Analysis
-
max time kernel
28s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
18-12-2024 00:55
General
-
Target
615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe
-
Size
1.1MB
-
MD5
669b6cf51f911e95a00f1b2d29dbf3ea
-
SHA1
7b0d3fc8e9390eb59d16e2a490d14fdcf0e06458
-
SHA256
615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1
-
SHA512
43a5dee16bf807ffcc19fa68d122ef7e58a17703d0774d66c3f82bebda3ae1c7e13d9bfc5722dfe7019e08e1ad16d2c3b50647a07c33773a730d3d98c8fa549a
-
SSDEEP
24576:W1/aGLDCM4D8ayGMCPnXo8/ql8ahCKn+xnjbmf8NRUoNvo2OKVlnFr4sIZjUHt9v:FD8ayGM0Xonl84UHmf8NRUoNvo2OKVlz
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
http://klkjwre77638dfqwieuoi888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
-
Sality
Sality is backdoor written in C++, first discovered in 2003.
-
Sality family
-
UAC bypass 3 TTPs 2 IoCs
-
Windows security bypass 2 TTPs 12 IoCs
-
Disables RegEdit via registry modification 2 IoCs
-
Disables Task Manager via registry modification
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Windows security modification 2 TTPs 14 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
UPX packed file 32 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 25 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe"C:\Users\Admin\AppData\Local\Temp\615b7955e30774c5be889411cdcb532d46ffbc2bf99d3d3af8c1f478003733e1.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\ProgramData\dewpm.exe"C:\ProgramData\dewpm.exe"3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Deletes itself
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5c60b34db1ee60ef111c5e7e3635d4a1c
SHA17285af8ef4d3681149a9072d2cd89f7d0b42a8cf
SHA256994c7cbd0ac69899df48d1592fabd995c2d09cc77a669b53010cee8145108877
SHA512934bc90b5bbec29f7f4f896a8f99741e13ad11a370fc2f0e977d64800b40917812fc330ccf41607c92fd551f6f055e3d332b3239c01438cf0c3537dea65155bd
-
Filesize
557KB
MD56f1656028d98fceaa83d9b6f8cc5459d
SHA17f2e990ad5347f6613683e7efa86f08ebfa9f4a6
SHA2562121af2516f030cebfd88efb6b6c195ecc4573cdbc79595253af54970a0a8a9a
SHA512cc0ede5bd411363d4f6a81e20521af15865decedbfb539702744f8cafc2087533a513f4a7541cb0eb3447411397cd042d00232e9d091a97e09043711379ce71e
-
Filesize
522KB
MD5e5eb4edf90bd0f39551065e11904d766
SHA18bd449263b6e72a7bc0c54f63d76e84ed47ed008
SHA256d95e5ef8de06fec0d74f30ceac6dd1c83898459eaf9e5e59affe914b898fe7b5
SHA5127298e3bb063f1bf3a2dab4eb17442c8b8129acf89cf1efb931778f41bd11982c055ba833c78c3b8a76fd45ae2ccfb047959a1b54202891b4f413283d2402650a
-
Filesize
257B
MD50f3c27732828998f2465ce1bdb5aa822
SHA1185de6c82d16636576c42411aebe8eadf5593bf0
SHA256012342d2ae6d42bd13ba29aaa6894aaa04e596ac6cea0aaeecad452bce006a69
SHA5126c0cc3548c360a77c7394a8d29dee715d76e5a7f0b285eaa272097eda95279995cfbca3273a4c35002a8460fc7a86b1dea46a0e687e19021fce4b555f5b7ffe5
-
Filesize
8KB
-
Filesize
16.6MB
-
Filesize
392KB
-
Filesize
392KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
356KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
356KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
8KB
-
Filesize
16.6MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
356KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB