Analysis
-
max time kernel
26s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
31-12-2024 14:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
646814c459b74e21239e3f7695f5d045d89f50adc0a942ed657094c5d8cf18d3N.dll
Resource
win7-20241010-en
windows7-x64
17 signatures
120 seconds
General
-
Target
646814c459b74e21239e3f7695f5d045d89f50adc0a942ed657094c5d8cf18d3N.dll
-
Size
120KB
-
MD5
8b41a85213e539ea9e329878f1209db0
-
SHA1
0e575edcc848c253814b12296a7d5e53dd26aeb6
-
SHA256
646814c459b74e21239e3f7695f5d045d89f50adc0a942ed657094c5d8cf18d3
-
SHA512
efac2d637acd285f368434983ccff61ba438499985d8aa691f4ae7f868a82b05ce8f3323fa79e54ef43b0f310d2b518031d96861af65928aa389fe0ea4b2c497
-
SSDEEP
1536:XUXZkf5smZJWRc/5gFqxxRTVEPViATRQMtbuNQIgaNVWgxmXPAXpwCNS6Cn:Epkf5KhsxxRJE9RQ5G3qx3nr
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f769fb9.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76bbb1.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76bbb1.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76bbb1.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f769fb9.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f769fb9.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f769fb9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76bbb1.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f769fb9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76bbb1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f769fb9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f769fb9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f769fb9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f769fb9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76bbb1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76bbb1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76bbb1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76bbb1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f769fb9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76bbb1.exe -
Executes dropped EXE 3 IoCs
pid Process 2996 f769fb9.exe 2828 f76a2e4.exe 2652 f76bbb1.exe -
Loads dropped DLL 6 IoCs
pid Process 3044 rundll32.exe 3044 rundll32.exe 3044 rundll32.exe 3044 rundll32.exe 3044 rundll32.exe 3044 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f769fb9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76bbb1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76bbb1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76bbb1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f769fb9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f769fb9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f769fb9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f769fb9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76bbb1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f769fb9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76bbb1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f769fb9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76bbb1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76bbb1.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f769fb9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76bbb1.exe -
Enumerates connected drives 3 TTPs 15 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: f769fb9.exe File opened (read-only) \??\E: f76bbb1.exe File opened (read-only) \??\E: f769fb9.exe File opened (read-only) \??\H: f769fb9.exe File opened (read-only) \??\J: f769fb9.exe File opened (read-only) \??\P: f769fb9.exe File opened (read-only) \??\O: f769fb9.exe File opened (read-only) \??\G: f769fb9.exe File opened (read-only) \??\K: f769fb9.exe File opened (read-only) \??\L: f769fb9.exe File opened (read-only) \??\M: f769fb9.exe File opened (read-only) \??\I: f769fb9.exe File opened (read-only) \??\N: f769fb9.exe File opened (read-only) \??\R: f769fb9.exe File opened (read-only) \??\S: f769fb9.exe -
resource yara_rule behavioral1/memory/2996-11-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2996-14-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2996-17-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2996-13-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2996-21-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2996-19-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2996-18-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2996-16-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2996-15-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2996-20-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2996-59-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2996-60-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2996-61-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2996-62-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2996-63-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2996-65-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2996-66-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2996-82-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2996-84-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2996-87-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2996-88-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2996-154-0x0000000000670000-0x000000000172A000-memory.dmp upx behavioral1/memory/2652-171-0x0000000000A00000-0x0000000001ABA000-memory.dmp upx behavioral1/memory/2652-209-0x0000000000A00000-0x0000000001ABA000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI f769fb9.exe File created C:\Windows\f76f22c f76bbb1.exe File created C:\Windows\f769ff7 f769fb9.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f769fb9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76bbb1.