Analysis
-
max time kernel
27s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
17-12-2024 09:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e4fc6e338960d1237d9be5a4c42addd117a946f6ed639ae3e44a15b535a5088aN.dll
Resource
win7-20240903-en
windows7-x64
17 signatures
120 seconds
General
-
Target
e4fc6e338960d1237d9be5a4c42addd117a946f6ed639ae3e44a15b535a5088aN.dll
-
Size
120KB
-
MD5
81c1572364505ebba96dbbbf77a1a840
-
SHA1
9241f5d085ae2a4a0d011a652f47bf7c78337710
-
SHA256
e4fc6e338960d1237d9be5a4c42addd117a946f6ed639ae3e44a15b535a5088a
-
SHA512
4c9c6881405f393951a7d88dc84272a9a0afc0edc1286633e14c834989ba4e45af59581a05ea923b584409e68187394769995c58099aaf60fd6b7fa0f1acf8f9
-
SSDEEP
3072:e2wAnaOrQR7SBj6HtmOJxJjEnYrFPVlrTl2/:LwA9rrwNBJjm6Fdlnl+
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f769eaf.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f769eaf.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f7682e6.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f7682e6.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f7682e6.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f769eaf.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7682e6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f769eaf.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f769eaf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f769eaf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7682e6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7682e6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7682e6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7682e6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f769eaf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f769eaf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7682e6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7682e6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f769eaf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f769eaf.exe -
Executes dropped EXE 3 IoCs
pid Process 2328 f7682e6.exe 2960 f76849b.exe 2144 f769eaf.exe -
Loads dropped DLL 6 IoCs
pid Process 1932 rundll32.exe 1932 rundll32.exe 1932 rundll32.exe 1932 rundll32.exe 1932 rundll32.exe 1932 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7682e6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7682e6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f769eaf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7682e6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f769eaf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f7682e6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7682e6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f769eaf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7682e6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f769eaf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f769eaf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f769eaf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f769eaf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7682e6.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7682e6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f769eaf.exe -
Enumerates connected drives 3 TTPs 17 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: f7682e6.exe File opened (read-only) \??\I: f7682e6.exe File opened (read-only) \??\K: f7682e6.exe File opened (read-only) \??\L: f7682e6.exe File opened (read-only) \??\Q: f7682e6.exe File opened (read-only) \??\S: f7682e6.exe File opened (read-only) \??\T: f7682e6.exe File opened (read-only) \??\G: f7682e6.exe File opened (read-only) \??\R: f7682e6.exe File opened (read-only) \??\P: f7682e6.exe File opened (read-only) \??\M: f7682e6.exe File opened (read-only) \??\N: f7682e6.exe File opened (read-only) \??\G: f769eaf.exe File opened (read-only) \??\E: f7682e6.exe File opened (read-only) \??\O: f7682e6.exe File opened (read-only) \??\E: f769eaf.exe File opened (read-only) \??\J: f7682e6.exe -
resource yara_rule behavioral1/memory/2328-12-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2328-17-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2328-14-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2328-20-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2328-21-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2328-19-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2328-18-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2328-16-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2328-15-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2328-22-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2328-62-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2328-63-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2328-64-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2328-66-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2328-65-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2328-68-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2328-69-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2328-83-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2328-84-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2328-86-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2328-88-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2328-158-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2144-170-0x0000000000910000-0x00000000019CA000-memory.dmp upx behavioral1/memory/2144-211-0x0000000000910000-0x00000000019CA000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\f768353 f7682e6.exe File opened for modification C:\Windows\SYSTEM.INI f7682e6.exe File created C:\Windows\f76d356 f769eaf.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f7682e6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f769eaf.