Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    18-12-2024 05:04

General

  • Target

    fdf0e5b020cd294e97e5c983c84c742428cc1071684d23e6a6e8c9d0c66e4b28N.dll

  • Size

    120KB

  • MD5

    c59671ec62f385ed57472752b4544a00

  • SHA1

    5a3222912561c89bbb05c99ab0260babeab96c9d

  • SHA256

    fdf0e5b020cd294e97e5c983c84c742428cc1071684d23e6a6e8c9d0c66e4b28

  • SHA512

    c94faa92d8194e6b0cd44e0eb89803e6a07c50dc2cafc4aaae6db67de540a819d5957a807d366ac98aba3bfc0406b6eb8ba39c8e4ffd3033ccc74991f3fe76db

  • SSDEEP

    3072:1VaQc7YLD0OHwM2mq349baISXXaRT+5oWj:s4AOHwMW34ZI+YoW

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

  • Modifies firewall policy service 3 TTPs 6 IoCs
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

  • Sality family
  • UAC bypass 3 TTPs 2 IoCs
  • Windows security bypass 2 TTPs 12 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • Windows security modification 2 TTPs 14 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 17 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file 23 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs
  • System policy modification 1 TTPs 2 IoCs

Processes

  • C:\Windows\system32\Dwm.exe
    "C:\Windows\system32\Dwm.exe"
    1⤵
      PID:1080
    • C:\Windows\system32\taskhost.exe
      "taskhost.exe"
      1⤵
        PID:1088
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
          PID:1156
          • C:\Windows\system32\rundll32.exe
            rundll32.exe C:\Users\Admin\AppData\Local\Temp\fdf0e5b020cd294e97e5c983c84c742428cc1071684d23e6a6e8c9d0c66e4b28N.dll,#1
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2384
            • C:\Windows\SysWOW64\rundll32.exe
              rundll32.exe C:\Users\Admin\AppData\Local\Temp\fdf0e5b020cd294e97e5c983c84c742428cc1071684d23e6a6e8c9d0c66e4b28N.dll,#1
              3⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2136
              • C:\Users\Admin\AppData\Local\Temp\f76d8b3.exe
                C:\Users\Admin\AppData\Local\Temp\f76d8b3.exe
                4⤵
                • Modifies firewall policy service
                • UAC bypass
                • Windows security bypass
                • Executes dropped EXE
                • Windows security modification
                • Checks whether UAC is enabled
                • Enumerates connected drives
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:1840
              • C:\Users\Admin\AppData\Local\Temp\f76da0a.exe
                C:\Users\Admin\AppData\Local\Temp\f76da0a.exe
                4⤵
                • Executes dropped EXE
                PID:2736
              • C:\Users\Admin\AppData\Local\Temp\f76f46d.exe
                C:\Users\Admin\AppData\Local\Temp\f76f46d.exe
                4⤵
                • Modifies firewall policy service
                • UAC bypass
                • Windows security bypass
                • Executes dropped EXE
                • Windows security modification
                • Checks whether UAC is enabled
                • Enumerates connected drives
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:2456
        • C:\Windows\system32\DllHost.exe
          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
          1⤵
            PID:468

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Windows\SYSTEM.INI

            Filesize

            256B

            MD5

            f7061dea279c45fd9bba59d3a467a1bf

            SHA1

            f83ac75a8baf3a086a494b1253aedf47c6a592b5

            SHA256

            cbbff3559151c3229f4fcb6d0591d12bde776230a7a186a5954e30523fe240af

            SHA512

            4bab9f627d362fb6841ec8f50bc40dc5c09ec15858ab35a306bdcc28e6ecc994619dfceb876207bc40336afd5e66f7157ed8a7a96bdffbebfbfcee7cfebfed81

          • \Users\Admin\AppData\Local\Temp\f76d8b3.exe

            Filesize

            97KB

            MD5

            d0f0188ff00e0af16ac796c8fe62404d

            SHA1

            b41943df0049f0a2dc5385627055cdbffc0678aa

            SHA256

            443659c41f012d0a0d0c12e03766a61033df262e7e28c3ef38bbad1f90ef9ff0

            SHA512

            cad504fb0cd0036e7e4a919f25a186640ad20ac970c74189efe69f5322a6127ea73cf20113e1ba08c5f83e50fe2f86413e636a0ae7b0e02cf90a85cee9d46894

          • memory/1080-23-0x0000000001DA0000-0x0000000001DA2000-memory.dmp

            Filesize

            8KB

          • memory/1840-86-0x0000000000290000-0x0000000000292000-memory.dmp

            Filesize

            8KB

          • memory/1840-19-0x0000000000680000-0x000000000173A000-memory.dmp

            Filesize

            16.7MB

          • memory/1840-18-0x0000000000680000-0x000000000173A000-memory.dmp

            Filesize

            16.7MB

          • memory/1840-155-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/1840-13-0x0000000000680000-0x000000000173A000-memory.dmp

