Analysis

  • max time kernel
    106s
  • max time network
    111s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-12-2024 22:36

General

  • Target

    152c7b6bbb28d3a6bb82db25c979a325689c83f2f8b5859784566e7cef08e634.dll

  • Size

    120KB

  • MD5

    23bda8ab0a97da69f454b3fb2ee3c927

  • SHA1

    385130ef11cd0689da7ab4ace23c5a45cf9fd76e

  • SHA256

    152c7b6bbb28d3a6bb82db25c979a325689c83f2f8b5859784566e7cef08e634

  • SHA512

    15e46b5e0d6a2b33a973e215e3bc032a5a4096d4b0a1e4a610937268f984d8f3bd084cfce4856ebe86ec43ba7fb4ebb9ee613a7fb294ffe151190f0145cf4f6d

  • SSDEEP

    1536:B3uvRxZMssQJDfxWjM7zmIcxufUv8OTaSCWsmhRFgBP9/st1Aev+bLAawYeih:tuv3hMj8zmffvPTfsmXF0Rstj+Lx9eih

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

  • Modifies firewall policy service 3 TTPs 6 IoCs
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

  • Sality family
  • UAC bypass 3 TTPs 2 IoCs
  • Windows security bypass 2 TTPs 12 IoCs
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 14 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 13 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file 28 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs

Processes

  • C:\Windows\system32\fontdrvhost.exe
    "fontdrvhost.exe"
    1⤵
      PID:780
    • C:\Windows\system32\fontdrvhost.exe
      "fontdrvhost.exe"
      1⤵
        PID:784
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        1⤵
          PID:60
        • C:\Windows\system32\sihost.exe
          sihost.exe
          1⤵
            PID:2540
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
            1⤵
              PID:2548
            • C:\Windows\system32\taskhostw.exe
              taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
              1⤵
                PID:2652
              • C:\Windows\Explorer.EXE
                C:\Windows\Explorer.EXE
                1⤵
                  PID:3544
                  • C:\Windows\system32\rundll32.exe
                    rundll32.exe C:\Users\Admin\AppData\Local\Temp\152c7b6bbb28d3a6bb82db25c979a325689c83f2f8b5859784566e7cef08e634.dll,#1
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4132
                    • C:\Windows\SysWOW64\rundll32.exe
                      rundll32.exe C:\Users\Admin\AppData\Local\Temp\152c7b6bbb28d3a6bb82db25c979a325689c83f2f8b5859784566e7cef08e634.dll,#1
                      3⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:3256
                      • C:\Users\Admin\AppData\Local\Temp\e578bb5.exe
                        C:\Users\Admin\AppData\Local\Temp\e578bb5.exe
                        4⤵
                        • Modifies firewall policy service
                        • UAC bypass
                        • Windows security bypass
                        • Executes dropped EXE
                        • Windows security modification
                        • Checks whether UAC is enabled
                        • Enumerates connected drives
                        • Drops file in Program Files directory
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        • System policy modification
                        PID:1468
                      • C:\Users\Admin\AppData\Local\Temp\e578dc9.exe
                        C:\Users\Admin\AppData\Local\Temp\e578dc9.exe
                        4⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:4424
                      • C:\Users\Admin\AppData\Local\Temp\e57ad09.exe
                        C:\Users\Admin\AppData\Local\Temp\e57ad09.exe
                        4⤵
                        • Modifies firewall policy service
                        • UAC bypass
                        • Windows security bypass
                        • Executes dropped EXE
                        • Windows security modification
                        • Checks whether UAC is enabled
                        • Enumerates connected drives
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        • System policy modification
                        PID:1344
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                  1⤵
                    PID:3656
                  • C:\Windows\system32\DllHost.exe
                    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                    1⤵
                      PID:3840
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:3936
                      • C:\Windows\System32\RuntimeBroker.exe
                        C:\Windows\System32\RuntimeBroker.exe -Embedding
                        1⤵
                          PID:4000
                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                          1⤵
                            PID:1064
                          • C:\Windows\System32\RuntimeBroker.exe
                            C:\Windows\System32\RuntimeBroker.exe -Embedding
                            1⤵
                              PID:4056
                            • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
                              "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
                              1⤵
                                PID:1604
                              • C:\Windows\System32\RuntimeBroker.exe
                                C:\Windows\System32\RuntimeBroker.exe -Embedding
                                1⤵
                                  PID:2808
                                • C:\Windows\system32\backgroundTaskHost.exe
                                  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                  1⤵
                                    PID:4124

