Analysis
-
max time kernel
12s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-01-2025 15:54
General
-
Target
32e2125a7c3090175fd8253ed30b27b6a89b52df60c5e57e9527c4191f0c2b0dN.dll
-
Size
564KB
-
MD5
16c5d977ae701decdb14be3c320d0ae0
-
SHA1
3f40ccb081cb653d92b09e0f0f7eb78f6daeab6b
-
SHA256
32e2125a7c3090175fd8253ed30b27b6a89b52df60c5e57e9527c4191f0c2b0d
-
SHA512
8435151662d7b1258507337b7dab14a7a9f15ee524c0885018a91b9b4fc09a4d24583e502d82dfc63c6e9f905ef77ff6b959977b35a930852e67a9027294d83c
-
SSDEEP
12288:tehnaNPpSVZmNxRCwnwm3W3OHIIf5m9RhWFV4:teh0PpS6NxNnwYeOHXAhWT4
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 6 IoCs
-
Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
-
Ramnit family
-
Sality
Sality is backdoor written in C++, first discovered in 2003.
-
Sality family
-
UAC bypass 3 TTPs 2 IoCs
-
Windows security bypass 2 TTPs 12 IoCs
-
Executes dropped EXE 2 IoCs
-
Windows security modification 2 TTPs 14 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Enumerates connected drives 3 TTPs 6 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory 1 IoCs
-
UPX packed file 40 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 3 IoCs
-
Drops file in Windows directory 1 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 26 IoCs
-
Suspicious behavior: EnumeratesProcesses 22 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\32e2125a7c3090175fd8253ed30b27b6a89b52df60c5e57e9527c4191f0c2b0dN.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\32e2125a7c3090175fd8253ed30b27b6a89b52df60c5e57e9527c4191f0c2b0dN.dll,#13⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"5⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe6⤵
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"6⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1652 CREDAT:17410 /prefetch:27⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"6⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3488 CREDAT:17410 /prefetch:27⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 6084⤵
- Program crash
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2896 -ip 28961⤵
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
471B
MD5fbd57568c7e969025fd7a77d6a9e5f45
SHA1d8c221556c7dbeb55cbfe80a3006b6578e2ae4bd
SHA256b820d32dc781d4a3af1cc452d73d4f57e1d963da4cdec90cb0660837657c8328
SHA512c8d4e5b78e01570d02f0953bd0ebd818ed2985dfc5006ba39ce101693f1bc9de8550b9149d3028911ec5c1371b813f0bc8391d10294e04022b52a91c3d47f5cf
-
Filesize
404B
MD5cc58dfe0852df26532cdd10792726cd2
SHA1f1313aac25d727e56920e1ebc3c98e4c78286938
SHA256b65f3145a07f21d8b15479a10fd25514cf0f1db98667edea52d0d559e0f1928b
SHA5121232b820e90f2b3ad73352d31120312d1479a152ab81d8709fe0060ebd069362cc05951a2c54e1be4360e6816fb85f33abf5ddfa802d28c895e5af32803358b0
-
Filesize
404B
MD594c81a1788ee4c73c77f7cf4340f15dc
SHA195f4f17b074a87ac253e76fba050bccf32476d06
SHA2565bbefe589f8133aa631fade407bc806bf04f953d58771be01134d327024b10fd
SHA512be5c4cc0e24c5383cefbbc98d3b42fc0760f0d477d1deb1c306da01f7c053ae3082c6b6cf79cdacd4203f34fff4b2553322e5c38abf3eaf39e5c99d3bdc0e874
-
Filesize
