Analysis
-
max time kernel
27s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
22-12-2024 14:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d3898dfc53886208546e4943a7025053aef455cb09a11267401c40a898128a3dN.dll
Resource
win7-20241010-en
windows7-x64
17 signatures
120 seconds
General
-
Target
d3898dfc53886208546e4943a7025053aef455cb09a11267401c40a898128a3dN.dll
-
Size
120KB
-
MD5
b67552ae5832ae452ba6c367580b3b80
-
SHA1
33f6ac6be121f34d7e1f23a18a9dcfdddf2b9c97
-
SHA256
d3898dfc53886208546e4943a7025053aef455cb09a11267401c40a898128a3d
-
SHA512
2d2908ef9c2bbf6d81f6ecabaadbd6888c549b5c79c7f2899b13e41eb1e1ab381d7cec7d4a4cdfcdf29465b4abd54d8b4bbc31f47475104fcc6265eb2946ecdc
-
SSDEEP
3072:SMsyq2ae8W67cw36kTI5ODYmST+y0CxSfwNpv+Y:Sl2ae8mg6kTtV4+ywyV
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76cafd.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76e698.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76e698.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76e698.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76cafd.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76cafd.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76cafd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76e698.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76e698.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76cafd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76cafd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76cafd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76cafd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76e698.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76e698.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76cafd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76cafd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76e698.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76e698.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76e698.exe -
Executes dropped EXE 3 IoCs
pid Process 2368 f76cafd.exe 2156 f76cb89.exe 2748 f76e698.exe -
Loads dropped DLL 6 IoCs
pid Process 1080 rundll32.exe 1080 rundll32.exe 1080 rundll32.exe 1080 rundll32.exe 1080 rundll32.exe 1080 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76e698.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76e698.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76e698.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76cafd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76cafd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76cafd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76e698.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76e698.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76cafd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76e698.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76e698.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76cafd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76cafd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76cafd.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76cafd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76e698.exe -
Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: f76cafd.exe File opened (read-only) \??\O: f76cafd.exe File opened (read-only) \??\R: f76cafd.exe File opened (read-only) \??\E: f76cafd.exe File opened (read-only) \??\I: f76cafd.exe File opened (read-only) \??\K: f76cafd.exe File opened (read-only) \??\N: f76cafd.exe File opened (read-only) \??\S: f76cafd.exe File opened (read-only) \??\P: f76cafd.exe File opened (read-only) \??\Q: f76cafd.exe File opened (read-only) \??\E: f76e698.exe File opened (read-only) \??\G: f76cafd.exe File opened (read-only) \??\H: f76cafd.exe File opened (read-only) \??\J: f76cafd.exe File opened (read-only) \??\L: f76cafd.exe -
resource yara_rule behavioral1/memory/2368-39-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2368-55-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2368-53-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2368-52-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2368-15-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2368-14-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2368-13-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2368-48-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2368-40-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2368-54-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2368-62-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2368-61-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2368-63-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2368-64-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2368-65-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2368-67-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2368-68-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2368-83-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2368-82-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2368-85-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2368-87-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2368-156-0x0000000000560000-0x000000000161A000-memory.dmp upx behavioral1/memory/2748-174-0x0000000000910000-0x00000000019CA000-memory.dmp upx behavioral1/memory/2748-213-0x0000000000910000-0x00000000019CA000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\f771fc0 f76e698.exe File created C:\Windows\f76cb6a f76cafd.exe File opened for modification C:\Windows\SYSTEM.INI f76cafd.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76cafd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76e698.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2368 f76cafd.exe 2368 f76cafd.exe 2748 f76e698.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 2368 f76cafd.exe Token: SeDebugPrivilege 2368 f76cafd.exe Token: SeDebugPrivilege 2368 f76cafd.exe Token: SeDebugPrivilege 2368 f76cafd.exe Token: SeDebugPrivilege 2368 f76cafd.exe Token: SeDebugPrivilege 2368 f76cafd.exe Token: SeDebugPrivilege 2368 f76cafd.exe Token: SeDebugPrivilege 2368 f76cafd.exe Token: SeDebugPrivilege 2368 f76cafd.exe Token: SeDebugPrivilege 2368 f76cafd.exe Token: SeDebugPrivilege 2368 f76cafd.exe Token: SeDebugPrivilege 2368 f76cafd.exe Token: SeDebugPrivilege 2368 f76cafd.exe Token: SeDebugPrivilege 2368 f76cafd.exe Token: SeDebugPrivilege 2368 f76cafd.exe Token: SeDebugPrivilege 2368 f76cafd.exe Token: SeDebugPrivilege 2368 f76cafd.exe Token: SeDebugPrivilege 2368 f76cafd.exe Token: SeDebugPrivilege 2368 f76cafd.exe Token: SeDebugPrivilege 2368 f76cafd.exe Token: SeDebugPrivilege 2368 f76cafd.exe Token: SeDebugPrivilege 2368 f76cafd.exe Token: SeDebugPrivilege 2368 f76cafd.exe Token: SeDebugPrivilege 2368 f76cafd.exe Token: SeDebugPrivilege 2748 f76e698.exe Token: SeDebugPrivilege 2748 f76e698.exe Token: SeDebugPrivilege 2748 f76e698.exe Token: SeDebugPrivilege 2748 f76e698.exe Token: SeDebugPrivilege 2748 f76e698.exe Token: SeDebugPrivilege 2748 f76e698.exe Token: SeDebugPrivilege 2748 f76e698.exe Token: SeDebugPrivilege 2748 f76e698.exe Token: SeDebugPrivilege 2748 f76e698.exe Token: SeDebugPrivilege 2748 f76e698.exe Token: SeDebugPrivilege 2748 f76e698.exe Token: SeDebugPrivilege 2748 f76e698.exe Token: SeDebugPrivilege 2748 f76e698.exe Token: SeDebugPrivilege 2748 f76e698.exe Token: SeDebugPrivilege 2748 f76e698.exe Token: SeDebugPrivilege 2748 f76e698.exe Token: SeDebugPrivilege 2748 f76e698.exe Token: SeDebugPrivilege 2748 f76e698.exe Token: SeDebugPrivilege 2748 f76e698.exe Token: SeDebugPrivilege 2748 f76e698.exe Token: SeDebugPrivilege 2748 f76e698.exe Token: SeDebugPrivilege 2748 f76e698.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2588 wrote to memory of 1080 2588 rundll32.exe 30 PID 2588 wrote to memory of 1080 2588 rundll32.exe 30 PID 2588 wrote to memory of 1080 2588 rundll32.exe 30 PID 2588 wrote to memory of 1080 2588 rundll32.exe 30 PID 2588 wrote to memory of 1080 2588 rundll32.exe 30 PID 2588 wrote to memory of 1080 2588 rundll32.exe 30 PID 2588 wrote to memory of 1080 2588 rundll32.exe 30 PID 1080 wrote to memory of 2368 1080 rundll32.exe 31 PID 1080 wrote to memory of 2368 1080 rundll32.exe 31 PID 1080 wrote to memory of 2368 1080 rundll32.exe 31 PID 1080 wrote to memory of 2368 1080 rundll32.exe 31 PID 2368 wrote to memory of 1108 2368 f76cafd.exe 19 PID 2368 wrote to memory of 1152 2368 f76cafd.exe 20 PID 2368 wrote to memory of 1192 2368 f76cafd.exe 21 PID 2368 wrote to memory of 844 2368 f76cafd.exe 23 PID 2368 wrote to memory of 2588 2368 f76cafd.exe 29 PID 2368 wrote to memory of 1080 2368 f76cafd.exe 30 PID 2368 wrote to memory of 1080 2368 f76cafd.exe 30 PID 1080 wrote to memory of 2156 1080 rundll32.exe 33 PID 1080 wrote to memory of 2156 1080 rundll32.exe 33 PID 1080 wrote to memory of 2156 1080 rundll32.exe 33 PID 1080 wrote to memory of 2156 1080 rundll32.exe 33 PID 1080 wrote to memory of 2748 1080 rundll32.exe 34 PID 1080 wrote to memory of 2748 1080 rundll32.exe 34 PID 1080 wrote to memory of 2748 1080 rundll32.exe 34 PID 1080 wrote to memory of 2748 1080 rundll32.exe 34 PID 2368 wrote to memory of 1108 2368 f76cafd.exe 19 PID 2368 wrote to memory of 1152 2368 f76cafd.exe 20 PID 2368 wrote to memory of 1192 2368 f76cafd.exe 21 PID 2368 wrote to memory of 844 2368 f76cafd.exe 23 PID 2368 wrote to memory of 2156 2368 f76cafd.exe 33 PID 2368 wrote to memory of 2156 2368 f76cafd.exe 33 PID 2368 wrote to memory of 2748 2368 f76cafd.exe 34 PID 2368 wrote to memory of 2748 2368 f76cafd.exe 34 PID 2748 wrote to memory of 1108 2748 f76e698.exe 19 PID 2748 wrote to memory of 1152 2748 f76e698.exe 20 PID 2748 wrote to memory of 1192 2748 f76e698.exe 21 PID 2748 wrote to memory of 844 2748 f76e698.exe 23 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76cafd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76e698.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1108
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1152
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1192
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d3898dfc53886208546e4943a7025053aef455cb09a11267401c40a898128a3dN.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d3898dfc53886208546e4943a7025053aef455cb09a11267401c40a898128a3dN.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\f76cafd.exeC:\Users\Admin\AppData\Local\Temp\f76cafd.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2368
-
-
C:\Users\Admin\AppData\Local\Temp\f76cb89.exeC:\Users\Admin\AppData\Local\Temp\f76cb89.exe4⤵
- Executes dropped EXE
PID:2156
-
-
C:\Users\Admin\AppData\Local\Temp\f76e698.exeC:\Users\Admin\AppData\Local\Temp\f76e698.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2748
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:844
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD5a2a98dd906198e633eca3ec298d68247
SHA129de473117a9db3bc2e7e51b44c6ef062eb95582
SHA2561ec967722069b0403f3250faba1023993928d3f78b77169b2bcee807a7e396f5
SHA512fcc622e8429109f6586b6baf736e5909031c2c6075fba3e9c4af408ef8b65bc982201b125a542a097fb37406326d87a10e17cf4a5a0b6ce550984be5fb942091
-
Filesize
97KB
MD568c354b8f304adb33092da2620b592c1
SHA13a2fd57eed024973f7b32711cd1dd6f04c19216c
SHA256dc29449361bfc49fee67089e4c56e2cde17fd3a7ab491278618ec5a879488e80
SHA51234fb97b4a0677cbbca5f0bdb68d9597ce401cda978ee160a51b81c1e8d10994580cac2bd7e2e22a4adbdcfaa6372b2dde181a636bb260d83368991ffa88fc213