                                  Network

                                  • flag-us
                                    DNS
                                    196.249.167.52.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    196.249.167.52.in-addr.arpa
                                    IN PTR
                                    Response
                                  • flag-us
                                    DNS
                                    67.31.126.40.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    67.31.126.40.in-addr.arpa
                                    IN PTR
                                    Response
                                  • flag-us
                                    DNS
                                    95.221.229.192.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    95.221.229.192.in-addr.arpa
                                    IN PTR
                                    Response
                                  • flag-us
                                    DNS
                                    95.221.229.192.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    95.221.229.192.in-addr.arpa
                                    IN PTR
                                  • flag-us
                                    DNS
                                    95.221.229.192.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    95.221.229.192.in-addr.arpa
                                    IN PTR
                                  • flag-us
                                    DNS
                                    95.221.229.192.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    95.221.229.192.in-addr.arpa
                                    IN PTR
                                  • flag-us
                                    DNS
                                    95.221.229.192.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    95.221.229.192.in-addr.arpa
                                    IN PTR
                                  • flag-us
                                    DNS
                                    212.20.149.52.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    212.20.149.52.in-addr.arpa
                                    IN PTR
                                    Response
                                  • flag-us
                                    DNS
                                    206.23.85.13.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    206.23.85.13.in-addr.arpa
                                    IN PTR
                                    Response
                                  • flag-us
                                    DNS
                                    133.211.185.52.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    133.211.185.52.in-addr.arpa
                                    IN PTR
                                    Response
                                  • flag-us
                                    DNS
                                    28.118.140.52.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    28.118.140.52.in-addr.arpa
                                    IN PTR
                                    Response
                                  • flag-us
                                    DNS
                                    172.210.232.199.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    172.210.232.199.in-addr.arpa
                                    IN PTR
                                    Response
                                  • flag-us
                                    DNS
                                    196.190.18.2.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    196.190.18.2.in-addr.arpa
                                    IN PTR
                                    Response
                                    196.190.18.2.in-addr.arpa
                                    IN PTR
                                    a2-18-190-196deploystaticakamaitechnologiescom
                                  • flag-us
                                    DNS
                                    31.243.111.52.in-addr.arpa
                                    Remote address:
                                    8.8.8.8:53
                                    Request
                                    31.243.111.52.in-addr.arpa
                                    IN PTR
                                    Response
                                  No results found
                                  • 8.8.8.8:53
                                    196.249.167.52.in-addr.arpa
                                    dns
                                    73 B
                                    147 B
                                    1
                                    1

                                    DNS Request

                                    196.249.167.52.in-addr.arpa

                                  • 8.8.8.8:53
                                    67.31.126.40.in-addr.arpa
                                    dns
                                    71 B
                                    157 B
                                    1
                                    1

                                    DNS Request

                                    67.31.126.40.in-addr.arpa

                                  • 8.8.8.8:53
                                    95.221.229.192.in-addr.arpa
                                    dns
                                    365 B
                                    144 B
                                    5
                                    1

                                    DNS Request

                                    95.221.229.192.in-addr.arpa

                                    DNS Request

                                    95.221.229.192.in-addr.arpa

                                    DNS Request

                                    95.221.229.192.in-addr.arpa

                                    DNS Request

                                    95.221.229.192.in-addr.arpa

                                    DNS Request

                                    95.221.229.192.in-addr.arpa

                                  • 8.8.8.8:53
                                    212.20.149.52.in-addr.arpa
                                    dns
                                    72 B
                                    146 B
                                    1
                                    1

                                    DNS Request

                                    212.20.149.52.in-addr.arpa

                                  • 8.8.8.8:53
                                    206.23.85.13.in-addr.arpa
                                    dns
                                    71 B
                                    145 B
                                    1
                                    1

                                    DNS Request

                                    206.23.85.13.in-addr.arpa

                                  • 8.8.8.8:53
                                    133.211.185.52.in-addr.arpa
                                    dns
                                    73 B
                                    147 B
                                    1
                                    1

                                    DNS Request

                                    133.211.185.52.in-addr.arpa

                                  • 8.8.8.8:53
                                    28.118.140.52.in-addr.arpa
                                    dns
                                    72 B
                                    158 B
                                    1
                                    1

                                    DNS Request

                                    28.118.140.52.in-addr.arpa

                                  • 8.8.8.8:53
                                    172.210.232.199.in-addr.arpa
                                    dns
                                    74 B
                                    128 B
                                    1
                                    1

                                    DNS Request

                                    172.210.232.199.in-addr.arpa

                                  • 8.8.8.8:53
                                    196.190.18.2.in-addr.arpa
                                    dns
                                    71 B
                                    135 B
                                    1
                                    1

                                    DNS Request

                                    196.190.18.2.in-addr.arpa

                                  • 8.8.8.8:53
                                    31.243.111.52.in-addr.arpa
                                    dns
                                    72 B
                                    158 B
                                    1
                                    1

                                    DNS Request

                                    31.243.111.52.in-addr.arpa

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Users\Admin\AppData\Local\Temp\e578bb5.exe

                                    Filesize

                                    97KB

                                    MD5

                                    bfe6b88dcfe5722f0c8e5694f460d062

                                    SHA1

                                    9a612665ff3724dce3abf895278dc9e3f866eb7c

                                    SHA256

                                    aee05ee9fde72ab8c0ca788e2ed681084df276451206aae602bbb88dae0b77d9

                                    SHA512

                                    c8ab2f3480d4357fc8ea4b4f6cbb56c3e4cd3a5ee2cd2dc7ece57eee47e4780edd579af06c51e2ce874abf673f62bce2ec18ef6d8268590ce328c3e5477fd69c

