Analysis

  • max time kernel
    27s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    17-12-2024 11:46

General

  • Target

    080233ca1949ea5422e81df94845e4b28d72cc63395979287482086a30ed395fN.dll

  • Size

    120KB

  • MD5

    1599eed9e1e2505be29009d80da2f7c0

  • SHA1

    85f276950ff89bdc0c895806ee398f85a0bd4db0

  • SHA256

    080233ca1949ea5422e81df94845e4b28d72cc63395979287482086a30ed395f

  • SHA512

    5780bb6e8c313adc67e9a182bd363bc6bf92d4c1c0fc8a26f14c2a52181d9e067dc888a220b239e348e5462862da51c3dfaa05c2fc72d76df41aeba9b493d053

  • SSDEEP

    1536:o4vswg0wKv4DWNlYMRR0QrSBGCvKGtXyGz2JDl/TYrZCZ7shqQ:yGUCnR9rSBGCvdRz2J1WZC1shq

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

  • Modifies firewall policy service 3 TTPs 9 IoCs
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

  • Sality family
  • UAC bypass 3 TTPs 3 IoCs
  • Windows security bypass 2 TTPs 18 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • Windows security modification 2 TTPs 21 IoCs
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
  • Enumerates connected drives 3 TTPs 16 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file 24 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs
  • System policy modification 1 TTPs 3 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1116
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1172
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
          PID:1196
          • C:\Windows\system32\rundll32.exe
            rundll32.exe C:\Users\Admin\AppData\Local\Temp\080233ca1949ea5422e81df94845e4b28d72cc63395979287482086a30ed395fN.dll,#1
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2080
            • C:\Windows\SysWOW64\rundll32.exe
              rundll32.exe C:\Users\Admin\AppData\Local\Temp\080233ca1949ea5422e81df94845e4b28d72cc63395979287482086a30ed395fN.dll,#1
              3⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1868
              • C:\Users\Admin\AppData\Local\Temp\f77031c.exe
                C:\Users\Admin\AppData\Local\Temp\f77031c.exe
                4⤵
                • Modifies firewall policy service
                • UAC bypass
                • Windows security bypass
                • Executes dropped EXE
                • Windows security modification
                • Checks whether UAC is enabled
                • Enumerates connected drives
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:2980
              • C:\Users\Admin\AppData\Local\Temp\f7704f0.exe
                C:\Users\Admin\AppData\Local\Temp\f7704f0.exe
                4⤵
                • Modifies firewall policy service
                • UAC bypass
                • Windows security bypass
                • Executes dropped EXE
                • Windows security modification
                • Checks whether UAC is enabled
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:2672
              • C:\Users\Admin\AppData\Local\Temp\f771e98.exe
                C:\Users\Admin\AppData\Local\Temp\f771e98.exe
                4⤵
                • Modifies firewall policy service
                • UAC bypass
                • Windows security bypass
                • Executes dropped EXE
                • Windows security modification
                • Checks whether UAC is enabled
                • Enumerates connected drives
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:1732
        • C:\Windows\system32\DllHost.exe
          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
          1⤵
            PID:1192

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\f77031c.exe

            Filesize

            97KB

            MD5

            e5063bee43631509bdd0996a7a5cc7f8

            SHA1

            b6d42f2f343ea05e1b1ec40d694a6ae794da0ba1

            SHA256

            f088d205dab4df9013a35d99a6945d45c054a1812dc87de02e7a811700a47776

            SHA512

            1d25b86910d8e73c27800903433584b3f6fbecd2540d91442b9702272906f9c3ac9889bbcbdd15ab11aea4d2a69cc9ee9d0e00611f78021ceb71295b009b965c

          • C:\Windows\SYSTEM.INI

            Filesize

            257B

            MD5

            900704bc04852fc2fdb50ff8edb83829

            SHA1

            0459800bef4f40aa4cedbbfe2e78c078259f6197

            SHA256

            0dd668228e444cbee65bb8d1e0b1bc7c7594d95c9621d6302b739001e8da0b7f

            SHA512

            00cf7c9aedfb77bb0d0ebbb18e80b6705fcbf20f6475c639291263d17dbf8d2f69de7f535ba698817c8f8f977b947657b057bc887286ccc9218073615298f0bd

          • memory/1116-30-0x0000000000410000-0x0000000000412000-memory.dmp

            Filesize

            8KB

          • memory/1732-140-0x0000000000360000-0x0000000000362000-memory.dmp

            Filesize

            8KB

          • memory/1732-111-0x0000000000360000-0x0000000000362000-memory.dmp

            Filesize

            8KB

          • memory/1732-83-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/1732-109-0x00000000003B0000-0x00000000003B1000-memory.dmp

            Filesize

            4KB

          • memory/1732-241-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/1868-59-0x00000000001A0000-0x00000000001A2000-memory.dmp

