Analysis
-
max time kernel
27s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 20:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2b0318b4bfadf0d1a494368a27e7a93bc6ec522a82a204622f9dae4583d3abb1N.dll
Resource
win7-20240903-en
windows7-x64
17 signatures
120 seconds
General
-
Target
2b0318b4bfadf0d1a494368a27e7a93bc6ec522a82a204622f9dae4583d3abb1N.dll
-
Size
120KB
-
MD5
18ca82300bbcd4d802173cda39e19770
-
SHA1
9938224c70b6f45d5c69c95f92c573099564b101
-
SHA256
2b0318b4bfadf0d1a494368a27e7a93bc6ec522a82a204622f9dae4583d3abb1
-
SHA512
a29abbad20f0a85c361882f9ec6614e81b287d792e17fbacebb556c31d5ef115018f95054b7db06285ba34656e976d3bbf88982f03c38aeb40383fbf0a2d4357
-
SSDEEP
3072:0LPJUKLLRjZhr6RwwdXOWEe/+91eGHrfa:09U2LXhrFaEnfjTa
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76bc5d.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76bac7.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76bac7.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76bac7.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76bc5d.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76bc5d.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76bac7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76bc5d.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76bac7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76bc5d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76bc5d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76bac7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76bac7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76bac7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76bac7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76bc5d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76bc5d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76bc5d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76bc5d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76bac7.exe -
Executes dropped EXE 3 IoCs
pid Process 2192 f76bac7.exe 2984 f76bc5d.exe 2736 f76d671.exe -
Loads dropped DLL 6 IoCs
pid Process 2120 rundll32.exe 2120 rundll32.exe 2120 rundll32.exe 2120 rundll32.exe 2120 rundll32.exe 2120 rundll32.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76bac7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76bc5d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76bc5d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76bac7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76bc5d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76bc5d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76bac7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76bac7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76bc5d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76bc5d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76bac7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76bac7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76bac7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76bc5d.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76bac7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76bc5d.exe -
Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: f76bac7.exe File opened (read-only) \??\M: f76bac7.exe File opened (read-only) \??\P: f76bac7.exe File opened (read-only) \??\Q: f76bac7.exe File opened (read-only) \??\J: f76bac7.exe File opened (read-only) \??\O: f76bac7.exe File opened (read-only) \??\R: f76bac7.exe File opened (read-only) \??\T: f76bac7.exe File opened (read-only) \??\G: f76bac7.exe File opened (read-only) \??\K: f76bac7.exe File opened (read-only) \??\S: f76bac7.exe File opened (read-only) \??\E: f76bac7.exe File opened (read-only) \??\H: f76bac7.exe File opened (read-only) \??\L: f76bac7.exe File opened (read-only) \??\N: f76bac7.exe -
resource yara_rule behavioral1/memory/2192-11-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2192-14-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2192-17-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2192-19-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2192-20-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2192-18-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2192-16-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2192-15-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2192-13-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2192-21-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2192-59-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2192-60-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2192-61-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2192-62-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2192-63-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2192-65-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2192-66-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2192-82-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2192-83-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2192-87-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2192-152-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2984-184-0x00000000009C0000-0x0000000001A7A000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\f76bb44 f76bac7.exe File opened for modification C:\Windows\SYSTEM.INI f76bac7.exe File created C:\Windows\f770af9 f76bc5d.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76bac7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76bc5d.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2192 f76bac7.exe 2192 f76bac7.exe 2984 f76bc5d.