404B
MD5387c1bae3608d24494d9e3f85fef6758
SHA1cba2ae88fb31ebb30315f07777ec724274aa9ef4
SHA256c47823255e1b2e88656a5c7518e5ac95612e3c26e008eed0b70335c7bf91c75d
SHA512533bc5da433ddafe679e1be750b673bb8ff9487d61d656169df41baf9a3b48ae213f0ea7e9252589011d5cbeb8b82da46fa3b96d78c4eb696f9a755b10d54b66
-
Filesize
404B
MD526dfe6e689a36008daf7487d1e40456c
SHA143f35432c03adc505c32f410501c0c154cb8802b
SHA256658be434c19dd0aa10f3f67fe0b51ffec84440d86a530beeb86104be4a5519c7
SHA512db7ef9c1633f09f7bd87911f693b21c92b0f62f3a17fc10be7236bb9cbf73d2c85a08077a3f81962fa09965c2318e39f71395e99bd5e221d05d45094679eeae6
-
Filesize
5KB
MD5c8310f007c9deb6d911dab8bb16bce65
SHA1ff6a9c65c0283fd7aff98fbe8cfb0215229b1ed4
SHA256f7d373c83d62c0c218fb5758bd63fe09a50b81ac825afd2cf1d3982ebaff2a79
SHA51294c09fd8082a805dbc23f09b584024846ac9fcb6a3fdc005a43dce1ea453724e77fc677c544c6bdc1d7d35fc138e3d04cf7cdd9b3976f1b5e91de1196f608728
-
Filesize
5KB
MD5aa23d0bc8710e612cb5ab57f06acbb26
SHA1ab599a0d480f6b1c5b71c3dc59e60618c3339664
SHA2568d11d1bd3cc2706774a6b02ef0e16656ff56aa5175016057e1ff5a338f354f53
SHA512ace0a549bee3d6b6e6981d39dae7fefe09c9ddea647740501b6fea78d99f574f63d38bbc936851733d9cd7a81b5fc77ea1dc64630daa17a4755ade7b5d8014ba
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
257B
MD5a1bdb9873e7a02493b5aec003c021e8f
SHA1f37d7cc33f2713be493c6beb765329e3b94f28d3
SHA256058c7c30c7dda1ee1b72207c1b3027391649ef64f1cb4c1cd003402e878f20bf
SHA5123e06faa8dc37453a229faf5ef2dc3216fcc80dd6106211aca5dd05c01ed6c1cf117c8d9cc286d0d3aa676adcbd5b63a1d0b8b97200de667e82961cd8f16bcbe3
-
Filesize
164KB
MD5a3b1f1c4cd75bea10095e054f990bf1d
SHA115bf037b2166d2533e12bbec9f1d5f9a3ad8c81b
SHA256a4c51942f696650a7ce0530a88c3742380ac82bc1ddc75c24d1417f0958caaee
SHA5127457591c9676baa6043e4c3ae6ede364f19964c4e4e6a91a06e148221402791cabf9d5ab2bfcb629120ab136fee0a2994c0830f7cbfb112c5c6b07109b6a1a94
-
Filesize
100KB
MD5d4414988a8d230c92c01ef99b69ff32c
SHA18280a60e76a8191845f959a3ad8193bd92aecb44
SHA2569f1b2da47f6b3f41f256a611ee8ccc4c109f3aecb7805e54aaf73e939977eb03
SHA512219d50e2f0467b7beb1a43e01cbd63394bedc3a2b16f812a5b5972b4d475fe17b6ea534d5e78bb8a7d3b6f90d69b3de0cf5d1fd9de088da13be96ee54775c737
-
Filesize
4KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
208KB
-
Filesize
4KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
132KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
8KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
8KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
4KB
-
Filesize
132KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
132KB
-
Filesize
16.6MB
-
Filesize
8KB
-
Filesize
208KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
4KB
-
Filesize
16.6MB
-
Filesize
4KB
-
Filesize
16.6MB
-
Filesize
556KB
-
Filesize
556KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
132KB
-
Filesize
16.6MB
-
Filesize
132KB
-
Filesize
16.6MB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
16.6MB
-
Filesize
132KB
-
Filesize
16.6MB
-
Filesize
4KB
-
Filesize
132KB
-
Filesize
208KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
132KB
-
Filesize
16.6MB