Analysis

  • max time kernel
    91s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    19-12-2024 00:56

General

  • Target

    532867ce7cef0ee357fb5b58c45821745215db96c2eff8346977597c65ec5505.dll

  • Size

    120KB

  • MD5

    d63cc28193e3f9d79d8b8628df7121f7

  • SHA1

    5a12cb347c270f92038cfcf35ec9fb6b99f45a99

  • SHA256

    532867ce7cef0ee357fb5b58c45821745215db96c2eff8346977597c65ec5505

  • SHA512

    4025af0ce7e40490109170b0853c39726dcf86f616ba34c7426c32695e1f4c410bf1891070a6f2af7b8769a0237be43f2ac1eb790cd0a2538b7559745feb3068

  • SSDEEP

    1536:oFQvcUbfQdtPOZd2T2WiH0Ab8d4O2240r9L0E9926Or/ttsXQGaSqQHn141Sbb6f:oFiv0iZdoU0Ab8dH2Or0r/6cQ14AboOM

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

  • Modifies firewall policy service 3 TTPs 6 IoCs
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

  • Sality family
  • UAC bypass 3 TTPs 2 IoCs
  • Windows security bypass 2 TTPs 12 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • Windows security modification 2 TTPs 14 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 15 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file 25 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs
  • System policy modification 1 TTPs 2 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1140
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1268
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
          PID:1360
          • C:\Windows\system32\rundll32.exe
            rundll32.exe C:\Users\Admin\AppData\Local\Temp\532867ce7cef0ee357fb5b58c45821745215db96c2eff8346977597c65ec5505.dll,#1
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2464
            • C:\Windows\SysWOW64\rundll32.exe
              rundll32.exe C:\Users\Admin\AppData\Local\Temp\532867ce7cef0ee357fb5b58c45821745215db96c2eff8346977597c65ec5505.dll,#1
              3⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2540
              • C:\Users\Admin\AppData\Local\Temp\f777a6d.exe
                C:\Users\Admin\AppData\Local\Temp\f777a6d.exe
                4⤵
                • Modifies firewall policy service
                • UAC bypass
                • Windows security bypass
                • Executes dropped EXE
                • Windows security modification
                • Checks whether UAC is enabled
                • Enumerates connected drives
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:2216
              • C:\Users\Admin\AppData\Local\Temp\f777c80.exe
                C:\Users\Admin\AppData\Local\Temp\f777c80.exe
                4⤵
                • Executes dropped EXE
                PID:3012
              • C:\Users\Admin\AppData\Local\Temp\f77981b.exe
                C:\Users\Admin\AppData\Local\Temp\f77981b.exe
                4⤵
                • Modifies firewall policy service
                • UAC bypass
                • Windows security bypass
                • Executes dropped EXE
                • Windows security modification
                • Checks whether UAC is enabled
                • Enumerates connected drives
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:696
        • C:\Windows\system32\DllHost.exe
          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
          1⤵
            PID:2036

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Windows\SYSTEM.INI

            Filesize

            257B

            MD5

            d04fb90f845eedb0f2a3e3a8fd746c0c

            SHA1

            4e244d61ed6d15be9af68cd86319b73925bfe9f2

            SHA256

            5b3b0e9883f33d5d65740724f2698ab0949b2e3b38ed245b0686d4f8357e3dcd

            SHA512

            dfd9120055ed08e70902b0ea92a45e90883738dfbed3020bb769a5a0b1066c1cb767aeb6283313fddd0cf6b60a76fb96633d6a375ab9b51e5e3fe7fee6361678

          • \Users\Admin\AppData\Local\Temp\f777a6d.exe

            Filesize

            97KB

            MD5

            e84f54d47b930ba8633255a2f9423817

            SHA1

            82fdb704d9a52e9264e71af31fd07a28edd1f85b

            SHA256

            8bfe4715bace15d37f82bac01e2a231ac09719a40a23c101a8f06bfe622ae563

            SHA512

            780d42e1fc6081ed617975a2d2f6302e5bd40108c4bede61d925d3f4a3d99fa55775027fffaab8052b2c15fcc97dcb52bacc0b7d33d7b850844c6ed3b3c58b3b

          • memory/696-199-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/696-200-0x0000000000900000-0x00000000019BA000-memory.dmp

            Filesize

            16.7MB

          • memory/696-174-0x0000000000900000-0x00000000019BA000-memory.dmp

            Filesize

            16.7MB

          • memory/696-153-0x0000000000220000-0x0000000000222000-memory.dmp

            Filesize

            8KB

          • memory/696-107-0x0000000000220000-0x0000000000222000-memory.dmp

            Filesize

            8KB

          • memory/696-108-0x00000000003F0000-0x00000000003F1000-memory.dmp

            Filesize

            4KB

          • memory/696-79-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/1140-23-0x00000000003C0000-0x00000000003C2000-memory.dmp

            Filesize

            8KB

          • memory/2216-87-0x00000000005D0000-0x000000000168A000-memory.dmp

            Filesize

            16.7MB

          • memory/2216-65-0x00000000005D0000-0x000000000168A000-memory.dmp

            Filesize

            16.7MB

          • memory/2216-10-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2216-17-0x00000000005D0000-0x000000000168A000-memory.dmp

            Filesize

            16.7MB

          • memory/2216-13-0x00000000005D0000-0x000000000168A000-memory.dmp

            Filesize

            16.7MB

          • memory/2216-149-0x00000000005D0000-0x000000000168A000-memory.dmp

            Filesize

            16.7MB

          • memory/2216-148-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2216-19-0x00000000005D0000-0x000000000168A000-memory.dmp

            Filesize

            16.7MB

          • memory/2216-16-0x00000000005D0000-0x000000000168A000-memory.dmp

            Filesize

            16.7MB

          • memory/2216-21-0x00000000005D0000-0x000000000168A000-memory.dmp

            Filesize

            16.7MB

          • memory/2216-15-0x00000000005D0000-0x000000000168A000-memory.dmp

            Filesize

            16.7MB

          • memory/2216-20-0x00000000005D0000-0x000000000168A000-memory.dmp

            Filesize

            16.7MB

          • memory/2216-14-0x00000000005D0000-0x000000000168A000-memory.dmp

            Filesize

            16.7MB

          • memory/2216-58-0x00000000040A0000-0x00000000040A2000-memory.dmp

            Filesize

            8KB

          • memory/2216-57-0x00000000040A0000-0x00000000040A2000-memory.dmp

            Filesize

            8KB

          • memory/2216-56-0x00000000041F0000-0x00000000041F1000-memory.dmp

            Filesize

            4KB

          • memory/2216-59-0x00000000005D0000-0x000000000168A000-memory.dmp

            Filesize

            16.7MB

          • memory/2216-61-0x00000000005D0000-0x000000000168A000-memory.dmp

            Filesize

            16.7MB

          • memory/2216-62-0x00000000005D0000-0x000000000168A000-memory.dmp

            Filesize

            16.7MB

          • memory/2216-63-0x00000000005D0000-0x000000000168A000-memory.dmp

            Filesize

            16.7MB

          • memory/2216-60-0x00000000005D0000-0x000000000168A000-memory.dmp

            Filesize

            16.7MB

          • memory/2216-18-0x00000000005D0000-0x000000000168A000-memory.dmp

            Filesize

            16.7MB

          • memory/2216-66-0x00000000005D0000-0x000000000168A000-memory.dmp

            Filesize

            16.7MB

          • memory/2216-85-0x00000000005D0000-0x000000000168A000-memory.dmp

            Filesize

            16.7MB

          • memory/2216-22-0x00000000005D0000-0x000000000168A000-memory.dmp

            Filesize

            16.7MB

          • memory/2216-80-0x00000000005D0000-0x000000000168A000-memory.dmp

            Filesize

            16.7MB

          • memory/2216-81-0x00000000005D0000-0x000000000168A000-memory.dmp

            Filesize

            16.7MB

          • memory/2216-84-0x00000000005D0000-0x000000000168A000-memory.dmp

            Filesize

            16.7MB

          • memory/2540-32-0x00000000001B0000-0x00000000001B1000-memory.dmp

            Filesize

            4KB

          • memory/2540-33-0x0000000000160000-0x0000000000162000-memory.dmp

            Filesize

            8KB

          • memory/2540-4-0x0000000000140000-0x0000000000152000-memory.dmp

            Filesize

            72KB

          • memory/2540-1-0x0000000010000000-0x0000000010020000-memory.dmp

            Filesize

            128KB

          • memory/2540-44-0x00000000006B0000-0x00000000006C2000-memory.dmp

            Filesize

            72KB

          • memory/2540-35-0x0000000000160000-0x0000000000162000-memory.dmp

            Filesize

            8KB

          • memory/2540-43-0x00000000006B0000-0x00000000006C2000-memory.dmp

            Filesize

            72KB

          • memory/2540-30-0x00000000001B0000-0x00000000001B1000-memory.dmp

            Filesize

            4KB

          • memory/2540-29-0x0000000000160000-0x0000000000162000-memory.dmp

            Filesize

            8KB

          • memory/2540-67-0x0000000000160000-0x0000000000162000-memory.dmp

            Filesize

            8KB

          • memory/3012-127-0x00000000003E0000-0x00000000003E2000-memory.dmp

            Filesize

            8KB

          • memory/3012-45-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/3012-99-0x00000000003E0000-0x00000000003E2000-memory.dmp

            Filesize

            8KB

          • memory/3012-100-0x00000000003E0000-0x00000000003E2000-memory.dmp

            Filesize

            8KB

          • memory/3012-98-0x00000000003F0000-0x00000000003F1000-memory.dmp

            Filesize

            4KB

          We care about your privacy.

          This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.