \??\S: f76b6e1.exe File opened (read-only) \??\G: f76d2aa.exe File opened (read-only) \??\E: f76b6e1.exe File opened (read-only) \??\H: f76b6e1.exe File opened (read-only) \??\I: f76b6e1.exe File opened (read-only) \??\J: f76b6e1.exe File opened (read-only) \??\K: f76b6e1.exe File opened (read-only) \??\M: f76b6e1.exe File opened (read-only) \??\P: f76b6e1.exe -
resource yara_rule behavioral1/memory/1704-12-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/1704-15-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/1704-14-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/1704-34-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/1704-46-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/1704-47-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/1704-16-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/1704-52-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/1704-56-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/1704-57-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/1704-58-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/1704-59-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/1704-60-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/1704-61-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/1704-62-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/1704-64-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/1704-65-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/1704-79-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/1704-81-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/1704-83-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/1704-146-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/1648-156-0x0000000000A10000-0x0000000001ACA000-memory.dmp upx behavioral1/memory/1648-202-0x0000000000A10000-0x0000000001ACA000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\f770770 f76d2aa.exe File created C:\Windows\f76b74e f76b6e1.exe File opened for modification C:\Windows\SYSTEM.INI f76b6e1.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76b6e1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76d2aa.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1704 f76b6e1.exe 1704 f76b6e1.exe 1648 f76d2aa.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 1704 f76b6e1.exe Token: SeDebugPrivilege 1704 f76b6e1.exe Token: SeDebugPrivilege 1704 f76b6e1.exe Token: SeDebugPrivilege 1704 f76b6e1.exe Token: SeDebugPrivilege 1704 f76b6e1.exe Token: SeDebugPrivilege 1704 f76b6e1.exe Token: SeDebugPrivilege 1704 f76b6e1.exe Token: SeDebugPrivilege 1704 f76b6e1.exe Token: SeDebugPrivilege 1704 f76b6e1.exe Token: SeDebugPrivilege 1704 f76b6e1.exe Token: SeDebugPrivilege 1704 f76b6e1.exe Token: SeDebugPrivilege 1704 f76b6e1.exe Token: SeDebugPrivilege 1704 f76b6e1.exe Token: SeDebugPrivilege 1704 f76b6e1.exe Token: SeDebugPrivilege 1704 f76b6e1.exe Token: SeDebugPrivilege 1704 f76b6e1.exe Token: SeDebugPrivilege 1704 f76b6e1.exe Token: SeDebugPrivilege 1704 f76b6e1.exe Token: SeDebugPrivilege 1704 f76b6e1.exe Token: SeDebugPrivilege 1704 f76b6e1.exe Token: SeDebugPrivilege 1704 f76b6e1.exe Token: SeDebugPrivilege 1704 f76b6e1.exe Token: SeDebugPrivilege 1704 f76b6e1.exe Token: SeDebugPrivilege 1704 f76b6e1.exe Token: SeDebugPrivilege 1648 f76d2aa.exe Token: SeDebugPrivilege 1648 f76d2aa.exe Token: SeDebugPrivilege 1648 f76d2aa.exe Token: SeDebugPrivilege 1648 f76d2aa.exe Token: SeDebugPrivilege 1648 f76d2aa.exe Token: SeDebugPrivilege 1648 f76d2aa.exe Token: SeDebugPrivilege 1648 f76d2aa.exe Token: SeDebugPrivilege 1648 f76d2aa.exe Token: SeDebugPrivilege 1648 f76d2aa.exe Token: SeDebugPrivilege 1648 f76d2aa.exe Token: SeDebugPrivilege 1648 f76d2aa.exe Token: SeDebugPrivilege 1648 f76d2aa.exe Token: SeDebugPrivilege 1648 f76d2aa.exe Token: SeDebugPrivilege 1648 f76d2aa.exe Token: SeDebugPrivilege 1648 f76d2aa.exe Token: SeDebugPrivilege 1648 f76d2aa.exe Token: SeDebugPrivilege 1648 f76d2aa.exe Token: SeDebugPrivilege 1648 f76d2aa.exe Token: SeDebugPrivilege 1648 f76d2aa.exe Token: SeDebugPrivilege 1648 f76d2aa.exe Token: SeDebugPrivilege 1648 f76d2aa.exe Token: SeDebugPrivilege 1648 f76d2aa.