Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-12-2024 04:58
Static task
static1
Behavioral task
behavioral1
Sample
e57afc723567408d1a3a99e0c95475316bcf83440fd8944e6730c5b95b43efbfN.dll
Resource
win7-20240903-en
General
-
Target
e57afc723567408d1a3a99e0c95475316bcf83440fd8944e6730c5b95b43efbfN.dll
-
Size
120KB
-
MD5
189e5e2b0c3a9cfeec4de5d51c1ec800
-
SHA1
186316d59086dba9363fcdef5c4c5b079301e1dd
-
SHA256
e57afc723567408d1a3a99e0c95475316bcf83440fd8944e6730c5b95b43efbf
-
SHA512
5112b7ecd7e1db1c9cc2fe09d995dddf492895f24afad10657265b69c2f9cfbeb87c26737a71d3e319798f13f74c574b573c045204312a3b48555a6a06d3969c
-
SSDEEP
3072:QwXxdeSh8VLtbpXiJSgDn1APxNVlU2Ud7ueRaVIl:voShubpX0peZNvLUdSeo
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76c0cf.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76c0cf.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76bf1b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76bf1b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76bf1b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76c0cf.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76bf1b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76c0cf.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76bf1b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76c0cf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76c0cf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76c0cf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76c0cf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76bf1b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76bf1b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76bf1b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76c0cf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76bf1b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76bf1b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76c0cf.exe -
Executes dropped EXE 3 IoCs
pid Process 2136 f76bf1b.exe 2976 f76c0cf.exe 3068 f76dd64.exe -
Loads dropped DLL 6 IoCs
pid Process 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76c0cf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76c0cf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76bf1b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76bf1b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76c0cf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76c0cf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76c0cf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76c0cf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76bf1b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76bf1b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76bf1b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76bf1b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76bf1b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76c0cf.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76bf1b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76c0cf.exe -
Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: f76bf1b.exe File opened (read-only) \??\Q: f76bf1b.exe File opened (read-only) \??\E: f76bf1b.exe File opened (read-only) \??\I: f76bf1b.exe File opened (read-only) \??\N: f76bf1b.exe File opened (read-only) \??\S: f76bf1b.exe File opened (read-only) \??\H: f76bf1b.exe File opened (read-only) \??\K: f76bf1b.exe File opened (read-only) \??\O: f76bf1b.exe File opened (read-only) \??\R: f76bf1b.exe File opened (read-only) \??\J: f76bf1b.exe File opened (read-only) \??\M: f76bf1b.exe File opened (read-only) \??\P: f76bf1b.exe File opened (read-only) \??\T: f76bf1b.exe File opened (read-only) \??\G: f76bf1b.exe -
resource yara_rule behavioral1/memory/2136-18-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2136-21-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2136-24-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2136-20-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2136-23-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2136-25-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2136-22-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2136-19-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2136-17-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2136-26-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2136-64-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2136-66-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2136-65-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2136-67-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2136-68-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2136-70-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2136-71-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2136-74-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2136-72-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2136-88-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2136-90-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2136-110-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2136-157-0x0000000000960000-0x0000000001A1A000-memory.dmp upx behavioral1/memory/2976-165-0x0000000000900000-0x00000000019BA000-memory.dmp upx behavioral1/memory/2976-195-0x0000000000900000-0x00000000019BA000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\f76bf78 f76bf1b.exe File opened for modification C:\Windows\SYSTEM.INI f76bf1b.exe File created C:\Windows\f770f9a f76c0cf.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76bf1b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76c0cf.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2136 f76bf1b.exe 2136 f76bf1b.exe 2976 f76c0cf.