            Filesize

            8KB

          • memory/1868-38-0x00000000001A0000-0x00000000001A2000-memory.dmp

            Filesize

            8KB

          • memory/1868-0-0x0000000010000000-0x0000000010020000-memory.dmp

            Filesize

            128KB

          • memory/1868-1-0x0000000010000000-0x0000000010020000-memory.dmp

            Filesize

            128KB

          • memory/1868-39-0x00000000001B0000-0x00000000001B1000-memory.dmp

            Filesize

            4KB

          • memory/1868-2-0x0000000010000000-0x0000000010020000-memory.dmp

            Filesize

            128KB

          • memory/1868-64-0x00000000001A0000-0x00000000001A2000-memory.dmp

            Filesize

            8KB

          • memory/1868-61-0x00000000002E0000-0x00000000002F2000-memory.dmp

            Filesize

            72KB

          • memory/1868-7-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/1868-3-0x0000000010000000-0x0000000010020000-memory.dmp

            Filesize

            128KB

          • memory/1868-48-0x00000000001B0000-0x00000000001B1000-memory.dmp

            Filesize

            4KB

          • memory/1868-13-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2672-135-0x00000000003E0000-0x00000000003E2000-memory.dmp

            Filesize

            8KB

          • memory/2672-107-0x00000000003E0000-0x00000000003E2000-memory.dmp

            Filesize

            8KB

          • memory/2672-195-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2672-108-0x00000000003E0000-0x00000000003E2000-memory.dmp

            Filesize

            8KB

          • memory/2672-101-0x00000000003F0000-0x00000000003F1000-memory.dmp

            Filesize

            4KB

          • memory/2672-194-0x0000000000900000-0x00000000019BA000-memory.dmp

            Filesize

            16.7MB

          • memory/2672-168-0x0000000000900000-0x00000000019BA000-memory.dmp

            Filesize

            16.7MB

          • memory/2672-65-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2980-52-0x00000000005E0000-0x00000000005E2000-memory.dmp

            Filesize

            8KB

          • memory/2980-66-0x00000000006F0000-0x00000000017AA000-memory.dmp

            Filesize

            16.7MB

          • memory/2980-63-0x00000000006F0000-0x00000000017AA000-memory.dmp

            Filesize

            16.7MB

          • memory/2980-68-0x00000000006F0000-0x00000000017AA000-memory.dmp

            Filesize

            16.7MB

          • memory/2980-67-0x00000000006F0000-0x00000000017AA000-memory.dmp

            Filesize

            16.7MB

          • memory/2980-70-0x00000000006F0000-0x00000000017AA000-memory.dmp

            Filesize

            16.7MB

          • memory/2980-71-0x00000000006F0000-0x00000000017AA000-memory.dmp

            Filesize

            16.7MB

          • memory/2980-84-0x00000000005E0000-0x00000000005E2000-memory.dmp

            Filesize

            8KB

          • memory/2980-62-0x00000000006F0000-0x00000000017AA000-memory.dmp

            Filesize

            16.7MB

          • memory/2980-85-0x00000000006F0000-0x00000000017AA000-memory.dmp

            Filesize

            16.7MB

          • memory/2980-86-0x00000000006F0000-0x00000000017AA000-memory.dmp

            Filesize

            16.7MB

          • memory/2980-90-0x00000000006F0000-0x00000000017AA000-memory.dmp

            Filesize

            16.7MB

          • memory/2980-89-0x00000000006F0000-0x00000000017AA000-memory.dmp

            Filesize

            16.7MB

          • memory/2980-22-0x00000000006F0000-0x00000000017AA000-memory.dmp

            Filesize

            16.7MB

          • memory/2980-16-0x00000000006F0000-0x00000000017AA000-memory.dmp

            Filesize

            16.7MB

          • memory/2980-17-0x00000000006F0000-0x00000000017AA000-memory.dmp

            Filesize

            16.7MB

          • memory/2980-20-0x00000000006F0000-0x00000000017AA000-memory.dmp

            Filesize

            16.7MB

          • memory/2980-21-0x00000000006F0000-0x00000000017AA000-memory.dmp

            Filesize

            16.7MB

          • memory/2980-49-0x0000000002E10000-0x0000000002E11000-memory.dmp

            Filesize

            4KB

          • memory/2980-51-0x00000000005E0000-0x00000000005E2000-memory.dmp

            Filesize

            8KB

          • memory/2980-159-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2980-160-0x00000000006F0000-0x00000000017AA000-memory.dmp

            Filesize

            16.7MB

          • memory/2980-24-0x00000000006F0000-0x00000000017AA000-memory.dmp

            Filesize

            16.7MB

          • memory/2980-19-0x00000000006F0000-0x00000000017AA000-memory.dmp

            Filesize

            16.7MB

          • memory/2980-23-0x00000000006F0000-0x00000000017AA000-memory.dmp

            Filesize

            16.7MB

          • memory/2980-18-0x00000000006F0000-0x00000000017AA000-memory.dmp

            Filesize

            16.7MB

          • memory/2980-14-0x00000000006F0000-0x00000000017AA000-memory.dmp

            Filesize

            16.7MB