Analysis
-
max time kernel
97s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19-12-2024 01:54
General
-
Target
299b3dfc9d41ff8dbe0a24b7050643ce52a4dc7ddf87bc4f2e2599df371625a1N.dll
-
Size
499KB
-
MD5
cd2df999e549e34872df4aa7d62e4230
-
SHA1
3db06fe1f76bafa9ef1ef4c7e99a40e37a17f30e
-
SHA256
299b3dfc9d41ff8dbe0a24b7050643ce52a4dc7ddf87bc4f2e2599df371625a1
-
SHA512
31be85dafc6d3d35b96a89551c9a312671f8ac0fb632ae7f1b4867e27563847c3b8352ce6e55a3417cacb2f8870884b7019a93301c30eb394afb3f9e924d439b
-
SSDEEP
6144:P0IEu0/l7rUdoqWMvjcw3sWSAoITM+NPUHFWna2Wb8dzLSAHRI5je:u79qXvjRc5AoIY+NPUlWna8QD5q
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
-
Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
-
Ramnit family
-
Sality
Sality is backdoor written in C++, first discovered in 2003.
-
Sality family
-
UAC bypass 3 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 6 IoCs
-
Executes dropped EXE 2 IoCs
-
Windows security modification 2 TTPs 7 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
UPX packed file 16 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 3 IoCs
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 51 IoCs
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 31 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\299b3dfc9d41ff8dbe0a24b7050643ce52a4dc7ddf87bc4f2e2599df371625a1N.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\299b3dfc9d41ff8dbe0a24b7050643ce52a4dc7ddf87bc4f2e2599df371625a1N.dll,#12⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe5⤵
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:628 CREDAT:17410 /prefetch:26⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2280 CREDAT:17410 /prefetch:26⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
471B
MD55e99ec80bb4e60401972729dff7db4f2
SHA1a68a2f47614d8afd1b7afd1e0620d32cd393e2c0
SHA2566ac6e0c6b415580d28c082f0e59f45289379890a167c088a557d3e2578b424e0
SHA5127670c7e91ae9555458275effc570e107c9ae43b02e65f9200b773f9139dfe228faf55f5c4ac5d9d713d0231e16c129baf1c289534b42ac7b4d042f370240c654
-
Filesize
404B
MD5d7d9f25d266c0a5911e3fea8b3487f04
SHA15304bc43f8ab535ea8d81c914ef93984fb0af00c
SHA256baa2a1a17df5b65fcb49fb82aed1915a411f0aec49a96c72ea0d781b56ccfa0d
SHA5124746de3cbfa52051426522569fb22764926c1ee1455be6d693b982faa81569f053e00835cd594b0cd0f7e5621fe9c72d4fbefb539f0c0b08ba93cdcb913d8c80
-
Filesize
404B
MD5f16e578f5ec12383b7814ef659822dab
SHA1b41bb3d170513ea13c3185626d76a9998acce770
SHA25664ecb4d9fa01ffb86635064fd8b30c37ce137d5e7f90854d09586679cb418da7
SHA512ebaa540b9e7f7c3bb855fd4753ff71efa49886dab8c20151bd027e8a67a994e8582977cf3c5d7b2856cda8f51adcc1633d82a67506b63ec6b91d3091c4063a50
-
Filesize
5KB
MD5091bd80c2453e6615922c4eee9dc134b
SHA123dacdb9b6637e57a9c06930bcbba87a32cbb398
SHA2563ecd712b35eedbf5d44efe601376ae27e30081c73e847aeb8a5dddcce815a578
SHA512751b27cfc3640f81232e6da4d7a8d0c75fc3ce587d7c689aa5bbfe8ff0a84a61c697dbff0eb925241dd4e11bc4dc5cce62b5a7a65479e89fa08c8461914996b4
-
Filesize
3KB
MD501057a645753d936f102de82dd4248a6
SHA1379a6cc2bfd81b2a378fc62c4e227146a3d94b4e
SHA2565f3c66c274786710abb7aa6e4c51303e568c3245d3bb57db66d8f2f53e41f4ef
SHA5127c94702286f3dbd2bf2e1190011e7bc3d062297dbb3a4396e4e2099383c11bd7caacfdb728f2772a680cb082995cd091e26924a1ce22f125f90fdb426d16972a
-
Filesize
15KB
MD51a545d0052b581fbb2ab4c52133846bc
SHA162f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
164KB
MD5a3b1f1c4cd75bea10095e054f990bf1d
SHA115bf037b2166d2533e12bbec9f1d5f9a3ad8c81b
SHA256a4c51942f696650a7ce0530a88c3742380ac82bc1ddc75c24d1417f0958caaee
SHA5127457591c9676baa6043e4c3ae6ede364f19964c4e4e6a91a06e148221402791cabf9d5ab2bfcb629120ab136fee0a2994c0830f7cbfb112c5c6b07109b6a1a94
-
Filesize
524KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
132KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
208KB
-
Filesize
132KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
40KB
-
Filesize
84KB
-
Filesize
132KB
-
Filesize
16.6MB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
208KB