Analysis
-
max time kernel
27s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
17-12-2024 10:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d5b9cb4c6cdc7de3d1d9f7636b2b23e7d7c220e1e2e4823b10a965b2eb6b8b17N.dll
Resource
win7-20240903-en
windows7-x64
17 signatures
120 seconds
General
-
Target
d5b9cb4c6cdc7de3d1d9f7636b2b23e7d7c220e1e2e4823b10a965b2eb6b8b17N.dll
-
Size
120KB
-
MD5
35978433062f18ffed5d3adace0bb300
-
SHA1
b41cae671cbf861cb2d109e2944bf36dd4004cb2
-
SHA256
d5b9cb4c6cdc7de3d1d9f7636b2b23e7d7c220e1e2e4823b10a965b2eb6b8b17
-
SHA512
267c3977a05d43ee5d893bed82baf3e5790251efcee3a7883f63a7ecbd2b7967802679b081e291d109dc29e32ebc35f0b8decc11b3bccefdb50fea3aea698a91
-
SSDEEP
3072:PqYabBrMrjSBrkVlNl5/rgSSF8K7OYww3gz:PqYirjSlNl5/kkYe
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76b126.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76b126.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76b126.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76cd0f.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76cd0f.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76cd0f.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76cd0f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b126.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76b126.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76b126.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76cd0f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76cd0f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76cd0f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76cd0f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76b126.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76b126.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76b126.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76b126.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76cd0f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76cd0f.exe -
Executes dropped EXE 3 IoCs
pid Process 1944 f76b126.exe 2140 f76b319.exe 2652 f76cd0f.exe -
Loads dropped DLL 6 IoCs
pid Process 1156 rundll32.exe 1156 rundll32.exe 1156 rundll32.exe 1156 rundll32.exe 1156 rundll32.exe 1156 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76cd0f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76b126.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76b126.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76b126.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76cd0f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76cd0f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76b126.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76cd0f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76b126.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76b126.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76b126.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76cd0f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76cd0f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76cd0f.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b126.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76cd0f.exe -
Enumerates connected drives 3 TTPs 17 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: f76b126.exe File opened (read-only) \??\O: f76b126.exe File opened (read-only) \??\E: f76cd0f.exe File opened (read-only) \??\S: f76b126.exe File opened (read-only) \??\H: f76b126.exe File opened (read-only) \??\M: f76b126.exe File opened (read-only) \??\Q: f76b126.exe File opened (read-only) \??\G: f76cd0f.exe File opened (read-only) \??\J: f76b126.exe File opened (read-only) \??\N: f76b126.exe File opened (read-only) \??\P: f76b126.exe File opened (read-only) \??\L: f76b126.exe File opened (read-only) \??\R: f76b126.exe File opened (read-only) \??\T: f76b126.exe File opened (read-only) \??\G: f76b126.exe File opened (read-only) \??\I: f76b126.exe File opened (read-only) \??\K: f76b126.exe -
resource yara_rule behavioral1/memory/1944-22-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/1944-14-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/1944-18-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/1944-17-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/1944-21-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/1944-19-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/1944-15-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/1944-13-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/1944-20-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/1944-16-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/1944-58-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/1944-59-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/1944-60-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/1944-62-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/1944-61-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/1944-64-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/1944-65-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/1944-81-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/1944-83-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/1944-85-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/1944-87-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/1944-149-0x0000000000700000-0x00000000017BA000-memory.dmp upx behavioral1/memory/2652-159-0x0000000000980000-0x0000000001A3A000-memory.dmp upx behavioral1/memory/2652-205-0x0000000000980000-0x0000000001A3A000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\f76b174 f76b126.exe File opened for modification C:\Windows\SYSTEM.INI f76b126.exe File created C:\Windows\f770280 f76cd0f.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76cd0f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76b126.