Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
17-12-2024 12:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
157c5069f06fa0035bc7b0f5ca9e760a2d48464294fc04aa7a78cf982348234a.dll
Resource
win7-20241010-en
windows7-x64
17 signatures
120 seconds
General
-
Target
157c5069f06fa0035bc7b0f5ca9e760a2d48464294fc04aa7a78cf982348234a.dll
-
Size
120KB
-
MD5
51090fc2e3fb0f749e8a7e922592f4db
-
SHA1
797f68a8756624bf46d722030026be9063ac3653
-
SHA256
157c5069f06fa0035bc7b0f5ca9e760a2d48464294fc04aa7a78cf982348234a
-
SHA512
16eb3aebdfb9c98780e4c1b33323d291ad81234f5272f565967bd6e0f49793c7131d1ee6835de828cb6648a1c8d88defc06bd95e9430c7fb12106582908e8e2b
-
SSDEEP
3072:GBrZeL5yAmxOB3vFlvkM5l2A2Takz9cchC8RPCgrxHdg:GBwsA3PdkM3e3RPVx9g
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f773d9c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f773d9c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f773d9c.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f771e2b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f771e2b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f771e2b.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f771e2b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f773d9c.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f771e2b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f771e2b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f771e2b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f773d9c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f773d9c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f773d9c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f773d9c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f771e2b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f771e2b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f771e2b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f773d9c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f773d9c.exe -
Executes dropped EXE 3 IoCs
pid Process 2404 f771e2b.exe 2516 f771fff.exe 2440 f773d9c.exe -
Loads dropped DLL 6 IoCs
pid Process 1180 rundll32.exe 1180 rundll32.exe 1180 rundll32.exe 1180 rundll32.exe 1180 rundll32.exe 1180 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f773d9c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f773d9c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f773d9c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f773d9c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f771e2b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f771e2b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f771e2b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f771e2b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f771e2b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f771e2b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f773d9c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f773d9c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f773d9c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f771e2b.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f771e2b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f773d9c.exe -
Enumerates connected drives 3 TTPs 17 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: f771e2b.exe File opened (read-only) \??\R: f771e2b.exe File opened (read-only) \??\S: f771e2b.exe File opened (read-only) \??\E: f771e2b.exe File opened (read-only) \??\P: f771e2b.exe File opened (read-only) \??\Q: f771e2b.exe File opened (read-only) \??\H: f773d9c.exe File opened (read-only) \??\G: f773d9c.exe File opened (read-only) \??\G: f771e2b.exe File opened (read-only) \??\K: f771e2b.exe File opened (read-only) \??\L: f771e2b.exe File opened (read-only) \??\E: f773d9c.exe File opened (read-only) \??\N: f771e2b.exe File opened (read-only) \??\H: f771e2b.exe File opened (read-only) \??\I: f771e2b.exe File opened (read-only) \??\J: f771e2b.exe File opened (read-only) \??\M: f771e2b.exe -
resource yara_rule behavioral1/memory/2404-15-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2404-18-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2404-23-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2404-22-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2404-20-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2404-19-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2404-17-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2404-16-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2404-14-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2404-21-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2404-52-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2404-62-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2404-53-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2404-64-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2404-63-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2404-66-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2404-67-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2404-68-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2404-83-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2404-85-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2404-86-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2404-155-0x0000000000520000-0x00000000015DA000-memory.dmp upx behavioral1/memory/2440-167-0x0000000000900000-0x00000000019BA000-memory.dmp upx behavioral1/memory/2440-213-0x0000000000900000-0x00000000019BA000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\f771e88 f771e2b.exe File opened for modification C:\Windows\SYSTEM.INI f771e2b.exe File created C:\Windows\f776e3d f773d9c.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f771e2b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f773d9c.