Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-12-2024 05:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cb370f9859087a218ad0325120e8a7bf4fbc178041a0b84f2ea34ea92ef7fda0.dll
Resource
win7-20240903-en
windows7-x64
17 signatures
120 seconds
General
-
Target
cb370f9859087a218ad0325120e8a7bf4fbc178041a0b84f2ea34ea92ef7fda0.dll
-
Size
120KB
-
MD5
035358a6066e22b842f07e71f9f78467
-
SHA1
a0b764758534a4040de67a990603c55f1c13fc44
-
SHA256
cb370f9859087a218ad0325120e8a7bf4fbc178041a0b84f2ea34ea92ef7fda0
-
SHA512
5eab041dca35ba014b003c113495ad7c0bd971f48535e4d44bcfd11ddc791131027b7ca0930f2240484696ec49ebaa4cec89374263ad8130175cc1f7241fec1c
-
SSDEEP
1536:oumhzdYs6OaIdVToI5l4OfA5ErhL8r6fRPFt1UAd/HZaBPNlAzxc0oK7ZzqDJxoZ:otNaIduO45Elm6fj9ClASAFu0Z
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f7696e3.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f7696e3.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f7698a7.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f7698a7.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f7698a7.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f7696e3.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7696e3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7698a7.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7698a7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7698a7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7698a7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7696e3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7696e3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7696e3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7696e3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7696e3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7696e3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7698a7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7698a7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7698a7.exe -
Executes dropped EXE 3 IoCs
pid Process 1680 f7696e3.exe 2944 f7698a7.exe 1044 f76b50d.exe -
Loads dropped DLL 6 IoCs
pid Process 2380 rundll32.exe 2380 rundll32.exe 2380 rundll32.exe 2380 rundll32.exe 2380 rundll32.exe 2380 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7696e3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7698a7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f7696e3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7698a7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7698a7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7696e3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f7696e3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f7698a7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f7698a7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f7696e3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7696e3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f7696e3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f7698a7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f7698a7.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7696e3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7698a7.exe -
Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: f7696e3.exe File opened (read-only) \??\K: f7696e3.exe File opened (read-only) \??\L: f7696e3.exe File opened (read-only) \??\M: f7696e3.exe File opened (read-only) \??\O: f7696e3.exe File opened (read-only) \??\R: f7696e3.exe File opened (read-only) \??\N: f7696e3.exe File opened (read-only) \??\S: f7696e3.exe File opened (read-only) \??\G: f7696e3.exe File opened (read-only) \??\I: f7696e3.exe File opened (read-only) \??\P: f7696e3.exe File opened (read-only) \??\T: f7696e3.exe File opened (read-only) \??\E: f7696e3.exe File opened (read-only) \??\H: f7696e3.exe File opened (read-only) \??\Q: f7696e3.exe -
resource yara_rule behavioral1/memory/1680-12-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/1680-16-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/1680-18-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/1680-21-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/1680-20-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/1680-19-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/1680-17-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/1680-15-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/1680-14-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/1680-23-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/1680-22-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/1680-62-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/1680-63-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/1680-64-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/1680-65-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/1680-67-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/1680-68-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/1680-69-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/1680-70-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/1680-71-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/1680-87-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/1680-88-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/1680-153-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/2944-167-0x0000000000A10000-0x0000000001ACA000-memory.dmp upx behavioral1/memory/2944-195-0x0000000000A10000-0x0000000001ACA000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\f769750 f7696e3.exe File opened for modification C:\Windows\SYSTEM.INI f7696e3.exe File created C:\Windows\f76e782 f7698a7.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f7696e3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f7698a7.