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1944 f76b126.exe 1944 f76b126.exe 2652 f76cd0f.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 1944 f76b126.exe Token: SeDebugPrivilege 1944 f76b126.exe Token: SeDebugPrivilege 1944 f76b126.exe Token: SeDebugPrivilege 1944 f76b126.exe Token: SeDebugPrivilege 1944 f76b126.exe Token: SeDebugPrivilege 1944 f76b126.exe Token: SeDebugPrivilege 1944 f76b126.exe Token: SeDebugPrivilege 1944 f76b126.exe Token: SeDebugPrivilege 1944 f76b126.exe Token: SeDebugPrivilege 1944 f76b126.exe Token: SeDebugPrivilege 1944 f76b126.exe Token: SeDebugPrivilege 1944 f76b126.exe Token: SeDebugPrivilege 1944 f76b126.exe Token: SeDebugPrivilege 1944 f76b126.exe Token: SeDebugPrivilege 1944 f76b126.exe Token: SeDebugPrivilege 1944 f76b126.exe Token: SeDebugPrivilege 1944 f76b126.exe Token: SeDebugPrivilege 1944 f76b126.exe Token: SeDebugPrivilege 1944 f76b126.exe Token: SeDebugPrivilege 1944 f76b126.exe Token: SeDebugPrivilege 1944 f76b126.exe Token: SeDebugPrivilege 1944 f76b126.exe Token: SeDebugPrivilege 1944 f76b126.exe Token: SeDebugPrivilege 1944 f76b126.exe Token: SeDebugPrivilege 2652 f76cd0f.exe Token: SeDebugPrivilege 2652 f76cd0f.exe Token: SeDebugPrivilege 2652 f76cd0f.exe Token: SeDebugPrivilege 2652 f76cd0f.exe Token: SeDebugPrivilege 2652 f76cd0f.exe Token: SeDebugPrivilege 2652 f76cd0f.exe Token: SeDebugPrivilege 2652 f76cd0f.exe Token: SeDebugPrivilege 2652 f76cd0f.exe Token: SeDebugPrivilege 2652 f76cd0f.exe Token: SeDebugPrivilege 2652 f76cd0f.exe Token: SeDebugPrivilege 2652 f76cd0f.exe Token: SeDebugPrivilege 2652 f76cd0f.exe Token: SeDebugPrivilege 2652 f76cd0f.exe Token: SeDebugPrivilege 2652 f76cd0f.exe Token: SeDebugPrivilege 2652 f76cd0f.exe Token: SeDebugPrivilege 2652 f76cd0f.exe Token: SeDebugPrivilege 2652 f76cd0f.exe Token: SeDebugPrivilege 2652 f76cd0f.exe Token: SeDebugPrivilege 2652 f76cd0f.exe Token: SeDebugPrivilege 2652 f76cd0f.exe Token: SeDebugPrivilege 2652 f76cd0f.exe Token: SeDebugPrivilege 2652 f76cd0f.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 352 wrote to memory of 1156 352 rundll32.exe 30 PID 352 wrote to memory of 1156 352 rundll32.exe 30 PID 352 wrote to memory of 1156 352 rundll32.exe 30 PID 352 wrote to memory of 1156 352 rundll32.exe 30 PID 352 wrote to memory of 1156 352 rundll32.exe 30 PID 352 wrote to memory of 1156 352 rundll32.exe 30 PID 352 wrote to memory of 1156 352 rundll32.exe 30 PID 1156 wrote to memory of 1944 1156 rundll32.exe 31 PID 1156 wrote to memory of 1944 1156 rundll32.exe 31 PID 1156 wrote to memory of 1944 1156 rundll32.exe 31 PID 1156 wrote to memory of 1944 1156 rundll32.exe 31 PID 1944 wrote to memory of 1108 1944 f76b126.exe 19 PID 1944 wrote to memory of 1172 1944 f76b126.exe 20 PID 1944 wrote to memory of 1196 1944 f76b126.exe 21 PID 1944 wrote to memory of 2028 1944 f76b126.exe 23 PID 1944 wrote to memory of 352 1944 f76b126.exe 29 PID 1944 wrote to memory of 1156 1944 f76b126.exe 30 PID 1944 wrote to memory of 1156 1944 f76b126.exe 30 PID 1156 wrote to memory of 2140 1156 rundll32.exe 32 PID 1156 wrote to memory of 2140 1156 rundll32.exe 32 PID 1156 wrote to memory of 2140 1156 rundll32.exe 32 PID 1156 wrote to memory of 2140 1156 rundll32.exe 32 PID 1156 wrote to memory of 2652 1156 rundll32.exe 34 PID 1156 wrote to memory of 2652 1156 rundll32.exe 34 PID 1156 wrote to memory of 2652 1156 rundll32.exe 34 PID 1156 wrote to memory of 2652 1156 rundll32.exe 34 PID 1944 wrote to memory of 1108 1944 f76b126.exe 19 PID 1944 wrote to memory of 1172 1944 f76b126.exe 20 PID 1944 wrote to memory of 1196 1944 f76b126.exe 21 PID 1944 wrote to memory of 2028 1944 f76b126.exe 23 PID 1944 wrote to memory of 2140 1944 f76b126.exe 32 PID 1944 wrote to memory of 2140 1944 f76b126.exe 32 PID 1944 wrote to memory of 2652 1944 f76b126.exe 34 PID 1944 wrote to memory of 2652 1944 f76b126.exe 34 PID 2652 wrote to memory of 1108 2652 f76cd0f.exe 19 PID 2652 wrote to memory of 1172 2652 f76cd0f.exe 20 PID 2652 wrote to memory of 1196 2652 f76cd0f.exe 21 PID 2652 wrote to memory of 2028 2652 f76cd0f.exe 23 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b126.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76cd0f.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1108
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1172
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1196
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d5b9cb4c6cdc7de3d1d9f7636b2b23e7d7c220e1e2e4823b10a965b2eb6b8b17N.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:352 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d5b9cb4c6cdc7de3d1d9f7636b2b23e7d7c220e1e2e4823b10a965b2eb6b8b17N.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\f76b126.exeC:\Users\Admin\AppData\Local\Temp\f76b126.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1944
-
-
C:\Users\Admin\AppData\Local\Temp\f76b319.exeC:\Users\Admin\AppData\Local\Temp\f76b319.exe4⤵
- Executes dropped EXE
PID:2140
-
-
C:\Users\Admin\AppData\Local\Temp\f76cd0f.exeC:\Users\Admin\AppData\Local\Temp\f76cd0f.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2652
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:2028
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD59fdf7d03002401c14ff4f1ed873b0d7c
SHA139844cacdba86437689b2a64121a10d62c48e7ed
SHA2562862a278430160c94a71003a4e2284f8abe670335d511e57fed713666ed0969f
SHA512c067be4e52b9c9d7d9d22d43667b4730355d192391d8f32d8a5d1cc7cb7223f69081d6beb038471c478357e5377a65833a5f939170481c3820f7b9b8acd1a3ed
-
Filesize
97KB
MD514aa616df025d44e0e6861a4073e76a7
SHA138ea85496150e9b2a5714cd6eb1c9b5128c6af9d
SHA256e4905801ac018c6d3dd4eee2eb8e98e28ec0be3286bb40541870fb650b5adf23
SHA51217ea5cfa4c480a2685fbd522c4f62dae4b70cfb95bce4815c3607b6410c2859384565fd157c60ccf99b0be0f336447cb6f5ea6c0fb6c0e697b533e76cd64ec0e