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2328 f7682e6.exe 2328 f7682e6.exe 2144 f769eaf.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 2328 f7682e6.exe Token: SeDebugPrivilege 2328 f7682e6.exe Token: SeDebugPrivilege 2328 f7682e6.exe Token: SeDebugPrivilege 2328 f7682e6.exe Token: SeDebugPrivilege 2328 f7682e6.exe Token: SeDebugPrivilege 2328 f7682e6.exe Token: SeDebugPrivilege 2328 f7682e6.exe Token: SeDebugPrivilege 2328 f7682e6.exe Token: SeDebugPrivilege 2328 f7682e6.exe Token: SeDebugPrivilege 2328 f7682e6.exe Token: SeDebugPrivilege 2328 f7682e6.exe Token: SeDebugPrivilege 2328 f7682e6.exe Token: SeDebugPrivilege 2328 f7682e6.exe Token: SeDebugPrivilege 2328 f7682e6.exe Token: SeDebugPrivilege 2328 f7682e6.exe Token: SeDebugPrivilege 2328 f7682e6.exe Token: SeDebugPrivilege 2328 f7682e6.exe Token: SeDebugPrivilege 2328 f7682e6.exe Token: SeDebugPrivilege 2328 f7682e6.exe Token: SeDebugPrivilege 2328 f7682e6.exe Token: SeDebugPrivilege 2328 f7682e6.exe Token: SeDebugPrivilege 2328 f7682e6.exe Token: SeDebugPrivilege 2328 f7682e6.exe Token: SeDebugPrivilege 2144 f769eaf.exe Token: SeDebugPrivilege 2144 f769eaf.exe Token: SeDebugPrivilege 2144 f769eaf.exe Token: SeDebugPrivilege 2144 f769eaf.exe Token: SeDebugPrivilege 2144 f769eaf.exe Token: SeDebugPrivilege 2144 f769eaf.exe Token: SeDebugPrivilege 2144 f769eaf.exe Token: SeDebugPrivilege 2144 f769eaf.exe Token: SeDebugPrivilege 2144 f769eaf.exe Token: SeDebugPrivilege 2144 f769eaf.exe Token: SeDebugPrivilege 2144 f769eaf.exe Token: SeDebugPrivilege 2144 f769eaf.exe Token: SeDebugPrivilege 2144 f769eaf.exe Token: SeDebugPrivilege 2144 f769eaf.exe Token: SeDebugPrivilege 2144 f769eaf.exe Token: SeDebugPrivilege 2144 f769eaf.exe Token: SeDebugPrivilege 2144 f769eaf.exe Token: SeDebugPrivilege 2144 f769eaf.exe Token: SeDebugPrivilege 2144 f769eaf.exe Token: SeDebugPrivilege 2144 f769eaf.exe Token: SeDebugPrivilege 2144 f769eaf.exe Token: SeDebugPrivilege 2144 f769eaf.exe Token: SeDebugPrivilege 2144 f769eaf.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 1640 wrote to memory of 1932 1640 rundll32.exe 30 PID 1640 wrote to memory of 1932 1640 rundll32.exe 30 PID 1640 wrote to memory of 1932 1640 rundll32.exe 30 PID 1640 wrote to memory of 1932 1640 rundll32.exe 30 PID 1640 wrote to memory of 1932 1640 rundll32.exe 30 PID 1640 wrote to memory of 1932 1640 rundll32.exe 30 PID 1640 wrote to memory of 1932 1640 rundll32.exe 30 PID 1932 wrote to memory of 2328 1932 rundll32.exe 31 PID 1932 wrote to memory of 2328 1932 rundll32.exe 31 PID 1932 wrote to memory of 2328 1932 rundll32.exe 31 PID 1932 wrote to memory of 2328 1932 rundll32.exe 31 PID 2328 wrote to memory of 1036 2328 f7682e6.exe 17 PID 2328 wrote to memory of 1052 2328 f7682e6.exe 18 PID 2328 wrote to memory of 1108 2328 f7682e6.exe 20 PID 2328 wrote to memory of 1664 2328 f7682e6.exe 25 PID 2328 wrote to memory of 1640 2328 f7682e6.exe 29 PID 2328 wrote to memory of 1932 2328 f7682e6.exe 30 PID 2328 wrote to memory of 1932 2328 f7682e6.exe 30 PID 1932 wrote to memory of 2960 1932 rundll32.exe 32 PID 1932 wrote to memory of 2960 1932 rundll32.exe 32 PID 1932 wrote to memory of 2960 1932 rundll32.exe 32 PID 1932 wrote to memory of 2960 1932 rundll32.exe 32 PID 1932 wrote to memory of 2144 1932 rundll32.exe 33 PID 1932 wrote to memory of 2144 1932 rundll32.exe 33 PID 1932 wrote to memory of 2144 1932 rundll32.exe 33 PID 1932 wrote to memory of 2144 1932 rundll32.exe 33 PID 2328 wrote to memory of 1036 2328 f7682e6.exe 17 PID 2328 wrote to memory of 1052 2328 f7682e6.exe 18 PID 2328 wrote to memory of 1108 2328 f7682e6.exe 20 PID 2328 wrote to memory of 1664 2328 f7682e6.exe 25 PID 2328 wrote to memory of 2960 2328 f7682e6.exe 32 PID 2328 wrote to memory of 2960 2328 f7682e6.exe 32 PID 2328 wrote to memory of 2144 2328 f7682e6.exe 33 PID 2328 wrote to memory of 2144 2328 f7682e6.exe 33 PID 2144 wrote to memory of 1036 2144 f769eaf.exe 17 PID 2144 wrote to memory of 1052 2144 f769eaf.exe 18 PID 2144 wrote to memory of 1108 2144 f769eaf.exe 20 PID 2144 wrote to memory of 1664 2144 f769eaf.exe 25 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7682e6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f769eaf.exe
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1036
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1052
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1108
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e4fc6e338960d1237d9be5a4c42addd117a946f6ed639ae3e44a15b535a5088aN.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e4fc6e338960d1237d9be5a4c42addd117a946f6ed639ae3e44a15b535a5088aN.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\f7682e6.exeC:\Users\Admin\AppData\Local\Temp\f7682e6.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2328
-
-
C:\Users\Admin\AppData\Local\Temp\f76849b.exeC:\Users\Admin\AppData\Local\Temp\f76849b.exe4⤵
- Executes dropped EXE
PID:2960
-
-
C:\Users\Admin\AppData\Local\Temp\f769eaf.exeC:\Users\Admin\AppData\Local\Temp\f769eaf.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2144
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1664
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD5a2722f702b04410f39685fbf89f13c18
SHA1d0663f5e40f2d82433f702261c15a0eff1ea5524
SHA256f0a402983b2cd5ac660204ab4f9280946245e787fb9997d9930d81a3c27fbb31
SHA5129af3193d2282489db55149e37bed491f3912818d70ec3091af9a5370f90f9fffff6da8c0cbb0e3e2463e8f04e230f83db30fd46faecc984797006e258e46727e
-
Filesize
97KB
MD5907a955c4395bae99738fc325d180745
SHA196b331ce7d13799a84bce2f11a070e6043a430db
SHA25623ece49a1bd1ddba305e117a30d6cfb07ebea578830b67f3226d518c1c2b7bb5
SHA5124c66c643004ae0910f0d5d2b8b901b597de8b3af2d94f9adbb183a726e76676ca55f8d05ed32e2aeec9c88032a05b5effbe0de141a38c83433b834206735ca29