General
-
Target
118c8493f0cdf451d1d0dd132734df9c1e365ed71ce0db3665c5d8c0734a27ebN.exe
-
Size
120KB
-
Sample
241218-1w8yvatkg1
-
MD5
1b46d953fd456705c5c069ba1ccfcd00
-
SHA1
67e37c283c23333e3f79307aac6209e86db7c124
-
SHA256
118c8493f0cdf451d1d0dd132734df9c1e365ed71ce0db3665c5d8c0734a27eb
-
SHA512
8a0467018069b28df898bd9db8dc3126a992f313e74d079e39b93acfdd3437b6ac88344f8313a4011387e95527702afb6370d714e825d78fa77e782786f1ab7d
-
SSDEEP
3072:tmF5Mklw0j5u0SOKfCbS0ucOGIPYS+hhN1hDnSqmQnbHR:tm5l7be9EJLSqJbx
Static task
static1
Behavioral task
behavioral1
Sample
118c8493f0cdf451d1d0dd132734df9c1e365ed71ce0db3665c5d8c0734a27ebN.dll
Resource
win7-20240903-en
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Targets
-
-
Target
118c8493f0cdf451d1d0dd132734df9c1e365ed71ce0db3665c5d8c0734a27ebN.exe
-
Size
120KB
-
MD5
1b46d953fd456705c5c069ba1ccfcd00
-
SHA1
67e37c283c23333e3f79307aac6209e86db7c124
-
SHA256
118c8493f0cdf451d1d0dd132734df9c1e365ed71ce0db3665c5d8c0734a27eb
-
SHA512
8a0467018069b28df898bd9db8dc3126a992f313e74d079e39b93acfdd3437b6ac88344f8313a4011387e95527702afb6370d714e825d78fa77e782786f1ab7d
-
SSDEEP
3072:tmF5Mklw0j5u0SOKfCbS0ucOGIPYS+hhN1hDnSqmQnbHR:tm5l7be9EJLSqJbx
-
Modifies firewall policy service
-
Sality family
-
Executes dropped EXE
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5