Analysis

  • max time kernel
    22s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-12-2024 05:25

General

  • Target

    e40cc7939dececa4d20d83280b97728059cfc444ac9de3c0ff4d1671ab6490f6.exe

  • Size

    1.1MB

  • MD5

    b2aec7ae0a095e59c8b98f9530302032

  • SHA1

    6007183f50375304a1465fd71cdb6d5dfd667209

  • SHA256

    e40cc7939dececa4d20d83280b97728059cfc444ac9de3c0ff4d1671ab6490f6

  • SHA512

    8226b09709b5744826bc6b57a07065952bf7e2af6687d330e3105c78f3d647b6da1def3afe453c7308de4304b64edc7b17842f26847f6887664c8b4222915147

  • SSDEEP

    24576:W1/aGLDCM4D8ayGMCPnXo8/4gflI2d+JdjyW:FD8ayGM0XoQr2jyW

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

http://klkjwre77638dfqwieuoi888.info/

Signatures

  • Modifies firewall policy service 3 TTPs 6 IoCs
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

  • Sality family
  • UAC bypass 3 TTPs 2 IoCs
  • Windows security bypass 2 TTPs 12 IoCs
  • Disables RegEdit via registry modification 2 IoCs
  • Disables Task Manager via registry modification
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Windows security modification 2 TTPs 14 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • UPX packed file 39 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs
  • System policy modification 1 TTPs 2 IoCs

Processes

  • C:\Windows\system32\fontdrvhost.exe
    "fontdrvhost.exe"
    1⤵
      PID:776
    • C:\Windows\system32\fontdrvhost.exe
      "fontdrvhost.exe"
      1⤵
        PID:780
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        1⤵
          PID:336
        • C:\Windows\system32\sihost.exe
          sihost.exe
          1⤵
            PID:2648
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
            1⤵
              PID:2660
            • C:\Windows\system32\taskhostw.exe
              taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
              1⤵
                PID:2892
              • C:\Windows\Explorer.EXE
                C:\Windows\Explorer.EXE
                1⤵
                  PID:3424
                  • C:\Users\Admin\AppData\Local\Temp\e40cc7939dececa4d20d83280b97728059cfc444ac9de3c0ff4d1671ab6490f6.exe
                    "C:\Users\Admin\AppData\Local\Temp\e40cc7939dececa4d20d83280b97728059cfc444ac9de3c0ff4d1671ab6490f6.exe"
                    2⤵
                    • Modifies firewall policy service
                    • UAC bypass
                    • Windows security bypass
                    • Disables RegEdit via registry modification
                    • Windows security modification
                    • Checks whether UAC is enabled
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    • System policy modification
                    PID:1780
                    • C:\ProgramData\buchxa.exe
                      "C:\ProgramData\buchxa.exe"
                      3⤵
                      • Modifies firewall policy service
                      • UAC bypass
                      • Windows security bypass
                      • Disables RegEdit via registry modification
                      • Deletes itself
                      • Executes dropped EXE
                      • Windows security modification
                      • Adds Run key to start application
                      • Checks whether UAC is enabled
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of WriteProcessMemory
                      • System policy modification
                      PID:2340
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                  1⤵
                    PID:3544
                  • C:\Windows\system32\DllHost.exe
                    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                    1⤵
                      PID:3732
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:3824
                      • C:\Windows\System32\RuntimeBroker.exe
                        C:\Windows\System32\RuntimeBroker.exe -Embedding
                        1⤵
                          PID:3884
                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                          1⤵
                            PID:3964
                          • C:\Windows\System32\RuntimeBroker.exe
                            C:\Windows\System32\RuntimeBroker.exe -Embedding
                            1⤵
                              PID:4132
                            • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
                              "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
                              1⤵
                                PID:4956
                              • C:\Windows\System32\RuntimeBroker.exe
                                C:\Windows\System32\RuntimeBroker.exe -Embedding
                                1⤵
                                  PID:4844

                                Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Documents and Settings .exe

                                  Filesize

                                  1.1MB

                                  MD5

                                  1938e2a2b51a5cedbc9d39ace65b6dc8

                                  SHA1

                                  371721098abad9f8bc0806ed276937aecba3b1c8

                                  SHA256

                                  9583ad1c5311bf46c6f666fc48c3f6f3eec5b028b396685855f4402c8639e1f9

                                  SHA512

                                  c7698fce37667b389607095d895dae9f20811e55c6d78d8e1dcc5adc96a85c9b3717a89a6f1d8771626c65734987e75d5a64a023808f085b057fd98a281f4fac

                                • C:\ProgramData\Saaaalamm\Mira.h

                                  Filesize

                                  557KB

                                  MD5

                                  6f1656028d98fceaa83d9b6f8cc5459d

                                  SHA1

                                  7f2e990ad5347f6613683e7efa86f08ebfa9f4a6

                                  SHA256

                                  2121af2516f030cebfd88efb6b6c195ecc4573cdbc79595253af54970a0a8a9a

                                  SHA512

                                  cc0ede5bd411363d4f6a81e20521af15865decedbfb539702744f8cafc2087533a513f4a7541cb0eb3447411397cd042d00232e9d091a97e09043711379ce71e