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2996 f769fb9.exe 2996 f769fb9.exe 2652 f76bbb1.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 2996 f769fb9.exe Token: SeDebugPrivilege 2996 f769fb9.exe Token: SeDebugPrivilege 2996 f769fb9.exe Token: SeDebugPrivilege 2996 f769fb9.exe Token: SeDebugPrivilege 2996 f769fb9.exe Token: SeDebugPrivilege 2996 f769fb9.exe Token: SeDebugPrivilege 2996 f769fb9.exe Token: SeDebugPrivilege 2996 f769fb9.exe Token: SeDebugPrivilege 2996 f769fb9.exe Token: SeDebugPrivilege 2996 f769fb9.exe Token: SeDebugPrivilege 2996 f769fb9.exe Token: SeDebugPrivilege 2996 f769fb9.exe Token: SeDebugPrivilege 2996 f769fb9.exe Token: SeDebugPrivilege 2996 f769fb9.exe Token: SeDebugPrivilege 2996 f769fb9.exe Token: SeDebugPrivilege 2996 f769fb9.exe Token: SeDebugPrivilege 2996 f769fb9.exe Token: SeDebugPrivilege 2996 f769fb9.exe Token: SeDebugPrivilege 2996 f769fb9.exe Token: SeDebugPrivilege 2996 f769fb9.exe Token: SeDebugPrivilege 2996 f769fb9.exe Token: SeDebugPrivilege 2996 f769fb9.exe Token: SeDebugPrivilege 2996 f769fb9.exe Token: SeDebugPrivilege 2652 f76bbb1.exe Token: SeDebugPrivilege 2652 f76bbb1.exe Token: SeDebugPrivilege 2652 f76bbb1.exe Token: SeDebugPrivilege 2652 f76bbb1.exe Token: SeDebugPrivilege 2652 f76bbb1.exe Token: SeDebugPrivilege 2652 f76bbb1.exe Token: SeDebugPrivilege 2652 f76bbb1.exe Token: SeDebugPrivilege 2652 f76bbb1.exe Token: SeDebugPrivilege 2652 f76bbb1.exe Token: SeDebugPrivilege 2652 f76bbb1.exe Token: SeDebugPrivilege 2652 f76bbb1.exe Token: SeDebugPrivilege 2652 f76bbb1.exe Token: SeDebugPrivilege 2652 f76bbb1.exe Token: SeDebugPrivilege 2652 f76bbb1.exe Token: SeDebugPrivilege 2652 f76bbb1.exe Token: SeDebugPrivilege 2652 f76bbb1.exe Token: SeDebugPrivilege 2652 f76bbb1.exe Token: SeDebugPrivilege 2652 f76bbb1.exe Token: SeDebugPrivilege 2652 f76bbb1.exe Token: SeDebugPrivilege 2652 f76bbb1.exe Token: SeDebugPrivilege 2652 f76bbb1.exe Token: SeDebugPrivilege 2652 f76bbb1.exe Token: SeDebugPrivilege 2652 f76bbb1.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2360 wrote to memory of 3044 2360 rundll32.exe 30 PID 2360 wrote to memory of 3044 2360 rundll32.exe 30 PID 2360 wrote to memory of 3044 2360 rundll32.exe 30 PID 2360 wrote to memory of 3044 2360 rundll32.exe 30 PID 2360 wrote to memory of 3044 2360 rundll32.exe 30 PID 2360 wrote to memory of 3044 2360 rundll32.exe 30 PID 2360 wrote to memory of 3044 2360 rundll32.exe 30 PID 3044 wrote to memory of 2996 3044 rundll32.exe 31 PID 3044 wrote to memory of 2996 3044 rundll32.exe 31 PID 3044 wrote to memory of 2996 3044 rundll32.exe 31 PID 3044 wrote to memory of 2996 3044 rundll32.exe 31 PID 2996 wrote to memory of 1116 2996 f769fb9.exe 19 PID 2996 wrote to memory of 1176 2996 f769fb9.exe 20 PID 2996 wrote to memory of 1204 2996 f769fb9.exe 21 PID 2996 wrote to memory of 1500 2996 f769fb9.exe 23 PID 2996 wrote to memory of 2360 2996 f769fb9.exe 29 PID 2996 wrote to memory of 3044 2996 f769fb9.exe 30 PID 2996 wrote to memory of 3044 2996 f769fb9.exe 30 PID 3044 wrote to memory of 2828 3044 rundll32.exe 32 PID 3044 wrote to memory of 2828 3044 rundll32.exe 32 PID 3044 wrote to memory of 2828 3044 rundll32.exe 32 PID 3044 wrote to memory of 2828 3044 rundll32.exe 32 PID 3044 wrote to memory of 2652 3044 rundll32.exe 33 PID 3044 wrote to memory of 2652 3044 rundll32.exe 33 PID 3044 wrote to memory of 2652 3044 rundll32.exe 33 PID 3044 wrote to memory of 2652 3044 rundll32.exe 33 PID 2996 wrote to memory of 1116 2996 f769fb9.exe 19 PID 2996 wrote to memory of 1176 2996 f769fb9.exe 20 PID 2996 wrote to memory of 1204 2996 f769fb9.exe 21 PID 2996 wrote to memory of 1500 2996 f769fb9.exe 23 PID 2996 wrote to memory of 2828 2996 f769fb9.exe 32 PID 2996 wrote to memory of 2828 2996 f769fb9.exe 32 PID 2996 wrote to memory of 2652 2996 f769fb9.exe 33 PID 2996 wrote to memory of 2652 2996 f769fb9.exe 33 PID 2652 wrote to memory of 1116 2652 f76bbb1.exe 19 PID 2652 wrote to memory of 1176 2652 f76bbb1.exe 20 PID 2652 wrote to memory of 1204 2652 f76bbb1.exe 21 PID 2652 wrote to memory of 1500 2652 f76bbb1.exe 23 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f769fb9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76bbb1.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1116
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1176
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1204
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\646814c459b74e21239e3f7695f5d045d89f50adc0a942ed657094c5d8cf18d3N.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\646814c459b74e21239e3f7695f5d045d89f50adc0a942ed657094c5d8cf18d3N.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\f769fb9.exeC:\Users\Admin\AppData\Local\Temp\f769fb9.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2996
-
-
C:\Users\Admin\AppData\Local\Temp\f76a2e4.exeC:\Users\Admin\AppData\Local\Temp\f76a2e4.exe4⤵
- Executes dropped EXE
PID:2828
-
-
C:\Users\Admin\AppData\Local\Temp\f76bbb1.exeC:\Users\Admin\AppData\Local\Temp\f76bbb1.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2652
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1500
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD552f81f824348483fc1bc9d15b500ad5d
SHA1fb71fa60db74b62f1ade1c412a9199e75f92c0a5
SHA25607a694347b59132f68e7d1270607be27694790c3099357d64d7a0146b7ac6e13
SHA51234ee67a33df0253ec846410bf4a9e65660388c37e85b7d525c15cbaf0aa42accf3fe84d6fe3ad885c56ab48b3023d33c581e573f60d90b8f3cf39b63fd67d91c
-
Filesize
257B
MD50f9a9dd51cc31f47875cbc12beaae67d
SHA1bad2fdc8d8d8b817682655bfc0c4bd476fd354a1
SHA25683274817b54ac2390fd13cca2ed92953dbcf2bafe6ef794fb1c4dfd0aad0dba6
SHA512a279885005ec3290a93aca4c6397f29d1fd75b0c58c6ecfb057c1de44c48a13f4f3ad4ded883d9bae9b1058f18d30fc236dfae592963329e63b33f6c54f11fdf