Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
18-12-2024 03:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a8db1d129c65da982648c49033b2d47c7479f03c34fb0b337919d8163d5beff1.dll
Resource
win7-20241010-en
windows7-x64
17 signatures
150 seconds
General
-
Target
a8db1d129c65da982648c49033b2d47c7479f03c34fb0b337919d8163d5beff1.dll
-
Size
120KB
-
MD5
9aa74da878dc993ed35c649926877f2f
-
SHA1
58b633603baf82dbc43383dd4295aa87e7258d41
-
SHA256
a8db1d129c65da982648c49033b2d47c7479f03c34fb0b337919d8163d5beff1
-
SHA512
a8c4683e8116c204ef9b79cdc5049b8c489b488f71fad8adb5303204f935db336f5bae2abc44cdbf8feb077fe8bb4bc79c1cdb8e80e92fb9672e01274709e1fa
-
SSDEEP
1536:ScGQq51NFpraOv4RFq04/4JKsXCflTkUOZ5FFmArOl0R68tc:y51/gzXQ/Q0faJxpB6
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f7662d8.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f7662d8.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f7662d8.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f767ea2.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f767ea2.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f767ea2.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7662d8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f767ea2.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7662d8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7662d8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f767ea2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f767ea2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f767ea2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f767ea2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f767ea2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7662d8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7662d8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7662d8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f767ea2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7662d8.exe -
Executes dropped EXE 3 IoCs
pid Process 2488 f7662d8.exe 312 f766642.exe 1768 f767ea2.exe -
Loads dropped DLL 6 IoCs
pid Process 2816 rundll32.exe 2816 rundll32.exe 2816 rundll32.exe 2816 rundll32.exe 2816 rundll32.exe 2816 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7662d8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7662d8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f767ea2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f767ea2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7662d8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f767ea2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f767ea2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7662d8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f7662d8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f767ea2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f767ea2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7662d8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7662d8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f767ea2.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7662d8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f767ea2.exe -
Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: f7662d8.exe File opened (read-only) \??\G: f7662d8.exe File opened (read-only) \??\N: f7662d8.exe File opened (read-only) \??\S: f7662d8.exe File opened (read-only) \??\K: f7662d8.exe File opened (read-only) \??\L: f7662d8.exe File opened (read-only) \??\O: f7662d8.exe File opened (read-only) \??\I: f7662d8.exe File opened (read-only) \??\J: f7662d8.exe File opened (read-only) \??\M: f7662d8.exe File opened (read-only) \??\Q: f7662d8.exe File opened (read-only) \??\H: f7662d8.exe File opened (read-only) \??\P: f7662d8.exe File opened (read-only) \??\R: f7662d8.exe File opened (read-only) \??\E: f767ea2.exe -
resource yara_rule behavioral1/memory/2488-11-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/2488-13-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/2488-16-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/2488-19-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/2488-20-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/2488-18-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/2488-17-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/2488-15-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/2488-14-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/2488-21-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/2488-60-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/2488-61-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/2488-62-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/2488-63-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/2488-64-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/2488-66-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/2488-67-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/2488-83-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/2488-84-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/2488-87-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/2488-157-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/1768-173-0x00000000009C0000-0x0000000001A7A000-memory.dmp upx behavioral1/memory/1768-213-0x00000000009C0000-0x0000000001A7A000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\f766345 f7662d8.exe File opened for modification C:\Windows\SYSTEM.INI f7662d8.exe File created C:\Windows\f76b589 f767ea2.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f7662d8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f767ea2.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2488 f7662d8.exe 2488 f7662d8.exe 1768 f767ea2.