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 2136 f76bf1b.exe Token: SeDebugPrivilege 2136 f76bf1b.exe Token: SeDebugPrivilege 2136 f76bf1b.exe Token: SeDebugPrivilege 2136 f76bf1b.exe Token: SeDebugPrivilege 2136 f76bf1b.exe Token: SeDebugPrivilege 2136 f76bf1b.exe Token: SeDebugPrivilege 2136 f76bf1b.exe Token: SeDebugPrivilege 2136 f76bf1b.exe Token: SeDebugPrivilege 2136 f76bf1b.exe Token: SeDebugPrivilege 2136 f76bf1b.exe Token: SeDebugPrivilege 2136 f76bf1b.exe Token: SeDebugPrivilege 2136 f76bf1b.exe Token: SeDebugPrivilege 2136 f76bf1b.exe Token: SeDebugPrivilege 2136 f76bf1b.exe Token: SeDebugPrivilege 2136 f76bf1b.exe Token: SeDebugPrivilege 2136 f76bf1b.exe Token: SeDebugPrivilege 2136 f76bf1b.exe Token: SeDebugPrivilege 2136 f76bf1b.exe Token: SeDebugPrivilege 2136 f76bf1b.exe Token: SeDebugPrivilege 2136 f76bf1b.exe Token: SeDebugPrivilege 2136 f76bf1b.exe Token: SeDebugPrivilege 2136 f76bf1b.exe Token: SeDebugPrivilege 2136 f76bf1b.exe Token: SeDebugPrivilege 2136 f76bf1b.exe Token: SeDebugPrivilege 2976 f76c0cf.exe Token: SeDebugPrivilege 2976 f76c0cf.exe Token: SeDebugPrivilege 2976 f76c0cf.exe Token: SeDebugPrivilege 2976 f76c0cf.exe Token: SeDebugPrivilege 2976 f76c0cf.exe Token: SeDebugPrivilege 2976 f76c0cf.exe Token: SeDebugPrivilege 2976 f76c0cf.exe Token: SeDebugPrivilege 2976 f76c0cf.exe Token: SeDebugPrivilege 2976 f76c0cf.exe Token: SeDebugPrivilege 2976 f76c0cf.exe Token: SeDebugPrivilege 2976 f76c0cf.exe Token: SeDebugPrivilege 2976 f76c0cf.exe Token: SeDebugPrivilege 2976 f76c0cf.exe Token: SeDebugPrivilege 2976 f76c0cf.exe Token: SeDebugPrivilege 2976 f76c0cf.exe Token: SeDebugPrivilege 2976 f76c0cf.exe Token: SeDebugPrivilege 2976 f76c0cf.exe Token: SeDebugPrivilege 2976 f76c0cf.exe Token: SeDebugPrivilege 2976 f76c0cf.exe Token: SeDebugPrivilege 2976 f76c0cf.exe Token: SeDebugPrivilege 2976 f76c0cf.exe Token: SeDebugPrivilege 2976 f76c0cf.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 1152 wrote to memory of 2680 1152 rundll32.exe 30 PID 1152 wrote to memory of 2680 1152 rundll32.exe 30 PID 1152 wrote to memory of 2680 1152 rundll32.exe 30 PID 1152 wrote to memory of 2680 1152 rundll32.exe 30 PID 1152 wrote to memory of 2680 1152 rundll32.exe 30 PID 1152 wrote to memory of 2680 1152 rundll32.exe 30 PID 1152 wrote to memory of 2680 1152 rundll32.exe 30 PID 2680 wrote to memory of 2136 2680 rundll32.exe 31 PID 2680 wrote to memory of 2136 2680 rundll32.exe 31 PID 2680 wrote to memory of 2136 2680 rundll32.exe 31 PID 2680 wrote to memory of 2136 2680 rundll32.exe 31 PID 2136 wrote to memory of 1100 2136 f76bf1b.exe 19 PID 2136 wrote to memory of 1156 2136 f76bf1b.exe 20 PID 2136 wrote to memory of 1204 2136 f76bf1b.exe 21 PID 2136 wrote to memory of 1664 2136 f76bf1b.exe 25 PID 2136 wrote to memory of 1152 2136 f76bf1b.exe 29 PID 2136 wrote to memory of 2680 2136 f76bf1b.exe 30 PID 2136 wrote to memory of 2680 2136 f76bf1b.exe 30 PID 2680 wrote to memory of 2976 2680 rundll32.exe 32 PID 2680 wrote to memory of 2976 2680 rundll32.exe 32 PID 2680 wrote to memory of 2976 2680 rundll32.exe 32 PID 2680 wrote to memory of 2976 2680 rundll32.exe 32 PID 2680 wrote to memory of 3068 2680 rundll32.exe 34 PID 2680 wrote to memory of 3068 2680 rundll32.exe 34 PID 2680 wrote to memory of 3068 2680 rundll32.exe 34 PID 2680 wrote to memory of 3068 2680 rundll32.exe 34 PID 2136 wrote to memory of 1100 2136 f76bf1b.exe 19 PID 2136 wrote to memory of 1156 2136 f76bf1b.exe 20 PID 2136 wrote to memory of 1204 2136 f76bf1b.exe 21 PID 2136 wrote to memory of 1664 2136 f76bf1b.exe 25 PID 2136 wrote to memory of 2976 2136 f76bf1b.exe 32 PID 2136 wrote to memory of 2976 2136 f76bf1b.exe 32 PID 2136 wrote to memory of 3068 2136 f76bf1b.exe 34 PID 2136 wrote to memory of 3068 2136 f76bf1b.exe 34 PID 2976 wrote to memory of 1100 2976 f76c0cf.exe 19 PID 2976 wrote to memory of 1156 2976 f76c0cf.exe 20 PID 2976 wrote to memory of 1204 2976 f76c0cf.exe 21 PID 2976 wrote to memory of 1664 2976 f76c0cf.exe 25 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76bf1b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76c0cf.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1100
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1156
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1204
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e57afc723567408d1a3a99e0c95475316bcf83440fd8944e6730c5b95b43efbfN.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e57afc723567408d1a3a99e0c95475316bcf83440fd8944e6730c5b95b43efbfN.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\f76bf1b.exeC:\Users\Admin\AppData\Local\Temp\f76bf1b.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2136
-
-
C:\Users\Admin\AppData\Local\Temp\f76c0cf.exeC:\Users\Admin\AppData\Local\Temp\f76c0cf.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2976
-
-
C:\Users\Admin\AppData\Local\Temp\f76dd64.exeC:\Users\Admin\AppData\Local\Temp\f76dd64.exe4⤵
- Executes dropped EXE
PID:3068
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1664
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD59fb3842339f464471a1f403a4952d479
SHA169d0c23ae11aff790268339335fa1a36a26391c5
SHA2567d488a5d4271ba99016ff6cd9e3427dd4fc2fd29221a34f5d987d184ae6c5d76
SHA512c77a514e65decbd322e6b0b876ff1fd08724c3b7c8e02b3596480533f5b770f85790527bb1f0508146e7512383fc863727a38dccf040dabaddf9b5aa4128a682
-
Filesize
257B
MD5cb8f8772c0fd2b425d98de0d474008f9
SHA198e94fa109c8a9f03af0c4cf768ed2d24ac94870
SHA256a55bb1f574e2eb476d8830d8f5fb12ff6005d51451b960b5033137bb39c12d39
SHA512f7b9e1baeaa6382f518ffbbfe1ef62476da1fc7b11538ce0408b6ad6943e48e3fb60df3bfcfee88c2cd8680c82100d49ca41e65ddfbe4535d1a9c997b6a4c685