Analysis
-
max time kernel
28s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-12-2024 12:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dc601c6691a2e0cef6a435bcd208eda44f5d2dd726d8cb190318743b095f3fa7N.dll
Resource
win7-20240903-en
windows7-x64
17 signatures
120 seconds
General
-
Target
dc601c6691a2e0cef6a435bcd208eda44f5d2dd726d8cb190318743b095f3fa7N.dll
-
Size
120KB
-
MD5
628df3fa2b3e32e263fc1a6057e0dbd0
-
SHA1
31501361958dd2a4d98fb0495d384827237344e7
-
SHA256
dc601c6691a2e0cef6a435bcd208eda44f5d2dd726d8cb190318743b095f3fa7
-
SHA512
13b27aa06d06b9b456a363bd110bd7d2965915f78b412c53b9bb0f89b07c09ebb2d86217b6d42fa87ddfd739358e3cb969914856bd1334559dfa8f638caeb1bc
-
SSDEEP
3072:9VIgjMrGSI6KVTRyTSML/dGyQfC4g/Ab:gbGSjKVTRySMLJQf1gw
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f769cbc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f769cbc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76bb25.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76bb25.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76bb25.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f769cbc.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f769cbc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76bb25.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f769cbc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f769cbc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f769cbc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76bb25.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76bb25.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76bb25.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76bb25.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f769cbc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f769cbc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f769cbc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76bb25.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76bb25.exe -
Executes dropped EXE 3 IoCs
pid Process 2400 f769cbc.exe 2632 f769e90.exe 2500 f76bb25.exe -
Loads dropped DLL 6 IoCs
pid Process 2888 rundll32.exe 2888 rundll32.exe 2888 rundll32.exe 2888 rundll32.exe 2888 rundll32.exe 2888 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f769cbc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f769cbc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f769cbc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76bb25.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f769cbc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76bb25.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f769cbc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f769cbc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76bb25.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76bb25.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f769cbc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76bb25.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76bb25.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76bb25.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f769cbc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76bb25.exe -
Enumerates connected drives 3 TTPs 17 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: f769cbc.exe File opened (read-only) \??\N: f769cbc.exe File opened (read-only) \??\Q: f769cbc.exe File opened (read-only) \??\R: f769cbc.exe File opened (read-only) \??\E: f769cbc.exe File opened (read-only) \??\O: f769cbc.exe File opened (read-only) \??\T: f769cbc.exe File opened (read-only) \??\I: f769cbc.exe File opened (read-only) \??\J: f769cbc.exe File opened (read-only) \??\L: f769cbc.exe File opened (read-only) \??\P: f769cbc.exe File opened (read-only) \??\E: f76bb25.exe File opened (read-only) \??\G: f76bb25.exe File opened (read-only) \??\G: f769cbc.exe File opened (read-only) \??\K: f769cbc.exe File opened (read-only) \??\S: f769cbc.exe File opened (read-only) \??\H: f769cbc.exe -
resource yara_rule behavioral1/memory/2400-16-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/2400-19-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/2400-22-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/2400-21-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/2400-20-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/2400-18-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/2400-17-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/2400-14-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/2400-13-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/2400-15-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/2400-59-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/2400-60-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/2400-61-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/2400-63-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/2400-62-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/2400-65-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/2400-66-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/2400-67-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/2400-83-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/2400-85-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/2400-86-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/2400-151-0x0000000000630000-0x00000000016EA000-memory.dmp upx behavioral1/memory/2500-163-0x0000000000910000-0x00000000019CA000-memory.dmp upx behavioral1/memory/2500-203-0x0000000000910000-0x00000000019CA000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\f769d1a f769cbc.exe File opened for modification C:\Windows\SYSTEM.INI f769cbc.exe File created C:\Windows\f76ed2c f76bb25.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f769cbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76bb25.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2400 f769cbc.exe 2400 f769cbc.exe 2500 f76bb25.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 2400 f769cbc.exe Token: SeDebugPrivilege 2400 f769cbc.exe Token: SeDebugPrivilege 2400 f769cbc.exe Token: SeDebugPrivilege 2400 f769cbc.exe Token: SeDebugPrivilege 2400 f769cbc.exe Token: SeDebugPrivilege 2400 f769cbc.exe Token: SeDebugPrivilege 2400 f769cbc.exe Token: SeDebugPrivilege 2400 f769cbc.exe Token: SeDebugPrivilege 2400 f769cbc.exe Token: SeDebugPrivilege 2400 f769cbc.exe Token: SeDebugPrivilege 2400 f769cbc.exe Token: SeDebugPrivilege 2400 f769cbc.exe Token: SeDebugPrivilege 2400 f769cbc.exe Token: SeDebugPrivilege 2400 f769cbc.exe Token: SeDebugPrivilege 2400 f769cbc.exe Token: SeDebugPrivilege 2400 f769cbc.exe Token: SeDebugPrivilege 2400 f769cbc.exe Token: SeDebugPrivilege 2400 f769cbc.exe Token: SeDebugPrivilege 2400 f769cbc.exe Token: SeDebugPrivilege 2400 f769cbc.exe Token: SeDebugPrivilege 2400 f769cbc.exe Token: SeDebugPrivilege 2400 f769cbc.exe Token: SeDebugPrivilege 2400 f769cbc.exe Token: SeDebugPrivilege 2500 f76bb25.exe Token: SeDebugPrivilege 2500 f76bb25.exe Token: SeDebugPrivilege 2500 f76bb25.exe Token: SeDebugPrivilege 2500 f76bb25.exe Token: SeDebugPrivilege 2500 f76bb25.exe Token: SeDebugPrivilege 2500 f76bb25.exe Token: SeDebugPrivilege 2500 f76bb25.exe Token: SeDebugPrivilege 2500 f76bb25.exe Token: SeDebugPrivilege 2500 f76bb25.exe Token: SeDebugPrivilege 2500 f76bb25.exe Token: SeDebugPrivilege 2500 f76bb25.exe Token: SeDebugPrivilege 2500 f76bb25.exe Token: SeDebugPrivilege 2500 f76bb25.exe Token: SeDebugPrivilege 2500 f76bb25.exe Token: SeDebugPrivilege 2500 f76bb25.exe Token: SeDebugPrivilege 2500 f76bb25.exe Token: SeDebugPrivilege 2500 f76bb25.exe Token: SeDebugPrivilege 2500 f76bb25.exe Token: SeDebugPrivilege 2500 f76bb25.exe Token: SeDebugPrivilege 2500 f76bb25.exe Token: SeDebugPrivilege 2500 f76bb25.exe Token: SeDebugPrivilege 2500 f76bb25.exe Token: SeDebugPrivilege 2500 f76bb25.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2688 wrote to memory of 2888 2688 rundll32.exe 30 PID 2688 wrote to memory of 2888 2688 rundll32.exe 30 PID 2688 wrote to memory of 2888 2688 rundll32.exe 30 PID 2688 wrote to memory of 2888 2688 rundll32.exe 30 PID 2688 wrote to memory of 2888 2688 rundll32.exe 30 PID 2688 wrote to memory of 2888 2688 rundll32.exe 30 PID 2688 wrote to memory of 2888 2688 rundll32.exe 30 PID 2888 wrote to memory of 2400 2888 rundll32.exe 31 PID 2888 wrote to memory of 2400 2888 rundll32.exe 31 PID 2888 wrote to memory of 2400 2888 rundll32.exe 31 PID 2888 wrote to memory of 2400 2888 rundll32.exe 31 PID 2400 wrote to memory of 1032 2400 f769cbc.exe 17 PID 2400 wrote to memory of 1048 2400 f769cbc.exe 18 PID 2400 wrote to memory of 1112 2400 f769cbc.exe 20 PID 2400 wrote to memory of 1420 2400 f769cbc.exe 25 PID 2400 wrote to memory of 2688 2400 f769cbc.exe 29 PID 2400 wrote to memory of 2888 2400 f769cbc.exe 30 PID 2400 wrote to memory of 2888 2400 f769cbc.exe 30 PID 2888 wrote to memory of 2632 2888 rundll32.exe 32 PID 2888 wrote to memory of 2632 2888 rundll32.exe 32 PID 2888 wrote to memory of 2632 2888 rundll32.exe 32 PID 2888 wrote to memory of 2632 2888 rundll32.exe 32 PID 2888 wrote to memory of 2500 2888 rundll32.exe 33 PID 2888 wrote to memory of 2500 2888 rundll32.exe 33 PID 2888 wrote to memory of 2500 2888 rundll32.exe 33 PID 2888 wrote to memory of 2500 2888 rundll32.exe 33 PID 2400 wrote to memory of 1032 2400 f769cbc.exe 17 PID 2400 wrote to memory of 1048 2400 f769cbc.exe 18 PID 2400 wrote to memory of 1112 2400 f769cbc.exe 20 PID 2400 wrote to memory of 1420 2400 f769cbc.exe 25 PID 2400 wrote to memory of 2632 2400 f769cbc.exe 32 PID 2400 wrote to memory of 2632 2400 f769cbc.exe 32 PID 2400 wrote to memory of 2500 2400 f769cbc.exe 33 PID 2400 wrote to memory of 2500 2400 f769cbc.exe 33 PID 2500 wrote to memory of 1032 2500 f76bb25.exe 17 PID 2500 wrote to memory of 1048 2500 f76bb25.exe 18 PID 2500 wrote to memory of 1112 2500 f76bb25.exe 20 PID 2500 wrote to memory of 1420 2500 f76bb25.exe 25 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f769cbc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76bb25.exe
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1032
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1048
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1112
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dc601c6691a2e0cef6a435bcd208eda44f5d2dd726d8cb190318743b095f3fa7N.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dc601c6691a2e0cef6a435bcd208eda44f5d2dd726d8cb190318743b095f3fa7N.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\f769cbc.exeC:\Users\Admin\AppData\Local\Temp\f769cbc.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2400
-
-
C:\Users\Admin\AppData\Local\Temp\f769e90.exeC:\Users\Admin\AppData\Local\Temp\f769e90.exe4⤵
- Executes dropped EXE
PID:2632
-
-
C:\Users\Admin\AppData\Local\Temp\f76bb25.exeC:\Users\Admin\AppData\Local\Temp\f76bb25.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2500
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1420
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD5e922875a2cb0e46f1c3aac48609172e1
SHA1a7cc6668fea5513093971433b6f035989cbe0a76
SHA2567bebec8a5b011ce2d0a11365e3fb36dfb484b1ff0d507d9add9ba39a0f5d977e
SHA5120a7cddd0106a2efa0f7276e96f3160532f2b04bba4d133557d42f0d26e93fa9b076bb7a6b5477ef535c6ca1f28b535a06c370591ec1ed44d59dacbc10d6616c3
-
Filesize
257B
MD52859cf4f46d7cf0745716b915e8f22ba
SHA15e4617f658d3df092578409939f5450c9e90d190
SHA256c41c88864924c50334e19cea1b1fd3330895057faad1a32e70ca9717323bd0aa
SHA5126a8e7df517c97152878290219d024b3d5be0b9af1461b91e365b7909b6994bc08ad81bbfbfa9a2dc7a91c892407936d71e2219f6a989b67b6e656638a35c39e5