                                • C:\ProgramData\buchxa.exe

                                  Filesize

                                  522KB

                                  MD5

                                  318d4f757e922729439b606c56c46021

                                  SHA1

                                  85b2be3c4b7a0dd0e75fd85af99b4c0e0cbdf8d9

                                  SHA256

                                  14229717397fe1d55655578a1228f4bdcd7a340c3df458ebd9749f2d2fa76ccf

                                  SHA512

                                  14904938961760a5682814f821fa57402e4db879d5d79f1ba08a211f2b6df9c58c3d3d275e63460b94012ff1b95f7f23e5de6a469829433fb44cf932c200953c

                                • C:\Windows\SYSTEM.INI

                                  Filesize

                                  257B

                                  MD5

                                  c275db4e6434e0a2ffcb7e4a2ce918aa

                                  SHA1

                                  faa5d0cc27b7c324ab0de7f74e34e61d3aa49624

                                  SHA256

                                  f456d753ccdec50d7e6ff4a00e7762b12e89557f939e90041f5d7382936095a1

                                  SHA512

                                  88c79bb3f531f7dac790d04839ddcc30a78995754cefc0bb78f866d64447a1617a7871076e44c4f983c9249be0646cc844920d81f96d5f37faa9f12ce0faab63

                                • memory/1780-9-0x0000000000710000-0x0000000000711000-memory.dmp

                                  Filesize

                                  4KB

                                • memory/1780-6-0x0000000002610000-0x000000000369E000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/1780-13-0x0000000002610000-0x000000000369E000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/1780-14-0x0000000000700000-0x0000000000702000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/1780-10-0x0000000002610000-0x000000000369E000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/1780-11-0x0000000000700000-0x0000000000702000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/1780-0-0x0000000000400000-0x0000000000462000-memory.dmp

                                  Filesize

                                  392KB

                                • memory/1780-15-0x0000000002610000-0x000000000369E000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/1780-8-0x0000000000700000-0x0000000000702000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/1780-12-0x0000000002610000-0x000000000369E000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/1780-7-0x0000000002610000-0x000000000369E000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/1780-26-0x0000000000700000-0x0000000000702000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/1780-3-0x0000000002610000-0x000000000369E000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/1780-35-0x0000000000400000-0x0000000000462000-memory.dmp

                                  Filesize

                                  392KB

                                • memory/1780-24-0x0000000002610000-0x000000000369E000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/1780-5-0x0000000002610000-0x000000000369E000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/1780-4-0x0000000002610000-0x000000000369E000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/1780-1-0x0000000002610000-0x000000000369E000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/2340-134-0x0000000002640000-0x00000000036CE000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/2340-175-0x0000000002640000-0x00000000036CE000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/2340-128-0x0000000002640000-0x00000000036CE000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/2340-133-0x0000000002640000-0x00000000036CE000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/2340-130-0x0000000002640000-0x00000000036CE000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/2340-127-0x0000000000400000-0x0000000000459000-memory.dmp

                                  Filesize

                                  356KB

                                • memory/2340-131-0x0000000002640000-0x00000000036CE000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/2340-22-0x0000000000400000-0x0000000000459000-memory.dmp

                                  Filesize

                                  356KB

                                • memory/2340-142-0x0000000000A80000-0x0000000000A82000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/2340-137-0x0000000002640000-0x00000000036CE000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/2340-141-0x0000000000A80000-0x0000000000A82000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/2340-136-0x0000000002640000-0x00000000036CE000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/2340-135-0x0000000002640000-0x00000000036CE000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/2340-140-0x0000000004F50000-0x0000000004F51000-memory.dmp

                                  Filesize

                                  4KB

                                • memory/2340-138-0x0000000002640000-0x00000000036CE000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/2340-144-0x0000000002640000-0x00000000036CE000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/2340-143-0x0000000002640000-0x00000000036CE000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/2340-132-0x0000000002640000-0x00000000036CE000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/2340-176-0x0000000002640000-0x00000000036CE000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/2340-180-0x0000000002640000-0x00000000036CE000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/2340-215-0x0000000002640000-0x00000000036CE000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/2340-216-0x0000000002640000-0x00000000036CE000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/2340-221-0x0000000002640000-0x00000000036CE000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/2340-222-0x0000000002640000-0x00000000036CE000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/2340-256-0x0000000002640000-0x00000000036CE000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/2340-257-0x0000000002640000-0x00000000036CE000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/2340-261-0x0000000000A80000-0x0000000000A82000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/2340-262-0x0000000002640000-0x00000000036CE000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/2340-266-0x0000000002640000-0x00000000036CE000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/2340-267-0x0000000000400000-0x0000000000459000-memory.dmp

                                  Filesize

                                  356KB

                                • memory/2340-269-0x0000000002640000-0x00000000036CE000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/2340-305-0x0000000002640000-0x00000000036CE000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/2340-307-0x0000000002640000-0x00000000036CE000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/2340-309-0x0000000002640000-0x00000000036CE000-memory.dmp

                                  Filesize

                                  16.6MB

                                • memory/2340-341-0x0000000002640000-0x00000000036CE000-memory.dmp

                                  Filesize

                                  16.6MB