Analysis
-
max time kernel
35s -
max time network
67s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
18-12-2024 03:05
General
-
Target
9fec6e7b5afbfa14c042363f8aae7067fe280ada5ba511de1ef9891f08496a1bN.exe
-
Size
1.1MB
-
MD5
dccfa9d28ed1ae89bd574d60aef59970
-
SHA1
3da6e8cf97bb4801dc38fb88afed711d954f7d89
-
SHA256
9fec6e7b5afbfa14c042363f8aae7067fe280ada5ba511de1ef9891f08496a1b
-
SHA512
69fde639caa70aa18cb3a026f60b0e5c499ae66c22af8b4191ae35b522370c52677d472766373afc73552cbb640ced7766691f43ba9a4cd4ff8d83ab59f48ce2
-
SSDEEP
24576:W1/aGLDCM4D8ayGMCPnXo8/ql8ahCKn+xnjbmf8NRUoNvo2OKVlnFr4sIZjUHt99:FD8ayGM0Xonl84UHmf8NRUoNvo2OKVlJ
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
http://klkjwre77638dfqwieuoi888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
-
Sality
Sality is backdoor written in C++, first discovered in 2003.
-
Sality family
-
UAC bypass 3 TTPs 2 IoCs
-
Windows security bypass 2 TTPs 12 IoCs
-
Disables RegEdit via registry modification 2 IoCs
-
Disables Task Manager via registry modification
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Windows security modification 2 TTPs 14 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
UPX packed file 34 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 27 IoCs
-
Suspicious use of WriteProcessMemory 20 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\9fec6e7b5afbfa14c042363f8aae7067fe280ada5ba511de1ef9891f08496a1bN.exe"C:\Users\Admin\AppData\Local\Temp\9fec6e7b5afbfa14c042363f8aae7067fe280ada5ba511de1ef9891f08496a1bN.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\ProgramData\odstbl.exe"C:\ProgramData\odstbl.exe"3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Deletes itself
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5a9e7f57bd0aa2250831e985092298cc0
SHA1dfcf3e9f328251d500c900a03a936632e69e8158
SHA256a8e30fc86e3d5abb1a293a78f34d80792f557a1074d536d9c4fe0d511fea9ac3
SHA5128ca82c8b7ff07da7f4703f9bd8227dd44c7eedb42a3b55d958d70bfa3e1f0d42888b6782018c56a2ad476626236e74ada8ac9bedf846775a0b170f036679f49a
-
Filesize
557KB
MD56f1656028d98fceaa83d9b6f8cc5459d
SHA17f2e990ad5347f6613683e7efa86f08ebfa9f4a6
SHA2562121af2516f030cebfd88efb6b6c195ecc4573cdbc79595253af54970a0a8a9a
SHA512cc0ede5bd411363d4f6a81e20521af15865decedbfb539702744f8cafc2087533a513f4a7541cb0eb3447411397cd042d00232e9d091a97e09043711379ce71e
-
Filesize
522KB
MD56446bbe2addac3f982b578c153b4052e
SHA1d8959dad9432a64837ce1055e1f7027bae652c6a
SHA256772d512687c47d87af5db585360fd029c54696ada86c144b2ebcfc2017a9a67c
SHA5128f1ee09ee5b9e79b266483510b2411f1b2fca43131ac06e82c6413eb23a138ad60df0bcb35fda1d2b3eacd5ea66ef907204998ba056aebe3c97f4d15fd1b28d8
-
Filesize
255B
MD56ffd6f4353b7e651c7dc619a57f45d91
SHA1476917801ba11a578c7b1ca81e7770020a0e10ea
SHA256ab5ae19ad81fddfe8a563fe357256c452b19d26c4745edc02123dc16b1c8a5c9
SHA5121c0e4fc0d37f72b6a9f2ddd95e2fb6f02b7cbc14702f15d163deb8dcf10742fb86b8ff5151d01b95db91b27a57408ba26322607a4e8ebe8e433bb70dde96bb51
-
Filesize
8KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
356KB
-
Filesize
392KB
-
Filesize
16.6MB
-
Filesize
392KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
4KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
356KB
-
Filesize
8KB
-
Filesize
16.6MB
-
Filesize
8KB
-
Filesize
16.6MB
-
Filesize
4KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
356KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
8KB