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2404 f771e2b.exe 2404 f771e2b.exe 2440 f773d9c.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeDebugPrivilege 2404 f771e2b.exe Token: SeDebugPrivilege 2404 f771e2b.exe Token: SeDebugPrivilege 2404 f771e2b.exe Token: SeDebugPrivilege 2404 f771e2b.exe Token: SeDebugPrivilege 2404 f771e2b.exe Token: SeDebugPrivilege 2404 f771e2b.exe Token: SeDebugPrivilege 2404 f771e2b.exe Token: SeDebugPrivilege 2404 f771e2b.exe Token: SeDebugPrivilege 2404 f771e2b.exe Token: SeDebugPrivilege 2404 f771e2b.exe Token: SeDebugPrivilege 2404 f771e2b.exe Token: SeDebugPrivilege 2404 f771e2b.exe Token: SeDebugPrivilege 2404 f771e2b.exe Token: SeDebugPrivilege 2404 f771e2b.exe Token: SeDebugPrivilege 2404 f771e2b.exe Token: SeDebugPrivilege 2404 f771e2b.exe Token: SeDebugPrivilege 2404 f771e2b.exe Token: SeDebugPrivilege 2404 f771e2b.exe Token: SeDebugPrivilege 2404 f771e2b.exe Token: SeDebugPrivilege 2404 f771e2b.exe Token: SeDebugPrivilege 2404 f771e2b.exe Token: SeDebugPrivilege 2404 f771e2b.exe Token: SeDebugPrivilege 2404 f771e2b.exe Token: SeDebugPrivilege 2440 f773d9c.exe Token: SeDebugPrivilege 2440 f773d9c.exe Token: SeDebugPrivilege 2440 f773d9c.exe Token: SeDebugPrivilege 2440 f773d9c.exe Token: SeDebugPrivilege 2440 f773d9c.exe Token: SeDebugPrivilege 2440 f773d9c.exe Token: SeDebugPrivilege 2440 f773d9c.exe Token: SeDebugPrivilege 2440 f773d9c.exe Token: SeDebugPrivilege 2440 f773d9c.exe Token: SeDebugPrivilege 2440 f773d9c.exe Token: SeDebugPrivilege 2440 f773d9c.exe Token: SeDebugPrivilege 2440 f773d9c.exe Token: SeDebugPrivilege 2440 f773d9c.exe Token: SeDebugPrivilege 2440 f773d9c.exe Token: SeDebugPrivilege 2440 f773d9c.exe Token: SeDebugPrivilege 2440 f773d9c.exe Token: SeDebugPrivilege 2440 f773d9c.exe Token: SeDebugPrivilege 2440 f773d9c.exe Token: SeDebugPrivilege 2440 f773d9c.exe Token: SeDebugPrivilege 2440 f773d9c.exe Token: SeDebugPrivilege 2440 f773d9c.exe Token: SeDebugPrivilege 2440 f773d9c.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2524 wrote to memory of 1180 2524 rundll32.exe 30 PID 2524 wrote to memory of 1180 2524 rundll32.exe 30 PID 2524 wrote to memory of 1180 2524 rundll32.exe 30 PID 2524 wrote to memory of 1180 2524 rundll32.exe 30 PID 2524 wrote to memory of 1180 2524 rundll32.exe 30 PID 2524 wrote to memory of 1180 2524 rundll32.exe 30 PID 2524 wrote to memory of 1180 2524 rundll32.exe 30 PID 1180 wrote to memory of 2404 1180 rundll32.exe 31 PID 1180 wrote to memory of 2404 1180 rundll32.exe 31 PID 1180 wrote to memory of 2404 1180 rundll32.exe 31 PID 1180 wrote to memory of 2404 1180 rundll32.exe 31 PID 2404 wrote to memory of 1108 2404 f771e2b.exe 19 PID 2404 wrote to memory of 1160 2404 f771e2b.exe 20 PID 2404 wrote to memory of 1188 2404 f771e2b.exe 21 PID 2404 wrote to memory of 1432 2404 f771e2b.exe 25 PID 2404 wrote to memory of 2524 2404 f771e2b.exe 29 PID 2404 wrote to memory of 1180 2404 f771e2b.exe 30 PID 2404 wrote to memory of 1180 2404 f771e2b.exe 30 PID 1180 wrote to memory of 2516 1180 rundll32.exe 32 PID 1180 wrote to memory of 2516 1180 rundll32.exe 32 PID 1180 wrote to memory of 2516 1180 rundll32.exe 32 PID 1180 wrote to memory of 2516 1180 rundll32.exe 32 PID 1180 wrote to memory of 2440 1180 rundll32.exe 33 PID 1180 wrote to memory of 2440 1180 rundll32.exe 33 PID 1180 wrote to memory of 2440 1180 rundll32.exe 33 PID 1180 wrote to memory of 2440 1180 rundll32.exe 33 PID 2404 wrote to memory of 1108 2404 f771e2b.exe 19 PID 2404 wrote to memory of 1160 2404 f771e2b.exe 20 PID 2404 wrote to memory of 1188 2404 f771e2b.exe 21 PID 2404 wrote to memory of 1432 2404 f771e2b.exe 25 PID 2404 wrote to memory of 2516 2404 f771e2b.exe 32 PID 2404 wrote to memory of 2516 2404 f771e2b.exe 32 PID 2404 wrote to memory of 2440 2404 f771e2b.exe 33 PID 2404 wrote to memory of 2440 2404 f771e2b.exe 33 PID 2440 wrote to memory of 1108 2440 f773d9c.exe 19 PID 2440 wrote to memory of 1160 2440 f773d9c.exe 20 PID 2440 wrote to memory of 1188 2440 f773d9c.exe 21 PID 2440 wrote to memory of 1432 2440 f773d9c.exe 25 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f771e2b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f773d9c.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1108
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1160
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1188
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\157c5069f06fa0035bc7b0f5ca9e760a2d48464294fc04aa7a78cf982348234a.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\157c5069f06fa0035bc7b0f5ca9e760a2d48464294fc04aa7a78cf982348234a.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\f771e2b.exeC:\Users\Admin\AppData\Local\Temp\f771e2b.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2404
-
-
C:\Users\Admin\AppData\Local\Temp\f771fff.exeC:\Users\Admin\AppData\Local\Temp\f771fff.exe4⤵
- Executes dropped EXE
PID:2516
-
-
C:\Users\Admin\AppData\Local\Temp\f773d9c.exeC:\Users\Admin\AppData\Local\Temp\f773d9c.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2440
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1432
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD5c59106852c6f3be8a09abf3f17ca2e24
SHA1440e7dd1a5c849c55c881edf2662fdb90546eb85
SHA2569fa6131f56292cbbed1178a3f2fd2532028a8b37d4fc5ba35e510aef4196d570
SHA51267f411e4b1d4052afdc9b3f6b12f700840f830e254e359a07cbcfb0e3dcbbe39341184e2d84b3d3ed0600e6520b7945e43c6a63e71a010499c59e9e415d05d21
-
Filesize
97KB
MD5315652da5f762125fa1daddf1e2b1423
SHA108ea92ec2840b61b7f08da0ce65d7aeae0deaf10
SHA256dccaae817c9cee2dbedc3c153d83a5e568aa6f575ab47f58e68396ec28870ef0
SHA51291bf99017855b97e9af82662f21ccce31e5f8a01e50aa61e55938a40e5675d2eeef8cdb5c32600ffdbb5d333b5d44d0dd1657a9230f6783a4ed01ee888714a6d