Analysis
-
max time kernel
79s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
01-01-2025 00:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b9ca2f7b8a0d29a63649e7f3b2eb2cba548f610705e48c1dadbacbe58c1248f3.dll
Resource
win7-20240903-en
windows7-x64
17 signatures
120 seconds
General
-
Target
b9ca2f7b8a0d29a63649e7f3b2eb2cba548f610705e48c1dadbacbe58c1248f3.dll
-
Size
120KB
-
MD5
eb6ac65767bdfb15721ad2097182a1b4
-
SHA1
ab920f5b87d1f3af1ca5660e4bdc7e9ee5301771
-
SHA256
b9ca2f7b8a0d29a63649e7f3b2eb2cba548f610705e48c1dadbacbe58c1248f3
-
SHA512
2e2aa483ab5701baea170896506b2e96ddda822639178707667685a109c314ae340f316f219d02afec7ba3f7944e49ce66a1e31c96d8b4de3d6fe36f03f2b273
-
SSDEEP
3072:UZWZ0zaRvsmGFSi42JcYNOPv7it2Mh+UWj1AVvlv0D3S:UZWwYvsmO9X7Oritlh+UWIdcC
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f76e8ba.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f76e8ba.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f76e8ba.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" f770760.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" f770760.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" f770760.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76e8ba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f770760.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76e8ba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f770760.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f770760.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76e8ba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76e8ba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f770760.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f770760.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f770760.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76e8ba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76e8ba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76e8ba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f770760.exe -
Executes dropped EXE 3 IoCs
pid Process 2808 f76e8ba.exe 2212 f76eaad.exe 328 f770760.exe -
Loads dropped DLL 6 IoCs
pid Process 2676 rundll32.exe 2676 rundll32.exe 2676 rundll32.exe 2676 rundll32.exe 2676 rundll32.exe 2676 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f76e8ba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f770760.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f76e8ba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f770760.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f770760.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc f770760.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f76e8ba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" f76e8ba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" f770760.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f770760.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" f76e8ba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" f76e8ba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" f76e8ba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" f770760.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76e8ba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f770760.exe -
Enumerates connected drives 3 TTPs 17 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: f76e8ba.exe File opened (read-only) \??\K: f76e8ba.exe File opened (read-only) \??\S: f76e8ba.exe File opened (read-only) \??\T: f76e8ba.exe File opened (read-only) \??\E: f770760.exe File opened (read-only) \??\J: f76e8ba.exe File opened (read-only) \??\L: f76e8ba.exe File opened (read-only) \??\O: f76e8ba.exe File opened (read-only) \??\R: f76e8ba.exe File opened (read-only) \??\H: f76e8ba.exe File opened (read-only) \??\M: f76e8ba.exe File opened (read-only) \??\N: f76e8ba.exe File opened (read-only) \??\E: f76e8ba.exe File opened (read-only) \??\G: f76e8ba.exe File opened (read-only) \??\P: f76e8ba.exe File opened (read-only) \??\Q: f76e8ba.exe File opened (read-only) \??\G: f770760.exe -
resource yara_rule behavioral1/memory/2808-17-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/2808-20-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/2808-23-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/2808-22-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/2808-21-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/2808-19-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/2808-18-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/2808-16-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/2808-15-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/2808-24-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/2808-66-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/2808-65-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/2808-67-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/2808-69-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/2808-68-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/2808-71-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/2808-72-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/2808-73-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/2808-74-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/2808-90-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/2808-158-0x0000000000680000-0x000000000173A000-memory.dmp upx behavioral1/memory/328-172-0x0000000000930000-0x00000000019EA000-memory.dmp upx behavioral1/memory/328-214-0x0000000000930000-0x00000000019EA000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\f76e927 f76e8ba.exe File opened for modification C:\Windows\SYSTEM.INI f76e8ba.exe File created C:\Windows\f773aa0 f770760.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f76e8ba.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f770760.