Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    22-12-2024 05:48

General

  • Target

    a0aad044624bd7fcf04b980d56e3a760ed5c40def10270eb383bc07899b93230N.dll

  • Size

    120KB

  • MD5

    ba84d20d3ae1aaee8c0056175c687c60

  • SHA1

    97cce977ec0fb7ea6d371a0b2626587d53a3d76f

  • SHA256

    a0aad044624bd7fcf04b980d56e3a760ed5c40def10270eb383bc07899b93230

  • SHA512

    f137c329749cf60ee93258c944fd54055b847123e6787f829566e5ae14e46adc9fa581d9fc5f7c3929f5f7ddb11578ed7a73ab5afa95884c479289352185bc8c

  • SSDEEP

    1536:ZIdrNcPnh0c23d7KLzLuvU9nGCfcP5t7rP+LqxhEA6tddQ0aocWsDpO0wdCSG/ub:ZIxN+h0lNRvkmP7DEI8Q0JVi9zE

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

  • Modifies firewall policy service 3 TTPs 6 IoCs
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

  • Sality family
  • UAC bypass 3 TTPs 2 IoCs
  • Windows security bypass 2 TTPs 12 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • Windows security modification 2 TTPs 14 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 17 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file 25 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 41 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs
  • System policy modification 1 TTPs 2 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
      PID:1120
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1164
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
          PID:1200
          • C:\Windows\system32\rundll32.exe
            rundll32.exe C:\Users\Admin\AppData\Local\Temp\a0aad044624bd7fcf04b980d56e3a760ed5c40def10270eb383bc07899b93230N.dll,#1
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:1852
            • C:\Windows\SysWOW64\rundll32.exe
              rundll32.exe C:\Users\Admin\AppData\Local\Temp\a0aad044624bd7fcf04b980d56e3a760ed5c40def10270eb383bc07899b93230N.dll,#1
              3⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2416
              • C:\Users\Admin\AppData\Local\Temp\f76558f.exe
                C:\Users\Admin\AppData\Local\Temp\f76558f.exe
                4⤵
                • Modifies firewall policy service
                • UAC bypass
                • Windows security bypass
                • Executes dropped EXE
                • Windows security modification
                • Checks whether UAC is enabled
                • Enumerates connected drives
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:2912
              • C:\Users\Admin\AppData\Local\Temp\f765715.exe
                C:\Users\Admin\AppData\Local\Temp\f765715.exe
                4⤵
                • Executes dropped EXE
                PID:2784
              • C:\Users\Admin\AppData\Local\Temp\f767159.exe
                C:\Users\Admin\AppData\Local\Temp\f767159.exe
                4⤵
                • Modifies firewall policy service
                • UAC bypass
                • Windows security bypass
                • Executes dropped EXE
                • Windows security modification
                • Checks whether UAC is enabled
                • Enumerates connected drives
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:2524
        • C:\Windows\system32\DllHost.exe
          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
          1⤵
            PID:1624

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Windows\SYSTEM.INI

            Filesize

            256B

            MD5

            c5248ad0934e91cb1c1dbd4b24c3b5f9

            SHA1

            645a7aa46a9156f1a99978174556c632d6e85611

            SHA256

            083962d3f19840bf0b390e435b9b50e4ec5fe05ddba746ed0f0f81ac971ef248

            SHA512

            e1c57a154f9ad901c89b6dc65be6b9f980aceccd4c57c8e7397e332e007b10ebf74aad36cdab260edb771c90632db920f8a0aa259ec05b44253b10a071356d67

          • \Users\Admin\AppData\Local\Temp\f76558f.exe

            Filesize

            97KB

            MD5

            4c0b8029de8f9bad0819c705382c324e

            SHA1

            c6b1d57e9ac51f15a667ad297bd01bf7d2a5421b

            SHA256

            edd0d498cbef9a2ac1f12bdc1fd20df5f8bb0221f93a6348e6f5597d6cf9ee4d

            SHA512

            7cffcd4e79b6471bfa1b76f408082e901f409a74089c6666b7a0b728425433f3b015068abedc271a23f9eaf15784acec5bc02c0afd1e4315d4854d9a7e610314

          • memory/1120-29-0x0000000002010000-0x0000000002012000-memory.dmp

            Filesize

            8KB

          • memory/2416-78-0x0000000000230000-0x0000000000242000-memory.dmp

            Filesize

            72KB

          • memory/2416-10-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2416-9-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2416-77-0x00000000001F0000-0x00000000001F2000-memory.dmp

