Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
30-12-2024 16:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ee20a018c451b148fee4fea0b6b848b570454d45abf2c104580db316c53ddbb1.dll
Resource
win7-20240903-en
windows7-x64
17 signatures
120 seconds
General
-
Target
ee20a018c451b148fee4fea0b6b848b570454d45abf2c104580db316c53ddbb1.dll
-
Size
120KB
-
MD5
0d4332a660bddac60861f7b5a2163164
-
SHA1
0aea11af4275835d8e3e74a9a63c96726ee7c0ef
-
SHA256
ee20a018c451b148fee4fea0b6b848b570454d45abf2c104580db316c53ddbb1
-
SHA512
90fb026456cbeecac2b31d89bb7b2a3bc76a55bf68bf184f5586b701861dbf9916155b0a06ab431b89e8b48f69f11e944cf65d673781588faaa28eb2d5a4d720
-
SSDEEP
3072:N4Zh5gLRUPXcGZ7RhUIF9ah05E9pMkpFWNwzBpmHCf:N4fg+PXcGZNhUIFghUkpQKzPn
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76d308.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76b1a3.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76b1a3.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76b1a3.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76d308.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76d308.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b1a3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76d308.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76d308.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76d308.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76d308.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76d308.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76b1a3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76b1a3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76b1a3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76d308.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76b1a3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76b1a3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76b1a3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76d308.exe -
Executes dropped EXE 3 IoCs
pid Process 2056 f76b1a3.exe 3000 f76b367.exe 812 f76d308.exe -
Loads dropped DLL 6 IoCs
pid Process 2384 rundll32.exe 2384 rundll32.exe 2384 rundll32.exe 2384 rundll32.exe 2384 rundll32.exe 2384 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76b1a3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76b1a3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76b1a3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76d308.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76d308.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76b1a3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76b1a3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76b1a3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76d308.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76d308.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76b1a3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76d308.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76d308.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76d308.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b1a3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76d308.exe -
Enumerates connected drives 3 TTPs 18 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: f76b1a3.exe File opened (read-only) \??\I: f76b1a3.exe File opened (read-only) \??\N: f76b1a3.exe File opened (read-only) \??\O: f76b1a3.exe File opened (read-only) \??\T: f76b1a3.exe File opened (read-only) \??\G: f76b1a3.exe File opened (read-only) \??\M: f76b1a3.exe File opened (read-only) \??\E: f76d308.exe File opened (read-only) \??\K: f76b1a3.exe File opened (read-only) \??\J: f76b1a3.exe File opened (read-only) \??\L: f76b1a3.exe File opened (read-only) \??\R: f76b1a3.exe File opened (read-only) \??\E: f76b1a3.exe File opened (read-only) \??\Q: f76b1a3.exe File opened (read-only) \??\S: f76b1a3.exe File opened (read-only) \??\G: f76d308.exe File opened (read-only) \??\H: f76d308.exe File opened (read-only) \??\P: f76b1a3.exe -
resource yara_rule behavioral1/memory/2056-16-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2056-19-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2056-22-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2056-21-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2056-17-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2056-24-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2056-20-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2056-18-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2056-25-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2056-23-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2056-65-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2056-66-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2056-67-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2056-68-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2056-69-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2056-71-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2056-72-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2056-73-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2056-74-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2056-88-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/2056-152-0x0000000000590000-0x000000000164A000-memory.dmp upx behavioral1/memory/812-166-0x0000000000A80000-0x0000000001B3A000-memory.dmp upx behavioral1/memory/812-211-0x0000000000A80000-0x0000000001B3A000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\f76b210 f76b1a3.exe File opened for modification C:\Windows\SYSTEM.INI f76b1a3.exe File created C:\Windows\f770223 f76d308.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76b1a3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76d308.