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2672 wrote to memory of 3064 2672 rundll32.exe 30 PID 2672 wrote to memory of 3064 2672 rundll32.exe 30 PID 2672 wrote to memory of 3064 2672 rundll32.exe 30 PID 2672 wrote to memory of 3064 2672 rundll32.exe 30 PID 2672 wrote to memory of 3064 2672 rundll32.exe 30 PID 2672 wrote to memory of 3064 2672 rundll32.exe 30 PID 2672 wrote to memory of 3064 2672 rundll32.exe 30 PID 3064 wrote to memory of 1704 3064 rundll32.exe 31 PID 3064 wrote to memory of 1704 3064 rundll32.exe 31 PID 3064 wrote to memory of 1704 3064 rundll32.exe 31 PID 3064 wrote to memory of 1704 3064 rundll32.exe 31 PID 1704 wrote to memory of 1040 1704 f76b6e1.exe 17 PID 1704 wrote to memory of 1068 1704 f76b6e1.exe 18 PID 1704 wrote to memory of 1112 1704 f76b6e1.exe 20 PID 1704 wrote to memory of 888 1704 f76b6e1.exe 23 PID 1704 wrote to memory of 2672 1704 f76b6e1.exe 29 PID 1704 wrote to memory of 3064 1704 f76b6e1.exe 30 PID 1704 wrote to memory of 3064 1704 f76b6e1.exe 30 PID 3064 wrote to memory of 2840 3064 rundll32.exe 32 PID 3064 wrote to memory of 2840 3064 rundll32.exe 32 PID 3064 wrote to memory of 2840 3064 rundll32.exe 32 PID 3064 wrote to memory of 2840 3064 rundll32.exe 32 PID 3064 wrote to memory of 1648 3064 rundll32.exe 34 PID 3064 wrote to memory of 1648 3064 rundll32.exe 34 PID 3064 wrote to memory of 1648 3064 rundll32.exe 34 PID 3064 wrote to memory of 1648 3064 rundll32.exe 34 PID 1704 wrote to memory of 1040 1704 f76b6e1.exe 17 PID 1704 wrote to memory of 1068 1704 f76b6e1.exe 18 PID 1704 wrote to memory of 1112 1704 f76b6e1.exe 20 PID 1704 wrote to memory of 888 1704 f76b6e1.exe 23 PID 1704 wrote to memory of 2840 1704 f76b6e1.exe 32 PID 1704 wrote to memory of 2840 1704 f76b6e1.exe 32 PID 1704 wrote to memory of 1648 1704 f76b6e1.exe 34 PID 1704 wrote to memory of 1648 1704 f76b6e1.exe 34 PID 1648 wrote to memory of 1040 1648 f76d2aa.exe 17 PID 1648 wrote to memory of 1068 1648 f76d2aa.exe 18 PID 1648 wrote to memory of 1112 1648 f76d2aa.exe 20 PID 1648 wrote to memory of 888 1648 f76d2aa.exe 23 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b6e1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76d2aa.exe
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1040
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1068
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1112
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\de886fe637110e565a4ee69e0df45521be27c425229ff1e98fc2c690289c9eae.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\de886fe637110e565a4ee69e0df45521be27c425229ff1e98fc2c690289c9eae.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\f76b6e1.exeC:\Users\Admin\AppData\Local\Temp\f76b6e1.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1704
-
-
C:\Users\Admin\AppData\Local\Temp\f76b847.exeC:\Users\Admin\AppData\Local\Temp\f76b847.exe4⤵
- Executes dropped EXE
PID:2840
-
-
C:\Users\Admin\AppData\Local\Temp\f76d2aa.exeC:\Users\Admin\AppData\Local\Temp\f76d2aa.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1648
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:888
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD5c9c5a61bdc07fde0ff0ab045cf078c50
SHA1fde88ada451581ae09ecafc2c3c50b9d55330d63
SHA25613560abb8c8a7e7fcbd6b7d48c4d58d398f993ac2b323566041a066818a43199
SHA512b9a710a56f2b930ece42214b0a81f7abe7d7ab32eb550930291208c5f033c8da6cb3796ff1272a5525fb6cbaf58e214a0e106b815c6963d4344e778497d2ab13
-
Filesize
257B
MD5d4057738ad6c133a9af8b527a4a30d7a
SHA1fe7a9589eadca95cd58445364a326ac130339c6b
SHA2565dd7f64f9b5d523de784722fd14eb1890298e8307ffab84f4ef9ad21de6bae18
SHA5129294eb24d02911c1cbc649fc8853ce09173b7482c58e75104a1914c22a018895f5e82a5086e7fd2e7f01d266a7a7d29c17e4bf0e6fcf5c4e243fcf87633d9c52