            Filesize

            8KB

          • memory/2416-57-0x00000000001F0000-0x00000000001F2000-memory.dmp

            Filesize

            8KB

          • memory/2416-35-0x00000000001F0000-0x00000000001F2000-memory.dmp

            Filesize

            8KB

          • memory/2416-2-0x0000000010000000-0x0000000010020000-memory.dmp

            Filesize

            128KB

          • memory/2416-36-0x0000000000200000-0x0000000000201000-memory.dmp

            Filesize

            4KB

          • memory/2416-54-0x00000000001F0000-0x00000000001F2000-memory.dmp

            Filesize

            8KB

          • memory/2416-44-0x0000000000200000-0x0000000000201000-memory.dmp

            Filesize

            4KB

          • memory/2416-1-0x0000000010000000-0x0000000010020000-memory.dmp

            Filesize

            128KB

          • memory/2416-56-0x0000000000210000-0x0000000000222000-memory.dmp

            Filesize

            72KB

          • memory/2524-163-0x0000000000910000-0x00000000019CA000-memory.dmp

            Filesize

            16.7MB

          • memory/2524-164-0x00000000003E0000-0x00000000003E2000-memory.dmp

            Filesize

            8KB

          • memory/2524-82-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2524-106-0x00000000003F0000-0x00000000003F1000-memory.dmp

            Filesize

            4KB

          • memory/2524-108-0x00000000003E0000-0x00000000003E2000-memory.dmp

            Filesize

            8KB

          • memory/2524-210-0x0000000000910000-0x00000000019CA000-memory.dmp

            Filesize

            16.7MB

          • memory/2524-211-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2784-127-0x0000000000220000-0x0000000000222000-memory.dmp

            Filesize

            8KB

          • memory/2784-97-0x0000000000230000-0x0000000000231000-memory.dmp

            Filesize

            4KB

          • memory/2784-98-0x0000000000220000-0x0000000000222000-memory.dmp

            Filesize

            8KB

          • memory/2784-59-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2784-105-0x0000000000220000-0x0000000000222000-memory.dmp

            Filesize

            8KB

          • memory/2784-157-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2912-47-0x0000000003CD0000-0x0000000003CD2000-memory.dmp

            Filesize

            8KB

          • memory/2912-22-0x0000000000520000-0x00000000015DA000-memory.dmp

            Filesize

            16.7MB

          • memory/2912-64-0x0000000000520000-0x00000000015DA000-memory.dmp

            Filesize

            16.7MB

          • memory/2912-63-0x0000000000520000-0x00000000015DA000-memory.dmp

            Filesize

            16.7MB

          • memory/2912-66-0x0000000000520000-0x00000000015DA000-memory.dmp

            Filesize

            16.7MB

          • memory/2912-67-0x0000000000520000-0x00000000015DA000-memory.dmp

            Filesize

            16.7MB

          • memory/2912-61-0x0000000000520000-0x00000000015DA000-memory.dmp

            Filesize

            16.7MB

          • memory/2912-60-0x0000000000520000-0x00000000015DA000-memory.dmp

            Filesize

            16.7MB

          • memory/2912-16-0x0000000000520000-0x00000000015DA000-memory.dmp

            Filesize

            16.7MB

          • memory/2912-76-0x0000000003CD0000-0x0000000003CD2000-memory.dmp

            Filesize

            8KB

          • memory/2912-83-0x0000000000520000-0x00000000015DA000-memory.dmp

            Filesize

            16.7MB

          • memory/2912-85-0x0000000000520000-0x00000000015DA000-memory.dmp

            Filesize

            16.7MB

          • memory/2912-87-0x0000000000520000-0x00000000015DA000-memory.dmp

            Filesize

            16.7MB

          • memory/2912-19-0x0000000000520000-0x00000000015DA000-memory.dmp

            Filesize

            16.7MB

          • memory/2912-21-0x0000000000520000-0x00000000015DA000-memory.dmp

            Filesize

            16.7MB

          • memory/2912-62-0x0000000000520000-0x00000000015DA000-memory.dmp

            Filesize

            16.7MB

          • memory/2912-110-0x0000000000520000-0x00000000015DA000-memory.dmp

            Filesize

            16.7MB

          • memory/2912-45-0x0000000003D20000-0x0000000003D21000-memory.dmp

            Filesize

            4KB

          • memory/2912-55-0x0000000003CD0000-0x0000000003CD2000-memory.dmp

            Filesize

            8KB

          • memory/2912-111-0x0000000000520000-0x00000000015DA000-memory.dmp

            Filesize

            16.7MB

          • memory/2912-20-0x0000000000520000-0x00000000015DA000-memory.dmp

            Filesize

            16.7MB

          • memory/2912-152-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          • memory/2912-153-0x0000000000520000-0x00000000015DA000-memory.dmp

            Filesize

            16.7MB

          • memory/2912-23-0x0000000000520000-0x00000000015DA000-memory.dmp

            Filesize

            16.7MB

          • memory/2912-17-0x0000000000520000-0x00000000015DA000-memory.dmp

            Filesize

            16.7MB

          • memory/2912-15-0x0000000000520000-0x00000000015DA000-memory.dmp

            Filesize

            16.7MB

          • memory/2912-18-0x0000000000520000-0x00000000015DA000-memory.dmp

            Filesize

            16.7MB

          • memory/2912-13-0x0000000000520000-0x00000000015DA000-memory.dmp

            Filesize

            16.7MB

          • memory/2912-12-0x0000000000400000-0x0000000000412000-memory.dmp

            Filesize

            72KB

          We care about your privacy.

          This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.