            Filesize

            16.7MB

          • memory/1840-14-0x0000000000680000-0x000000000173A000-memory.dmp

            Filesize

            16.7MB

          • memory/1840-156-0x0000000000680000-0x000000000173A000-memory.dmp

            Filesize

            16.7MB

          • memory/1840-20-0x0000000000680000-0x000000000173A000-memory.dmp

            Filesize

            16.7MB

          • memory/1840-21-0x0000000000680000-0x000000000173A000-memory.dmp

            Filesize

            16.7MB

          • memory/1840-89-0x0000000000680000-0x000000000173A000-memory.dmp

            Filesize

            16.7MB

          • memory/1840-87-0x0000000000680000-0x000000000173A000-memory.dmp

            Filesize

            16.7MB

          • memory/1840-67-0x0000000000680000-0x000000000173A000-memory.dmp

            Filesize

            16.7MB

          • memory/1840-60-0x0000000000290000-0x0000000000292000-memory.dmp

            Filesize

            8KB

          • memory/1840-16-0x0000000000680000-0x000000000173A000-memory.dmp

            Filesize

            16.7MB

          • memory/1840-17-0x0000000000680000-0x000000000173A000-memory.dmp

            Filesize

            16.7MB

          • memory/1840-15-0x0000000000680000-0x000000000173A000-memory.dmp

            Filesize

            16.7MB

          • memory/1840-41-0x00000000002A0000-0x00000000002A1000-memory.dmp

            Filesize

            4KB

          • memory/1840-85-0x0000000000680000-0x000000000173A000-memory.dmp

            Filesize

            16.7MB

          • memory/1840-68-0x0000000000680000-0x000000000173A000-memory.dmp

            Filesize

            16.7MB

          • memory/1840-10-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/1840-22-0x0000000000680000-0x000000000173A000-memory.dmp

            Filesize

            16.7MB

          • memory/1840-61-0x0000000000680000-0x000000000173A000-memory.dmp

            Filesize

            16.7MB

          • memory/1840-62-0x0000000000680000-0x000000000173A000-memory.dmp

            Filesize

            16.7MB

          • memory/1840-63-0x0000000000680000-0x000000000173A000-memory.dmp

            Filesize

            16.7MB

          • memory/1840-64-0x0000000000680000-0x000000000173A000-memory.dmp

            Filesize

            16.7MB

          • memory/1840-65-0x0000000000680000-0x000000000173A000-memory.dmp

            Filesize

            16.7MB

          • memory/2136-51-0x00000000001C0000-0x00000000001D2000-memory.dmp

            Filesize

            72KB

          • memory/2136-30-0x00000000001A0000-0x00000000001A2000-memory.dmp

            Filesize

            8KB

          • memory/2136-82-0x00000000000C0000-0x00000000000C2000-memory.dmp

            Filesize

            8KB

          • memory/2136-79-0x00000000001E0000-0x00000000001F2000-memory.dmp

            Filesize

            72KB

          • memory/2136-78-0x00000000001A0000-0x00000000001A2000-memory.dmp

            Filesize

            8KB

          • memory/2136-72-0x00000000001E0000-0x00000000001F2000-memory.dmp

            Filesize

            72KB

          • memory/2136-40-0x00000000001B0000-0x00000000001B1000-memory.dmp

            Filesize

            4KB

          • memory/2136-1-0x0000000010000000-0x0000000010020000-memory.dmp

            Filesize

            128KB

          • memory/2136-52-0x00000000001A0000-0x00000000001A2000-memory.dmp

            Filesize

            8KB

          • memory/2136-31-0x00000000001B0000-0x00000000001B1000-memory.dmp

            Filesize

            4KB

          • memory/2136-49-0x00000000001A0000-0x00000000001A2000-memory.dmp

            Filesize

            8KB

          • memory/2136-8-0x00000000000C0000-0x00000000000D2000-memory.dmp

            Filesize

            72KB

          • memory/2456-109-0x00000000002B0000-0x00000000002B1000-memory.dmp

            Filesize

            4KB

          • memory/2456-110-0x0000000000260000-0x0000000000262000-memory.dmp

            Filesize

            8KB

          • memory/2456-214-0x00000000009B0000-0x0000000001A6A000-memory.dmp

            Filesize

            16.7MB

          • memory/2456-173-0x0000000000260000-0x0000000000262000-memory.dmp

            Filesize

            8KB

          • memory/2456-172-0x00000000009B0000-0x0000000001A6A000-memory.dmp

            Filesize

            16.7MB

          • memory/2456-111-0x0000000000260000-0x0000000000262000-memory.dmp

            Filesize

            8KB

          • memory/2456-213-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2736-108-0x0000000000260000-0x0000000000262000-memory.dmp

            Filesize

            8KB

          • memory/2736-160-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2736-130-0x0000000000260000-0x0000000000262000-memory.dmp

            Filesize

            8KB

          • memory/2736-100-0x00000000002B0000-0x00000000002B1000-memory.dmp

            Filesize

            4KB

          • memory/2736-101-0x0000000000260000-0x0000000000262000-memory.dmp

            Filesize

            8KB

          • memory/2736-53-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB