Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 06:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4dbfb80d701b5d67b91a4837100b9aa63f8ec6e6e655d19a4bf5e5de10882346.dll
Resource
win7-20240708-en
windows7-x64
17 signatures
120 seconds
General
-
Target
4dbfb80d701b5d67b91a4837100b9aa63f8ec6e6e655d19a4bf5e5de10882346.dll
-
Size
120KB
-
MD5
2340169795fd645f6d939ee28e66add5
-
SHA1
8e960eda5bfc5647eaa22fe4d3c29b6bd55b9e01
-
SHA256
4dbfb80d701b5d67b91a4837100b9aa63f8ec6e6e655d19a4bf5e5de10882346
-
SHA512
03518a1ffe1be45ca5032c77091a3e55873c2f8993a27a16c6a8c1e819e99c85b658cd06338e4db79e464873fb0251979df8155090b5aecc96bf18c89996d61a
-
SSDEEP
1536:rdRWakKuD+pwKAoTgg8XUaZnLoJ4sHjGcggstdvHFgo1LMeP5aCTZCJ:r3ghn0Jj/I/HW+MeP5RgJ
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f769ab9.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76b683.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76b683.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76b683.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f769ab9.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f769ab9.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f769ab9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b683.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f769ab9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76b683.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76b683.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76b683.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76b683.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76b683.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f769ab9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f769ab9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f769ab9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f769ab9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f769ab9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76b683.exe -
Executes dropped EXE 3 IoCs
pid Process 1772 f769ab9.exe 2308 f769c5f.exe 2632 f76b683.exe -
Loads dropped DLL 6 IoCs
pid Process 1452 rundll32.exe 1452 rundll32.exe 1452 rundll32.exe 1452 rundll32.exe 1452 rundll32.exe 1452 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f769ab9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f769ab9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f769ab9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76b683.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f769ab9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f769ab9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f769ab9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76b683.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76b683.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76b683.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76b683.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76b683.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f769ab9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76b683.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b683.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f769ab9.exe -
Enumerates connected drives 3 TTPs 17 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: f769ab9.exe File opened (read-only) \??\J: f769ab9.exe File opened (read-only) \??\M: f769ab9.exe File opened (read-only) \??\N: f769ab9.exe File opened (read-only) \??\P: f769ab9.exe File opened (read-only) \??\R: f769ab9.exe File opened (read-only) \??\T: f769ab9.exe File opened (read-only) \??\E: f769ab9.exe File opened (read-only) \??\E: f76b683.exe File opened (read-only) \??\O: f769ab9.exe File opened (read-only) \??\S: f769ab9.exe File opened (read-only) \??\K: f769ab9.exe File opened (read-only) \??\L: f769ab9.exe File opened (read-only) \??\I: f769ab9.exe File opened (read-only) \??\Q: f769ab9.exe File opened (read-only) \??\G: f76b683.exe File opened (read-only) \??\H: f769ab9.exe -
resource yara_rule behavioral1/memory/1772-17-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/1772-13-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/1772-21-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/1772-15-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/1772-14-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/1772-18-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/1772-19-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/1772-22-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/1772-20-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/1772-16-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/1772-61-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/1772-62-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/1772-63-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/1772-65-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/1772-64-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/1772-67-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/1772-68-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/1772-81-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/1772-84-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/1772-85-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/1772-104-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/1772-105-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/1772-153-0x00000000006B0000-0x000000000176A000-memory.dmp upx behavioral1/memory/2632-178-0x0000000000910000-0x00000000019CA000-memory.dmp upx behavioral1/memory/2632-207-0x0000000000910000-0x00000000019CA000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\f76eadc f76b683.exe File created C:\Windows\f769b27 f769ab9.exe File opened for modification C:\Windows\SYSTEM.INI f769ab9.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f769ab9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76b683.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1772 f769ab9.exe 1772 f769ab9.exe 2632 f76b683.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 1772 f769ab9.exe Token: SeDebugPrivilege 1772 f769ab9.exe Token: SeDebugPrivilege 1772 f769ab9.exe Token: SeDebugPrivilege 1772 f769ab9.exe Token: SeDebugPrivilege 1772 f769ab9.exe Token: SeDebugPrivilege 1772 f769ab9.exe Token: SeDebugPrivilege 1772 f769ab9.exe Token: SeDebugPrivilege 1772 f769ab9.exe Token: SeDebugPrivilege 1772 f769ab9.exe Token: SeDebugPrivilege 1772 f769ab9.exe Token: SeDebugPrivilege 1772 f769ab9.exe Token: SeDebugPrivilege 1772 f769ab9.exe Token: SeDebugPrivilege 1772 f769ab9.exe Token: SeDebugPrivilege 1772 f769ab9.exe Token: SeDebugPrivilege 1772 f769ab9.exe Token: SeDebugPrivilege 1772 f769ab9.exe Token: SeDebugPrivilege 1772 f769ab9.exe Token: SeDebugPrivilege 1772 f769ab9.exe Token: SeDebugPrivilege 1772 f769ab9.exe Token: SeDebugPrivilege 1772 f769ab9.exe Token: SeDebugPrivilege 1772 f769ab9.exe Token: SeDebugPrivilege 1772 f769ab9.exe Token: SeDebugPrivilege 1772 f769ab9.exe Token: SeDebugPrivilege 2632 f76b683.exe Token: SeDebugPrivilege 2632 f76b683.exe Token: SeDebugPrivilege 2632 f76b683.exe Token: SeDebugPrivilege 2632 f76b683.exe Token: SeDebugPrivilege 2632 f76b683.exe Token: SeDebugPrivilege 2632 f76b683.exe Token: SeDebugPrivilege 2632 f76b683.exe Token: SeDebugPrivilege 2632 f76b683.exe Token: SeDebugPrivilege 2632 f76b683.exe Token: SeDebugPrivilege 2632 f76b683.exe Token: SeDebugPrivilege 2632 f76b683.exe Token: SeDebugPrivilege 2632 f76b683.exe Token: SeDebugPrivilege 2632 f76b683.exe Token: SeDebugPrivilege 2632 f76b683.exe Token: SeDebugPrivilege 2632 f76b683.exe Token: SeDebugPrivilege 2632 f76b683.exe Token: SeDebugPrivilege 2632 f76b683.exe Token: SeDebugPrivilege 2632 f76b683.exe Token: SeDebugPrivilege 2632 f76b683.exe Token: SeDebugPrivilege 2632 f76b683.exe Token: SeDebugPrivilege 2632 f76b683.exe Token: SeDebugPrivilege 2632 f76b683.exe Token: SeDebugPrivilege 2632 f76b683.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 1700 wrote to memory of 1452 1700 rundll32.exe 30 PID 1700 wrote to memory of 1452 1700 rundll32.exe 30 PID 1700 wrote to memory of 1452 1700 rundll32.exe 30 PID 1700 wrote to memory of 1452 1700 rundll32.exe 30 PID 1700 wrote to memory of 1452 1700 rundll32.exe 30 PID 1700 wrote to memory of 1452 1700 rundll32.exe 30 PID 1700 wrote to memory of 1452 1700 rundll32.exe 30 PID 1452 wrote to memory of 1772 1452 rundll32.exe 31 PID 1452 wrote to memory of 1772 1452 rundll32.exe 31 PID 1452 wrote to memory of 1772 1452 rundll32.exe 31 PID 1452 wrote to memory of 1772 1452 rundll32.exe 31 PID 1772 wrote to memory of 1108 1772 f769ab9.exe 19 PID 1772 wrote to memory of 1168 1772 f769ab9.exe 20 PID 1772 wrote to memory of 1204 1772 f769ab9.exe 21 PID 1772 wrote to memory of 376 1772 f769ab9.exe 25 PID 1772 wrote to memory of 1700 1772 f769ab9.exe 29 PID 1772 wrote to memory of 1452 1772 f769ab9.exe 30 PID 1772 wrote to memory of 1452 1772 f769ab9.exe 30 PID 1452 wrote to memory of 2308 1452 rundll32.exe 32 PID 1452 wrote to memory of 2308 1452 rundll32.exe 32 PID 1452 wrote to memory of 2308 1452 rundll32.exe 32 PID 1452 wrote to memory of 2308 1452 rundll32.exe 32 PID 1452 wrote to memory of 2632 1452 rundll32.exe 33 PID 1452 wrote to memory of 2632 1452 rundll32.exe 33 PID 1452 wrote to memory of 2632 1452 rundll32.exe 33 PID 1452 wrote to memory of 2632 1452 rundll32.exe 33 PID 1772 wrote to memory of 1108 1772 f769ab9.exe 19 PID 1772 wrote to memory of 1168 1772 f769ab9.exe 20 PID 1772 wrote to memory of 1204 1772 f769ab9.exe 21 PID 1772 wrote to memory of 376 1772 f769ab9.exe 25 PID 1772 wrote to memory of 2308 1772 f769ab9.exe 32 PID 1772 wrote to memory of 2308 1772 f769ab9.exe 32 PID 1772 wrote to memory of 2632 1772 f769ab9.exe 33 PID 1772 wrote to memory of 2632 1772 f769ab9.exe 33 PID 2632 wrote to memory of 1108 2632 f76b683.exe 19 PID 2632 wrote to memory of 1168 2632 f76b683.exe 20 PID 2632 wrote to memory of 1204 2632 f76b683.exe 21 PID 2632 wrote to memory of 376 2632 f76b683.exe 25 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f769ab9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b683.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1108
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1168
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1204
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4dbfb80d701b5d67b91a4837100b9aa63f8ec6e6e655d19a4bf5e5de10882346.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4dbfb80d701b5d67b91a4837100b9aa63f8ec6e6e655d19a4bf5e5de10882346.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\f769ab9.exeC:\Users\Admin\AppData\Local\Temp\f769ab9.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1772
-
-
C:\Users\Admin\AppData\Local\Temp\f769c5f.exeC:\Users\Admin\AppData\Local\Temp\f769c5f.exe4⤵
- Executes dropped EXE
PID:2308
-
-
C:\Users\Admin\AppData\Local\Temp\f76b683.exeC:\Users\Admin\AppData\Local\Temp\f76b683.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2632
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:376
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD5215c3ae1f7b9733a2d0099406237bd18
SHA1debe2b38f6554fba070f7e1030d0498089122ff3
SHA256a575bea3e304295b7caeb7d23e1a7bf2ab550e2a9bc4d7e16ea62933d0298e61
SHA512b03d5d5b506dacb4f3242492e080770a38ea24e0a42ae3ebd97800b2e49066a481308f6c0f39c817b6778251efdd79aeda821350a5a8e86ddd0e9de376cd0463
-
Filesize
97KB
MD5ff9cb29e53a85f1433c03e7b23a2ee88
SHA17b158155be982c4b26bbe1538ff0ae7fcd19942b
SHA256df0640a5480c0bbcb21e35c62ff233030e6afe57a3fe8771582cdbb3abc99e00
SHA512b6bd7354e4072e03405bff1489a8e35d142eea82dcd1956daf89879cac0692fa223bbb39a163f5e5c731bfbe121b2597f44dfa4829f7358fc64215efe3a48d87