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1680 f7696e3.exe 1680 f7696e3.exe 2944 f7698a7.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 1680 f7696e3.exe Token: SeDebugPrivilege 1680 f7696e3.exe Token: SeDebugPrivilege 1680 f7696e3.exe Token: SeDebugPrivilege 1680 f7696e3.exe Token: SeDebugPrivilege 1680 f7696e3.exe Token: SeDebugPrivilege 1680 f7696e3.exe Token: SeDebugPrivilege 1680 f7696e3.exe Token: SeDebugPrivilege 1680 f7696e3.exe Token: SeDebugPrivilege 1680 f7696e3.exe Token: SeDebugPrivilege 1680 f7696e3.exe Token: SeDebugPrivilege 1680 f7696e3.exe Token: SeDebugPrivilege 1680 f7696e3.exe Token: SeDebugPrivilege 1680 f7696e3.exe Token: SeDebugPrivilege 1680 f7696e3.exe Token: SeDebugPrivilege 1680 f7696e3.exe Token: SeDebugPrivilege 1680 f7696e3.exe Token: SeDebugPrivilege 1680 f7696e3.exe Token: SeDebugPrivilege 1680 f7696e3.exe Token: SeDebugPrivilege 1680 f7696e3.exe Token: SeDebugPrivilege 1680 f7696e3.exe Token: SeDebugPrivilege 1680 f7696e3.exe Token: SeDebugPrivilege 1680 f7696e3.exe Token: SeDebugPrivilege 1680 f7696e3.exe Token: SeDebugPrivilege 2944 f7698a7.exe Token: SeDebugPrivilege 2944 f7698a7.exe Token: SeDebugPrivilege 2944 f7698a7.exe Token: SeDebugPrivilege 2944 f7698a7.exe Token: SeDebugPrivilege 2944 f7698a7.exe Token: SeDebugPrivilege 2944 f7698a7.exe Token: SeDebugPrivilege 2944 f7698a7.exe Token: SeDebugPrivilege 2944 f7698a7.exe Token: SeDebugPrivilege 2944 f7698a7.exe Token: SeDebugPrivilege 2944 f7698a7.exe Token: SeDebugPrivilege 2944 f7698a7.exe Token: SeDebugPrivilege 2944 f7698a7.exe Token: SeDebugPrivilege 2944 f7698a7.exe Token: SeDebugPrivilege 2944 f7698a7.exe Token: SeDebugPrivilege 2944 f7698a7.exe Token: SeDebugPrivilege 2944 f7698a7.exe Token: SeDebugPrivilege 2944 f7698a7.exe Token: SeDebugPrivilege 2944 f7698a7.exe Token: SeDebugPrivilege 2944 f7698a7.exe Token: SeDebugPrivilege 2944 f7698a7.exe Token: SeDebugPrivilege 2944 f7698a7.exe Token: SeDebugPrivilege 2944 f7698a7.exe Token: SeDebugPrivilege 2944 f7698a7.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 812 wrote to memory of 2380 812 rundll32.exe 30 PID 812 wrote to memory of 2380 812 rundll32.exe 30 PID 812 wrote to memory of 2380 812 rundll32.exe 30 PID 812 wrote to memory of 2380 812 rundll32.exe 30 PID 812 wrote to memory of 2380 812 rundll32.exe 30 PID 812 wrote to memory of 2380 812 rundll32.exe 30 PID 812 wrote to memory of 2380 812 rundll32.exe 30 PID 2380 wrote to memory of 1680 2380 rundll32.exe 31 PID 2380 wrote to memory of 1680 2380 rundll32.exe 31 PID 2380 wrote to memory of 1680 2380 rundll32.exe 31 PID 2380 wrote to memory of 1680 2380 rundll32.exe 31 PID 1680 wrote to memory of 1100 1680 f7696e3.exe 19 PID 1680 wrote to memory of 1172 1680 f7696e3.exe 20 PID 1680 wrote to memory of 1224 1680 f7696e3.exe 21 PID 1680 wrote to memory of 328 1680 f7696e3.exe 25 PID 1680 wrote to memory of 812 1680 f7696e3.exe 29 PID 1680 wrote to memory of 2380 1680 f7696e3.exe 30 PID 1680 wrote to memory of 2380 1680 f7696e3.exe 30 PID 2380 wrote to memory of 2944 2380 rundll32.exe 32 PID 2380 wrote to memory of 2944 2380 rundll32.exe 32 PID 2380 wrote to memory of 2944 2380 rundll32.exe 32 PID 2380 wrote to memory of 2944 2380 rundll32.exe 32 PID 2380 wrote to memory of 1044 2380 rundll32.exe 33 PID 2380 wrote to memory of 1044 2380 rundll32.exe 33 PID 2380 wrote to memory of 1044 2380 rundll32.exe 33 PID 2380 wrote to memory of 1044 2380 rundll32.exe 33 PID 1680 wrote to memory of 1100 1680 f7696e3.exe 19 PID 1680 wrote to memory of 1172 1680 f7696e3.exe 20 PID 1680 wrote to memory of 1224 1680 f7696e3.exe 21 PID 1680 wrote to memory of 328 1680 f7696e3.exe 25 PID 1680 wrote to memory of 2944 1680 f7696e3.exe 32 PID 1680 wrote to memory of 2944 1680 f7696e3.exe 32 PID 1680 wrote to memory of 1044 1680 f7696e3.exe 33 PID 1680 wrote to memory of 1044 1680 f7696e3.exe 33 PID 2944 wrote to memory of 1100 2944 f7698a7.exe 19 PID 2944 wrote to memory of 1172 2944 f7698a7.exe 20 PID 2944 wrote to memory of 1224 2944 f7698a7.exe 21 PID 2944 wrote to memory of 328 2944 f7698a7.exe 25 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7696e3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f7698a7.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1100
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1172
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1224
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cb370f9859087a218ad0325120e8a7bf4fbc178041a0b84f2ea34ea92ef7fda0.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cb370f9859087a218ad0325120e8a7bf4fbc178041a0b84f2ea34ea92ef7fda0.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\f7696e3.exeC:\Users\Admin\AppData\Local\Temp\f7696e3.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1680
-
-
C:\Users\Admin\AppData\Local\Temp\f7698a7.exeC:\Users\Admin\AppData\Local\Temp\f7698a7.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2944
-
-
C:\Users\Admin\AppData\Local\Temp\f76b50d.exeC:\Users\Admin\AppData\Local\Temp\f76b50d.exe4⤵
- Executes dropped EXE
PID:1044
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:328
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD51258d1867e9ed426019ca409b3911697
SHA183ca3de3d65a0de6a2ef56560a4c6ce42b3a62bb
SHA256c3b7091adbe7676db00734ed21fdfb8fbf1e7f299373d0fd168d6651d62499d8
SHA512a8fb729a506623a059eb76dbe624a2c4b01a20d57f7ef243d6927cfdcb6c74d4423944a49f17514cb49f8745c1166bd7c20d19380b9fe8b9b0b9bf0415be573a
-
Filesize
97KB
MD5fb59f77b551665ba08d7daa1e7977acd
SHA12dc7df1b6815ae64b4593dff25e7310519b3c908
SHA256e015e28f4ba52bc9e146806476573cb3334cab1b9614146c274cb1ab0b557432
SHA512198e3d25363a786fc17aae6292ac4ef79085eff7416ced7622a2e9c1bdf9a203802a6b4a5afe6f595590103637fe70f12688322346993a1fcfec32163c1fb7ce