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2056 f76b1a3.exe 2056 f76b1a3.exe 812 f76d308.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 2056 f76b1a3.exe Token: SeDebugPrivilege 2056 f76b1a3.exe Token: SeDebugPrivilege 2056 f76b1a3.exe Token: SeDebugPrivilege 2056 f76b1a3.exe Token: SeDebugPrivilege 2056 f76b1a3.exe Token: SeDebugPrivilege 2056 f76b1a3.exe Token: SeDebugPrivilege 2056 f76b1a3.exe Token: SeDebugPrivilege 2056 f76b1a3.exe Token: SeDebugPrivilege 2056 f76b1a3.exe Token: SeDebugPrivilege 2056 f76b1a3.exe Token: SeDebugPrivilege 2056 f76b1a3.exe Token: SeDebugPrivilege 2056 f76b1a3.exe Token: SeDebugPrivilege 2056 f76b1a3.exe Token: SeDebugPrivilege 2056 f76b1a3.exe Token: SeDebugPrivilege 2056 f76b1a3.exe Token: SeDebugPrivilege 2056 f76b1a3.exe Token: SeDebugPrivilege 2056 f76b1a3.exe Token: SeDebugPrivilege 2056 f76b1a3.exe Token: SeDebugPrivilege 2056 f76b1a3.exe Token: SeDebugPrivilege 2056 f76b1a3.exe Token: SeDebugPrivilege 2056 f76b1a3.exe Token: SeDebugPrivilege 2056 f76b1a3.exe Token: SeDebugPrivilege 2056 f76b1a3.exe Token: SeDebugPrivilege 2056 f76b1a3.exe Token: SeDebugPrivilege 812 f76d308.exe Token: SeDebugPrivilege 812 f76d308.exe Token: SeDebugPrivilege 812 f76d308.exe Token: SeDebugPrivilege 812 f76d308.exe Token: SeDebugPrivilege 812 f76d308.exe Token: SeDebugPrivilege 812 f76d308.exe Token: SeDebugPrivilege 812 f76d308.exe Token: SeDebugPrivilege 812 f76d308.exe Token: SeDebugPrivilege 812 f76d308.exe Token: SeDebugPrivilege 812 f76d308.exe Token: SeDebugPrivilege 812 f76d308.exe Token: SeDebugPrivilege 812 f76d308.exe Token: SeDebugPrivilege 812 f76d308.exe Token: SeDebugPrivilege 812 f76d308.exe Token: SeDebugPrivilege 812 f76d308.exe Token: SeDebugPrivilege 812 f76d308.exe Token: SeDebugPrivilege 812 f76d308.exe Token: SeDebugPrivilege 812 f76d308.exe Token: SeDebugPrivilege 812 f76d308.exe Token: SeDebugPrivilege 812 f76d308.exe Token: SeDebugPrivilege 812 f76d308.exe Token: SeDebugPrivilege 812 f76d308.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2568 wrote to memory of 2384 2568 rundll32.exe 30 PID 2568 wrote to memory of 2384 2568 rundll32.exe 30 PID 2568 wrote to memory of 2384 2568 rundll32.exe 30 PID 2568 wrote to memory of 2384 2568 rundll32.exe 30 PID 2568 wrote to memory of 2384 2568 rundll32.exe 30 PID 2568 wrote to memory of 2384 2568 rundll32.exe 30 PID 2568 wrote to memory of 2384 2568 rundll32.exe 30 PID 2384 wrote to memory of 2056 2384 rundll32.exe 31 PID 2384 wrote to memory of 2056 2384 rundll32.exe 31 PID 2384 wrote to memory of 2056 2384 rundll32.exe 31 PID 2384 wrote to memory of 2056 2384 rundll32.exe 31 PID 2056 wrote to memory of 1116 2056 f76b1a3.exe 19 PID 2056 wrote to memory of 1160 2056 f76b1a3.exe 20 PID 2056 wrote to memory of 1196 2056 f76b1a3.exe 21 PID 2056 wrote to memory of 1608 2056 f76b1a3.exe 23 PID 2056 wrote to memory of 2568 2056 f76b1a3.exe 29 PID 2056 wrote to memory of 2384 2056 f76b1a3.exe 30 PID 2056 wrote to memory of 2384 2056 f76b1a3.exe 30 PID 2384 wrote to memory of 3000 2384 rundll32.exe 32 PID 2384 wrote to memory of 3000 2384 rundll32.exe 32 PID 2384 wrote to memory of 3000 2384 rundll32.exe 32 PID 2384 wrote to memory of 3000 2384 rundll32.exe 32 PID 2384 wrote to memory of 812 2384 rundll32.exe 34 PID 2384 wrote to memory of 812 2384 rundll32.exe 34 PID 2384 wrote to memory of 812 2384 rundll32.exe 34 PID 2384 wrote to memory of 812 2384 rundll32.exe 34 PID 2056 wrote to memory of 1116 2056 f76b1a3.exe 19 PID 2056 wrote to memory of 1160 2056 f76b1a3.exe 20 PID 2056 wrote to memory of 1196 2056 f76b1a3.exe 21 PID 2056 wrote to memory of 1608 2056 f76b1a3.exe 23 PID 2056 wrote to memory of 3000 2056 f76b1a3.exe 32 PID 2056 wrote to memory of 3000 2056 f76b1a3.exe 32 PID 2056 wrote to memory of 812 2056 f76b1a3.exe 34 PID 2056 wrote to memory of 812 2056 f76b1a3.exe 34 PID 812 wrote to memory of 1116 812 f76d308.exe 19 PID 812 wrote to memory of 1160 812 f76d308.exe 20 PID 812 wrote to memory of 1196 812 f76d308.exe 21 PID 812 wrote to memory of 1608 812 f76d308.exe 23 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76b1a3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76d308.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1116
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1160
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1196
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ee20a018c451b148fee4fea0b6b848b570454d45abf2c104580db316c53ddbb1.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ee20a018c451b148fee4fea0b6b848b570454d45abf2c104580db316c53ddbb1.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\f76b1a3.exeC:\Users\Admin\AppData\Local\Temp\f76b1a3.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2056
-
-
C:\Users\Admin\AppData\Local\Temp\f76b367.exeC:\Users\Admin\AppData\Local\Temp\f76b367.exe4⤵
- Executes dropped EXE
PID:3000
-
-
C:\Users\Admin\AppData\Local\Temp\f76d308.exeC:\Users\Admin\AppData\Local\Temp\f76d308.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:812
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1608
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD535fc85d571b4b495a7e84a32414fd245
SHA1880db62ab4f63ce666a5dd8f8e5ab3786b0ed4af
SHA256e3c0f5aaf3b895e6c67e100b201ac090164139ddc21ac3a852d361ca8b1545a3
SHA512bcd8f0c48402b9a4171837d9b86ea51cfaefe319f75fbed58d6d3129e44a7e5b0560cdbdc023f81e26c30fa63f53a4e0ce88d0bc07e20dc0ff099856f5bfb1e4
-
Filesize
257B
MD57f8bdd04ecf9370a6ba125a7881772be
SHA138ee1df3fb7344c6caa4b7d45a7e38b550dce9a4
SHA256b3503364fa1cd97d01b3e6b95dd3ed5e976124cf3e16eec4afcd46abeb12fbcf
SHA512c70cf287adf1be4c13870704effd9160491245a2fcec94c2f8d2da606c660a3c4d3da59bafdd6a01f55aafb0048ce912c4f9766456974fa8ff040fda8d6170ed