Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
18-12-2024 03:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a8db1d129c65da982648c49033b2d47c7479f03c34fb0b337919d8163d5beff1.dll
Resource
win7-20240708-en
windows7-x64
17 signatures
150 seconds
General
-
Target
a8db1d129c65da982648c49033b2d47c7479f03c34fb0b337919d8163d5beff1.dll
-
Size
120KB
-
MD5
9aa74da878dc993ed35c649926877f2f
-
SHA1
58b633603baf82dbc43383dd4295aa87e7258d41
-
SHA256
a8db1d129c65da982648c49033b2d47c7479f03c34fb0b337919d8163d5beff1
-
SHA512
a8c4683e8116c204ef9b79cdc5049b8c489b488f71fad8adb5303204f935db336f5bae2abc44cdbf8feb077fe8bb4bc79c1cdb8e80e92fb9672e01274709e1fa
-
SSDEEP
1536:ScGQq51NFpraOv4RFq04/4JKsXCflTkUOZ5FFmArOl0R68tc:y51/gzXQ/Q0faJxpB6
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f769ab9.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f769ab9.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f769ab9.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f769c4f.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f769c4f.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f769c4f.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f769ab9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f769c4f.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f769ab9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f769c4f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f769c4f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f769c4f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f769c4f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f769ab9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f769ab9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f769ab9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f769ab9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f769ab9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f769c4f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f769c4f.exe -
Executes dropped EXE 3 IoCs
pid Process 1932 f769ab9.exe 3012 f769c4f.exe 2656 f76b673.exe -
Loads dropped DLL 6 IoCs
pid Process 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe 2040 rundll32.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f769ab9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f769ab9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f769c4f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f769c4f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f769c4f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f769ab9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f769ab9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f769c4f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f769c4f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f769ab9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f769ab9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f769c4f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f769c4f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f769ab9.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f769ab9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f769c4f.exe -
Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: f769ab9.exe File opened (read-only) \??\H: f769ab9.exe File opened (read-only) \??\I: f769ab9.exe File opened (read-only) \??\N: f769ab9.exe File opened (read-only) \??\O: f769ab9.exe File opened (read-only) \??\E: f769ab9.exe File opened (read-only) \??\G: f769ab9.exe File opened (read-only) \??\K: f769ab9.exe File opened (read-only) \??\P: f769ab9.exe File opened (read-only) \??\R: f769ab9.exe File opened (read-only) \??\T: f769ab9.exe File opened (read-only) \??\J: f769ab9.exe File opened (read-only) \??\L: f769ab9.exe File opened (read-only) \??\M: f769ab9.exe File opened (read-only) \??\S: f769ab9.exe -
resource yara_rule behavioral1/memory/1932-13-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/1932-11-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/1932-19-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/1932-17-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/1932-14-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/1932-21-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/1932-20-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/1932-18-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/1932-16-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/1932-15-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/1932-60-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/1932-61-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/1932-62-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/1932-63-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/1932-64-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/1932-66-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/1932-67-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/1932-81-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/1932-84-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/1932-85-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/1932-108-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/1932-151-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/3012-168-0x0000000000940000-0x00000000019FA000-memory.dmp upx behavioral1/memory/3012-190-0x0000000000940000-0x00000000019FA000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI f769ab9.exe File created C:\Windows\f76eb39 f769c4f.exe File created C:\Windows\f769b17 f769ab9.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f769ab9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f769c4f.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1932 f769ab9.exe 1932 f769ab9.exe 3012 f769c4f.