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeDebugPrivilege 2488 f7662d8.exe Token: SeDebugPrivilege 2488 f7662d8.exe Token: SeDebugPrivilege 2488 f7662d8.exe Token: SeDebugPrivilege 2488 f7662d8.exe Token: SeDebugPrivilege 2488 f7662d8.exe Token: SeDebugPrivilege 2488 f7662d8.exe Token: SeDebugPrivilege 2488 f7662d8.exe Token: SeDebugPrivilege 2488 f7662d8.exe Token: SeDebugPrivilege 2488 f7662d8.exe Token: SeDebugPrivilege 2488 f7662d8.exe Token: SeDebugPrivilege 2488 f7662d8.exe Token: SeDebugPrivilege 2488 f7662d8.exe Token: SeDebugPrivilege 2488 f7662d8.exe Token: SeDebugPrivilege 2488 f7662d8.exe Token: SeDebugPrivilege 2488 f7662d8.exe Token: SeDebugPrivilege 2488 f7662d8.exe Token: SeDebugPrivilege 2488 f7662d8.exe Token: SeDebugPrivilege 2488 f7662d8.exe Token: SeDebugPrivilege 2488 f7662d8.exe Token: SeDebugPrivilege 2488 f7662d8.exe Token: SeDebugPrivilege 2488 f7662d8.exe Token: SeDebugPrivilege 2488 f7662d8.exe Token: SeDebugPrivilege 2488 f7662d8.exe Token: SeDebugPrivilege 1768 f767ea2.exe Token: SeDebugPrivilege 1768 f767ea2.exe Token: SeDebugPrivilege 1768 f767ea2.exe Token: SeDebugPrivilege 1768 f767ea2.exe Token: SeDebugPrivilege 1768 f767ea2.exe Token: SeDebugPrivilege 1768 f767ea2.exe Token: SeDebugPrivilege 1768 f767ea2.exe Token: SeDebugPrivilege 1768 f767ea2.exe Token: SeDebugPrivilege 1768 f767ea2.exe Token: SeDebugPrivilege 1768 f767ea2.exe Token: SeDebugPrivilege 1768 f767ea2.exe Token: SeDebugPrivilege 1768 f767ea2.exe Token: SeDebugPrivilege 1768 f767ea2.exe Token: SeDebugPrivilege 1768 f767ea2.exe Token: SeDebugPrivilege 1768 f767ea2.exe Token: SeDebugPrivilege 1768 f767ea2.exe Token: SeDebugPrivilege 1768 f767ea2.exe Token: SeDebugPrivilege 1768 f767ea2.exe Token: SeDebugPrivilege 1768 f767ea2.exe Token: SeDebugPrivilege 1768 f767ea2.exe Token: SeDebugPrivilege 1768 f767ea2.exe Token: SeDebugPrivilege 1768 f767ea2.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2828 wrote to memory of 2816 2828 rundll32.exe 30 PID 2828 wrote to memory of 2816 2828 rundll32.exe 30 PID 2828 wrote to memory of 2816 2828 rundll32.exe 30 PID 2828 wrote to memory of 2816 2828 rundll32.exe 30 PID 2828 wrote to memory of 2816 2828 rundll32.exe 30 PID 2828 wrote to memory of 2816 2828 rundll32.exe 30 PID 2828 wrote to memory of 2816 2828 rundll32.exe 30 PID 2816 wrote to memory of 2488 2816 rundll32.exe 31 PID 2816 wrote to memory of 2488 2816 rundll32.exe 31 PID 2816 wrote to memory of 2488 2816 rundll32.exe 31 PID 2816 wrote to memory of 2488 2816 rundll32.exe 31 PID 2488 wrote to memory of 1096 2488 f7662d8.exe 19 PID 2488 wrote to memory of 1160 2488 f7662d8.exe 20 PID 2488 wrote to memory of 1192 2488 f7662d8.exe 21 PID 2488 wrote to memory of 1668 2488 f7662d8.exe 25 PID 2488 wrote to memory of 2828 2488 f7662d8.exe 29 PID 2488 wrote to memory of 2816 2488 f7662d8.exe 30 PID 2488 wrote to memory of 2816 2488 f7662d8.exe 30 PID 2816 wrote to memory of 312 2816 rundll32.exe 32 PID 2816 wrote to memory of 312 2816 rundll32.exe 32 PID 2816 wrote to memory of 312 2816 rundll32.exe 32 PID 2816 wrote to memory of 312 2816 rundll32.exe 32 PID 2816 wrote to memory of 1768 2816 rundll32.exe 33 PID 2816 wrote to memory of 1768 2816 rundll32.exe 33 PID 2816 wrote to memory of 1768 2816 rundll32.exe 33 PID 2816 wrote to memory of 1768 2816 rundll32.exe 33 PID 2488 wrote to memory of 1096 2488 f7662d8.exe 19 PID 2488 wrote to memory of 1160 2488 f7662d8.exe 20 PID 2488 wrote to memory of 1192 2488 f7662d8.exe 21 PID 2488 wrote to memory of 1668 2488 f7662d8.exe 25 PID 2488 wrote to memory of 312 2488 f7662d8.exe 32 PID 2488 wrote to memory of 312 2488 f7662d8.exe 32 PID 2488 wrote to memory of 1768 2488 f7662d8.exe 33 PID 2488 wrote to memory of 1768 2488 f7662d8.exe 33 PID 1768 wrote to memory of 1096 1768 f767ea2.exe 19 PID 1768 wrote to memory of 1160 1768 f767ea2.exe 20 PID 1768 wrote to memory of 1192 1768 f767ea2.exe 21 PID 1768 wrote to memory of 1668 1768 f767ea2.exe 25 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7662d8.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f767ea2.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1096
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1160
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1192
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a8db1d129c65da982648c49033b2d47c7479f03c34fb0b337919d8163d5beff1.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a8db1d129c65da982648c49033b2d47c7479f03c34fb0b337919d8163d5beff1.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\f7662d8.exeC:\Users\Admin\AppData\Local\Temp\f7662d8.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2488
-
-
C:\Users\Admin\AppData\Local\Temp\f766642.exeC:\Users\Admin\AppData\Local\Temp\f766642.exe4⤵
- Executes dropped EXE
PID:312
-
-
C:\Users\Admin\AppData\Local\Temp\f767ea2.exeC:\Users\Admin\AppData\Local\Temp\f767ea2.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1768
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1668
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD56f6c7ff8e604f2994f2fb9b86d7c8c61
SHA135e406cbc5963ed7ee99122354af19980a780e51
SHA2566c6cd8a149d7090999df62707582ec97a542bf29d07db6341d5cd6d220932ff4
SHA512a1fa30af6973286e0681aa3163ac0dccd68a94c8bd3fbe68c6f5b907af6a83bb025646efb6bee34931e5e589dc63c39b4c1a6ecf84ba2837a3f06327c2fff142
-
Filesize
97KB
MD568419433e6eec65774b5a06d24a6386a
SHA1628c155d252b4315330b9c1a46293950e9877a45
SHA256556cb3826c97c3b7f1583cb9ff0775b5ea8a2c63786e64333789e3d3b36cac74
SHA512cb0271c8d2eed7332d032983b78ccc5189107407539e77588fc62c89434dfcd0c70f9a75dc95a6e2c0490c7ba66276b97cc1ecfa05c1f294edc023c6722185af