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2808 f76e8ba.exe 2808 f76e8ba.exe 328 f770760.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeDebugPrivilege 2808 f76e8ba.exe Token: SeDebugPrivilege 2808 f76e8ba.exe Token: SeDebugPrivilege 2808 f76e8ba.exe Token: SeDebugPrivilege 2808 f76e8ba.exe Token: SeDebugPrivilege 2808 f76e8ba.exe Token: SeDebugPrivilege 2808 f76e8ba.exe Token: SeDebugPrivilege 2808 f76e8ba.exe Token: SeDebugPrivilege 2808 f76e8ba.exe Token: SeDebugPrivilege 2808 f76e8ba.exe Token: SeDebugPrivilege 2808 f76e8ba.exe Token: SeDebugPrivilege 2808 f76e8ba.exe Token: SeDebugPrivilege 2808 f76e8ba.exe Token: SeDebugPrivilege 2808 f76e8ba.exe Token: SeDebugPrivilege 2808 f76e8ba.exe Token: SeDebugPrivilege 2808 f76e8ba.exe Token: SeDebugPrivilege 2808 f76e8ba.exe Token: SeDebugPrivilege 2808 f76e8ba.exe Token: SeDebugPrivilege 2808 f76e8ba.exe Token: SeDebugPrivilege 2808 f76e8ba.exe Token: SeDebugPrivilege 2808 f76e8ba.exe Token: SeDebugPrivilege 2808 f76e8ba.exe Token: SeDebugPrivilege 2808 f76e8ba.exe Token: SeDebugPrivilege 2808 f76e8ba.exe Token: SeDebugPrivilege 2808 f76e8ba.exe Token: SeDebugPrivilege 328 f770760.exe Token: SeDebugPrivilege 328 f770760.exe Token: SeDebugPrivilege 328 f770760.exe Token: SeDebugPrivilege 328 f770760.exe Token: SeDebugPrivilege 328 f770760.exe Token: SeDebugPrivilege 328 f770760.exe Token: SeDebugPrivilege 328 f770760.exe Token: SeDebugPrivilege 328 f770760.exe Token: SeDebugPrivilege 328 f770760.exe Token: SeDebugPrivilege 328 f770760.exe Token: SeDebugPrivilege 328 f770760.exe Token: SeDebugPrivilege 328 f770760.exe Token: SeDebugPrivilege 328 f770760.exe Token: SeDebugPrivilege 328 f770760.exe Token: SeDebugPrivilege 328 f770760.exe Token: SeDebugPrivilege 328 f770760.exe Token: SeDebugPrivilege 328 f770760.exe Token: SeDebugPrivilege 328 f770760.exe Token: SeDebugPrivilege 328 f770760.exe Token: SeDebugPrivilege 328 f770760.exe Token: SeDebugPrivilege 328 f770760.exe Token: SeDebugPrivilege 328 f770760.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2656 wrote to memory of 2676 2656 rundll32.exe 31 PID 2656 wrote to memory of 2676 2656 rundll32.exe 31 PID 2656 wrote to memory of 2676 2656 rundll32.exe 31 PID 2656 wrote to memory of 2676 2656 rundll32.exe 31 PID 2656 wrote to memory of 2676 2656 rundll32.exe 31 PID 2656 wrote to memory of 2676 2656 rundll32.exe 31 PID 2656 wrote to memory of 2676 2656 rundll32.exe 31 PID 2676 wrote to memory of 2808 2676 rundll32.exe 32 PID 2676 wrote to memory of 2808 2676 rundll32.exe 32 PID 2676 wrote to memory of 2808 2676 rundll32.exe 32 PID 2676 wrote to memory of 2808 2676 rundll32.exe 32 PID 2808 wrote to memory of 1120 2808 f76e8ba.exe 19 PID 2808 wrote to memory of 1176 2808 f76e8ba.exe 20 PID 2808 wrote to memory of 1204 2808 f76e8ba.exe 21 PID 2808 wrote to memory of 1568 2808 f76e8ba.exe 23 PID 2808 wrote to memory of 2656 2808 f76e8ba.exe 30 PID 2808 wrote to memory of 2676 2808 f76e8ba.exe 31 PID 2808 wrote to memory of 2676 2808 f76e8ba.exe 31 PID 2676 wrote to memory of 2212 2676 rundll32.exe 33 PID 2676 wrote to memory of 2212 2676 rundll32.exe 33 PID 2676 wrote to memory of 2212 2676 rundll32.exe 33 PID 2676 wrote to memory of 2212 2676 rundll32.exe 33 PID 2676 wrote to memory of 328 2676 rundll32.exe 34 PID 2676 wrote to memory of 328 2676 rundll32.exe 34 PID 2676 wrote to memory of 328 2676 rundll32.exe 34 PID 2676 wrote to memory of 328 2676 rundll32.exe 34 PID 2808 wrote to memory of 1120 2808 f76e8ba.exe 19 PID 2808 wrote to memory of 1176 2808 f76e8ba.exe 20 PID 2808 wrote to memory of 1204 2808 f76e8ba.exe 21 PID 2808 wrote to memory of 1568 2808 f76e8ba.exe 23 PID 2808 wrote to memory of 2212 2808 f76e8ba.exe 33 PID 2808 wrote to memory of 2212 2808 f76e8ba.exe 33 PID 2808 wrote to memory of 328 2808 f76e8ba.exe 34 PID 2808 wrote to memory of 328 2808 f76e8ba.exe 34 PID 328 wrote to memory of 1120 328 f770760.exe 19 PID 328 wrote to memory of 1176 328 f770760.exe 20 PID 328 wrote to memory of 1204 328 f770760.exe 21 PID 328 wrote to memory of 1568 328 f770760.exe 23 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f76e8ba.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" f770760.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1120
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1176
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1204
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b9ca2f7b8a0d29a63649e7f3b2eb2cba548f610705e48c1dadbacbe58c1248f3.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b9ca2f7b8a0d29a63649e7f3b2eb2cba548f610705e48c1dadbacbe58c1248f3.dll,#13⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\f76e8ba.exeC:\Users\Admin\AppData\Local\Temp\f76e8ba.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2808
-
-
C:\Users\Admin\AppData\Local\Temp\f76eaad.exeC:\Users\Admin\AppData\Local\Temp\f76eaad.exe4⤵
- Executes dropped EXE
PID:2212
-
-
C:\Users\Admin\AppData\Local\Temp\f770760.exeC:\Users\Admin\AppData\Local\Temp\f770760.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:328
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1568
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
257B
MD5a4a39a4a00ddf9b1c3ab6a4fc4b94c47
SHA1122a60041b3b586351796f21ee03074de1e16ef8
SHA256f81b219c103ccde6b85ea768dcd1f90a3c046459eaeaa29c17c4a48166b41f8e
SHA5128251dd8a2dd362b8d954833d1753357deb68ed464c9bff07326329e8a6435fdd0fe6af94bac970d5f8efdc15319cd86ad9787c1e06f81cd995be8ec57b29b3a8
-
Filesize
97KB
MD5bbc10c7ba3dfea281f7d7bfe26d31439
SHA17b0ef0df1129ac9c9073aeabd92ee94c68f68079
SHA256cbe2f240b04c1c71cea52c463d610f885a34f907ea1080a0447cf32e4d198396
SHA512489c0439f3e6fbb49da1297b49f1961a7c5b4d469be2b891a10c225f8817b305f0d816b126692acc02227ad4d6446619f6718b0a11d7589972204d5f17eaa246