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 1932 f769ab9.exe Token: SeDebugPrivilege 1932 f769ab9.exe Token: SeDebugPrivilege 1932 f769ab9.exe Token: SeDebugPrivilege 1932 f769ab9.exe Token: SeDebugPrivilege 1932 f769ab9.exe Token: SeDebugPrivilege 1932 f769ab9.exe Token: SeDebugPrivilege 1932 f769ab9.exe Token: SeDebugPrivilege 1932 f769ab9.exe Token: SeDebugPrivilege 1932 f769ab9.exe Token: SeDebugPrivilege 1932 f769ab9.exe Token: SeDebugPrivilege 1932 f769ab9.exe Token: SeDebugPrivilege 1932 f769ab9.exe Token: SeDebugPrivilege 1932 f769ab9.exe Token: SeDebugPrivilege 1932 f769ab9.exe Token: SeDebugPrivilege 1932 f769ab9.exe Token: SeDebugPrivilege 1932 f769ab9.exe Token: SeDebugPrivilege 1932 f769ab9.exe Token: SeDebugPrivilege 1932 f769ab9.exe Token: SeDebugPrivilege 1932 f769ab9.exe Token: SeDebugPrivilege 1932 f769ab9.exe Token: SeDebugPrivilege 1932 f769ab9.exe Token: SeDebugPrivilege 1932 f769ab9.exe Token: SeDebugPrivilege 1932 f769ab9.exe Token: SeDebugPrivilege 3012 f769c4f.exe Token: SeDebugPrivilege 3012 f769c4f.exe Token: SeDebugPrivilege 3012 f769c4f.exe Token: SeDebugPrivilege 3012 f769c4f.exe Token: SeDebugPrivilege 3012 f769c4f.exe Token: SeDebugPrivilege 3012 f769c4f.exe Token: SeDebugPrivilege 3012 f769c4f.exe Token: SeDebugPrivilege 3012 f769c4f.exe Token: SeDebugPrivilege 3012 f769c4f.exe Token: SeDebugPrivilege 3012 f769c4f.exe Token: SeDebugPrivilege 3012 f769c4f.exe Token: SeDebugPrivilege 3012 f769c4f.exe Token: SeDebugPrivilege 3012 f769c4f.exe Token: SeDebugPrivilege 3012 f769c4f.exe Token: SeDebugPrivilege 3012 f769c4f.exe Token: SeDebugPrivilege 3012 f769c4f.exe Token: SeDebugPrivilege 3012 f769c4f.exe Token: SeDebugPrivilege 3012 f769c4f.exe Token: SeDebugPrivilege 3012 f769c4f.exe Token: SeDebugPrivilege 3012 f769c4f.exe Token: SeDebugPrivilege 3012 f769c4f.exe Token: SeDebugPrivilege 3012 f769c4f.exe Token: SeDebugPrivilege 3012 f769c4f.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 1452 wrote to memory of 2040 1452 rundll32.exe 30 PID 1452 wrote to memory of 2040 1452 rundll32.exe 30 PID 1452 wrote to memory of 2040 1452 rundll32.exe 30 PID 1452 wrote to memory of 2040 1452 rundll32.exe 30 PID 1452 wrote to memory of 2040 1452 rundll32.exe 30 PID 1452 wrote to memory of 2040 1452 rundll32.exe 30 PID 1452 wrote to memory of 2040 1452 rundll32.exe 30 PID 2040 wrote to memory of 1932 2040 rundll32.exe 31 PID 2040 wrote to memory of 1932 2040 rundll32.exe 31 PID 2040 wrote to memory of 1932 2040 rundll32.exe 31 PID 2040 wrote to memory of 1932 2040 rundll32.exe 31 PID 1932 wrote to memory of 1108 1932 f769ab9.exe 19 PID 1932 wrote to memory of 1168 1932 f769ab9.exe 20 PID 1932 wrote to memory of 1204 1932 f769ab9.exe 21 PID 1932 wrote to memory of 376 1932 f769ab9.exe 25 PID 1932 wrote to memory of 1452 1932 f769ab9.exe 29 PID 1932 wrote to memory of 2040 1932 f769ab9.exe 30 PID 1932 wrote to memory of 2040 1932 f769ab9.exe 30 PID 2040 wrote to memory of 3012 2040 rundll32.exe 32 PID 2040 wrote to memory of 3012 2040 rundll32.exe 32 PID 2040 wrote to memory of 3012 2040 rundll32.exe 32 PID 2040 wrote to memory of 3012 2040 rundll32.exe 32 PID 2040 wrote to memory of 2656 2040 rundll32.exe 33 PID 2040 wrote to memory of 2656 2040 rundll32.exe 33 PID 2040 wrote to memory of 2656 2040 rundll32.exe 33 PID 2040 wrote to memory of 2656 2040 rundll32.exe 33 PID 1932 wrote to memory of 1108 1932 f769ab9.exe 19 PID 1932 wrote to memory of 1168 1932 f769ab9.exe 20 PID 1932 wrote to memory of 1204 1932 f769ab9.exe 21 PID 1932 wrote to memory of 376 1932 f769ab9.exe 25 PID 1932 wrote to memory of 3012 1932 f769ab9.exe 32 PID 1932 wrote to memory of 3012 1932 f769ab9.exe 32 PID 1932 wrote to memory of 2656 1932 f769ab9.exe 33 PID 1932 wrote to memory of 2656 1932 f769ab9.exe 33 PID 3012 wrote to memory of 1108 3012 f769c4f.exe 19 PID 3012 wrote to memory of 1168 3012 f769c4f.exe 20 PID 3012 wrote to memory of 1204 3012 f769c4f.exe 21 PID 3012 wrote to memory of 376 3012 f769c4f.exe 25 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f769ab9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f769c4f.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1108
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1168
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1204
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a8db1d129c65da982648c49033b2d47c7479f03c34fb0b337919d8163d5beff1.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a8db1d129c65da982648c49033b2d47c7479f03c34fb0b337919d8163d5beff1.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\f769ab9.exeC:\Users\Admin\AppData\Local\Temp\f769ab9.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1932
-
-
C:\Users\Admin\AppData\Local\Temp\f769c4f.exeC:\Users\Admin\AppData\Local\Temp\f769c4f.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3012
-
-
C:\Users\Admin\AppData\Local\Temp\f76b673.exeC:\Users\Admin\AppData\Local\Temp\f76b673.exe4⤵
- Executes dropped EXE
PID:2656
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:376
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD536f40844f1d8f61f6cce8b08df37f3c2
SHA1644ac375069201efc4f53fae93554ca726cc8b31
SHA256cf451d6ff1b985800212c6968573a669b0a60dbf7250fa6ff84ff16065afcb40
SHA512dfa20bef7fea155cfd19243fb978996b7bace30304246999c2e5b27f191e15d42b447ff7945f817cc68a20e8122534bc92649652aa594c106c5a7457a35faa5a
-
Filesize
97KB
MD568419433e6eec65774b5a06d24a6386a
SHA1628c155d252b4315330b9c1a46293950e9877a45
SHA256556cb3826c97c3b7f1583cb9ff0775b5ea8a2c63786e64333789e3d3b36cac74
SHA512cb0271c8d2eed7332d032983b78ccc5189107407539e77588fc62c89434dfcd0c70f9a75dc95a6e2c0490c7ba66276b97cc1ecfa05c1f294edc023c6722185af