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 2192 f76bac7.exe Token: SeDebugPrivilege 2192 f76bac7.exe Token: SeDebugPrivilege 2192 f76bac7.exe Token: SeDebugPrivilege 2192 f76bac7.exe Token: SeDebugPrivilege 2192 f76bac7.exe Token: SeDebugPrivilege 2192 f76bac7.exe Token: SeDebugPrivilege 2192 f76bac7.exe Token: SeDebugPrivilege 2192 f76bac7.exe Token: SeDebugPrivilege 2192 f76bac7.exe Token: SeDebugPrivilege 2192 f76bac7.exe Token: SeDebugPrivilege 2192 f76bac7.exe Token: SeDebugPrivilege 2192 f76bac7.exe Token: SeDebugPrivilege 2192 f76bac7.exe Token: SeDebugPrivilege 2192 f76bac7.exe Token: SeDebugPrivilege 2192 f76bac7.exe Token: SeDebugPrivilege 2192 f76bac7.exe Token: SeDebugPrivilege 2192 f76bac7.exe Token: SeDebugPrivilege 2192 f76bac7.exe Token: SeDebugPrivilege 2192 f76bac7.exe Token: SeDebugPrivilege 2192 f76bac7.exe Token: SeDebugPrivilege 2192 f76bac7.exe Token: SeDebugPrivilege 2192 f76bac7.exe Token: SeDebugPrivilege 2192 f76bac7.exe Token: SeDebugPrivilege 2192 f76bac7.exe Token: SeDebugPrivilege 2984 f76bc5d.exe Token: SeDebugPrivilege 2984 f76bc5d.exe Token: SeDebugPrivilege 2984 f76bc5d.exe Token: SeDebugPrivilege 2984 f76bc5d.exe Token: SeDebugPrivilege 2984 f76bc5d.exe Token: SeDebugPrivilege 2984 f76bc5d.exe Token: SeDebugPrivilege 2984 f76bc5d.exe Token: SeDebugPrivilege 2984 f76bc5d.exe Token: SeDebugPrivilege 2984 f76bc5d.exe Token: SeDebugPrivilege 2984 f76bc5d.exe Token: SeDebugPrivilege 2984 f76bc5d.exe Token: SeDebugPrivilege 2984 f76bc5d.exe Token: SeDebugPrivilege 2984 f76bc5d.exe Token: SeDebugPrivilege 2984 f76bc5d.exe Token: SeDebugPrivilege 2984 f76bc5d.exe Token: SeDebugPrivilege 2984 f76bc5d.exe Token: SeDebugPrivilege 2984 f76bc5d.exe Token: SeDebugPrivilege 2984 f76bc5d.exe Token: SeDebugPrivilege 2984 f76bc5d.exe Token: SeDebugPrivilege 2984 f76bc5d.exe Token: SeDebugPrivilege 2984 f76bc5d.exe Token: SeDebugPrivilege 2984 f76bc5d.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2908 wrote to memory of 2120 2908 rundll32.exe 30 PID 2908 wrote to memory of 2120 2908 rundll32.exe 30 PID 2908 wrote to memory of 2120 2908 rundll32.exe 30 PID 2908 wrote to memory of 2120 2908 rundll32.exe 30 PID 2908 wrote to memory of 2120 2908 rundll32.exe 30 PID 2908 wrote to memory of 2120 2908 rundll32.exe 30 PID 2908 wrote to memory of 2120 2908 rundll32.exe 30 PID 2120 wrote to memory of 2192 2120 rundll32.exe 31 PID 2120 wrote to memory of 2192 2120 rundll32.exe 31 PID 2120 wrote to memory of 2192 2120 rundll32.exe 31 PID 2120 wrote to memory of 2192 2120 rundll32.exe 31 PID 2192 wrote to memory of 1108 2192 f76bac7.exe 19 PID 2192 wrote to memory of 1176 2192 f76bac7.exe 20 PID 2192 wrote to memory of 1208 2192 f76bac7.exe 21 PID 2192 wrote to memory of 1580 2192 f76bac7.exe 25 PID 2192 wrote to memory of 2908 2192 f76bac7.exe 29 PID 2192 wrote to memory of 2120 2192 f76bac7.exe 30 PID 2192 wrote to memory of 2120 2192 f76bac7.exe 30 PID 2120 wrote to memory of 2984 2120 rundll32.exe 32 PID 2120 wrote to memory of 2984 2120 rundll32.exe 32 PID 2120 wrote to memory of 2984 2120 rundll32.exe 32 PID 2120 wrote to memory of 2984 2120 rundll32.exe 32 PID 2120 wrote to memory of 2736 2120 rundll32.exe 34 PID 2120 wrote to memory of 2736 2120 rundll32.exe 34 PID 2120 wrote to memory of 2736 2120 rundll32.exe 34 PID 2120 wrote to memory of 2736 2120 rundll32.exe 34 PID 2192 wrote to memory of 1108 2192 f76bac7.exe 19 PID 2192 wrote to memory of 1176 2192 f76bac7.exe 20 PID 2192 wrote to memory of 1208 2192 f76bac7.exe 21 PID 2192 wrote to memory of 1580 2192 f76bac7.exe 25 PID 2192 wrote to memory of 2984 2192 f76bac7.exe 32 PID 2192 wrote to memory of 2984 2192 f76bac7.exe 32 PID 2192 wrote to memory of 2736 2192 f76bac7.exe 34 PID 2192 wrote to memory of 2736 2192 f76bac7.exe 34 PID 2984 wrote to memory of 1108 2984 f76bc5d.exe 19 PID 2984 wrote to memory of 1176 2984 f76bc5d.exe 20 PID 2984 wrote to memory of 1208 2984 f76bc5d.exe 21 PID 2984 wrote to memory of 1580 2984 f76bc5d.exe 25 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76bc5d.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76bac7.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1108
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1176
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1208
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b0318b4bfadf0d1a494368a27e7a93bc6ec522a82a204622f9dae4583d3abb1N.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2b0318b4bfadf0d1a494368a27e7a93bc6ec522a82a204622f9dae4583d3abb1N.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\f76bac7.exeC:\Users\Admin\AppData\Local\Temp\f76bac7.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2192
-
-
C:\Users\Admin\AppData\Local\Temp\f76bc5d.exeC:\Users\Admin\AppData\Local\Temp\f76bc5d.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2984
-
-
C:\Users\Admin\AppData\Local\Temp\f76d671.exeC:\Users\Admin\AppData\Local\Temp\f76d671.exe4⤵
- Executes dropped EXE
PID:2736
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1580
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD5225c3e688db1b29873a5989c3c41fad6
SHA1551a4dabe5a89cd90cf0d5ab38a65ebd60e47a61
SHA256dd57d77825daa0c02515be275d72e8f190532e25c008d08845860fa9e1b6039c
SHA5123cb034eaca2d66df39e847ae0ea6efb43006c584387a4211a0612fae1bdf88ba36368ad67e1a420452ed0850af566050a861ed9050749c2a682a9c050b52e1e3
-
Filesize
97KB
MD59356280b1342021b1b3c703d8cfc1f2a
SHA103897605fedda547f286cbb353295ec5843d4afd
SHA256eb4ce6a26e0939a2ae4bd76403af6e9265e2112ef05645c0fd23408781fdff03
SHA512b82cce7dba342ab88a6a10e26deb11ab873edb7670c343e851df155db1d4c74e0deb5d5dcf2984936a9cc3932c79b88281fe1f4ee2f2d3de6113cd8fdcd4c8cb