                                  • C:\Windows\SYSTEM.INI

                                    Filesize

                                    257B

                                    MD5

                                    9d4a56b7f81e0f350228f31f525c42a5

                                    SHA1

                                    48dd5a76c94b7a0c02d9d8b2c8c2bdc2ff72358e

                                    SHA256

                                    32f5427793093c221c5e48478dcd88dbf8f272051ca860ca7e2691ed799ebd92

                                    SHA512

                                    3e4bd37f4fed2840fa6aba5c79e1f6536bd5b7998881812cc3af81e7047c73ebdac6638812dbdf3a70b70982e52e3345ebe0f73a067c0a67350de387cc91ed83

                                  • memory/1344-145-0x0000000000400000-0x0000000000412000-memory.dmp

                                    Filesize

                                    72KB

                                  • memory/1344-144-0x0000000000B30000-0x0000000001BEA000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/1344-109-0x0000000000B30000-0x0000000001BEA000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/1344-57-0x00000000001E0000-0x00000000001E2000-memory.dmp

                                    Filesize

                                    8KB

                                  • memory/1344-55-0x00000000001E0000-0x00000000001E2000-memory.dmp

                                    Filesize

                                    8KB

                                  • memory/1344-53-0x00000000001F0000-0x00000000001F1000-memory.dmp

                                    Filesize

                                    4KB

                                  • memory/1468-40-0x0000000000780000-0x000000000183A000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/1468-66-0x0000000000780000-0x000000000183A000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/1468-30-0x0000000001AC0000-0x0000000001AC1000-memory.dmp

                                    Filesize

                                    4KB

                                  • memory/1468-4-0x0000000000400000-0x0000000000412000-memory.dmp

                                    Filesize

                                    72KB

                                  • memory/1468-9-0x0000000000780000-0x000000000183A000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/1468-10-0x0000000000780000-0x000000000183A000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/1468-12-0x0000000000780000-0x000000000183A000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/1468-94-0x0000000000400000-0x0000000000412000-memory.dmp

                                    Filesize

                                    72KB

                                  • memory/1468-19-0x0000000000780000-0x000000000183A000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/1468-11-0x0000000000780000-0x000000000183A000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/1468-13-0x0000000000780000-0x000000000183A000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/1468-8-0x0000000000780000-0x000000000183A000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/1468-37-0x0000000000780000-0x000000000183A000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/1468-36-0x0000000000780000-0x000000000183A000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/1468-38-0x0000000000780000-0x000000000183A000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/1468-39-0x0000000000780000-0x000000000183A000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/1468-20-0x0000000000780000-0x000000000183A000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/1468-49-0x0000000000780000-0x000000000183A000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/1468-33-0x00000000004A0000-0x00000000004A2000-memory.dmp

                                    Filesize

                                    8KB

                                  • memory/1468-35-0x00000000004A0000-0x00000000004A2000-memory.dmp

                                    Filesize

                                    8KB

                                  • memory/1468-80-0x0000000000780000-0x000000000183A000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/1468-74-0x0000000000780000-0x000000000183A000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/1468-71-0x0000000000780000-0x000000000183A000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/1468-27-0x0000000000780000-0x000000000183A000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/1468-69-0x0000000000780000-0x000000000183A000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/1468-58-0x0000000000780000-0x000000000183A000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/1468-59-0x0000000000780000-0x000000000183A000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/1468-61-0x00000000004A0000-0x00000000004A2000-memory.dmp

                                    Filesize

                                    8KB

                                  • memory/1468-62-0x0000000000780000-0x000000000183A000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/1468-64-0x0000000000780000-0x000000000183A000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/1468-65-0x0000000000780000-0x000000000183A000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/1468-26-0x0000000000780000-0x000000000183A000-memory.dmp

                                    Filesize

                                    16.7MB

                                  • memory/3256-21-0x0000000000A30000-0x0000000000A32000-memory.dmp

                                    Filesize

                                    8KB

                                  • memory/3256-22-0x0000000000A40000-0x0000000000A41000-memory.dmp

                                    Filesize

                                    4KB

                                  • memory/3256-28-0x0000000000A30000-0x0000000000A32000-memory.dmp

                                    Filesize

                                    8KB

                                  • memory/3256-25-0x0000000000A30000-0x0000000000A32000-memory.dmp

                                    Filesize

                                    8KB

                                  • memory/3256-0-0x0000000010000000-0x0000000010020000-memory.dmp

                                    Filesize

                                    128KB

                                  • memory/4424-56-0x00000000001C0000-0x00000000001C2000-memory.dmp

                                    Filesize

                                    8KB

                                  • memory/4424-54-0x00000000001C0000-0x00000000001C2000-memory.dmp

                                    Filesize

                                    8KB

                                  • memory/4424-51-0x00000000004A0000-0x00000000004A1000-memory.dmp

                                    Filesize

                                    4KB

                                  • memory/4424-34-0x0000000000400000-0x0000000000412000-memory.dmp

                                    Filesize

                                    72KB

                                  • memory/4424-98-0x0000000000400000-0x0000000000412000-memory.dmp

                                    Filesize

                                    72KB

                                  We care about your privacy.

                                  This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.