Analysis
-
max time kernel
122s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
01-02-2025 12:31
General
-
Target
2025-02-01_fe61638e689836d59ab380f80c603d7d_avoslocker_hijackloader_luca-stealer.exe
-
Size
1.2MB
-
MD5
fe61638e689836d59ab380f80c603d7d
-
SHA1
8babe0bd685a639572e820b24a20cb2b047c8dd5
-
SHA256
f20e5a0c0c57f149405c928698a0df25419d14ae4f22fe6fb8b14c5cd2abdbab
-
SHA512
3f14ad266d3d668f3d118e08e9071802377dbd66fd4c6b8b865521b38ea8f8e7a668c5a98f76b801874dd2e6ef48f7391324c4cc72086465abbe99b3c357f9aa
-
SSDEEP
24576:f39kAORJa1/6YXgwYcbrW+5/85RkVeWXgGH:1TIIrXgCm+5UfkVZXg4
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
http://klkjwre77638dfqwieuoi888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
-
Sality
Sality is backdoor written in C++, first discovered in 2003.
-
Sality family
-
UAC bypass 3 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 6 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Disables Task Manager via registry modification
-
Windows security modification 2 TTPs 7 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
UPX packed file 12 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 23 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\2025-02-01_fe61638e689836d59ab380f80c603d7d_avoslocker_hijackloader_luca-stealer.exe"C:\Users\Admin\AppData\Local\Temp\2025-02-01_fe61638e689836d59ab380f80c603d7d_avoslocker_hijackloader_luca-stealer.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files\Java\jre7\bin\javaws.exe"C:\Program Files\Java\jre7\bin\javaws.exe" -J-Djdk.disableLastUsageTracking=true -SSVBaselineUpdate3⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre7\bin\jp2launcher.exe"C:\Program Files\Java\jre7\bin\jp2launcher.exe" -secure -javaws -jre "C:\Program Files\Java\jre7" -vma LWNsYXNzcGF0aABDOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlN1xsaWJcZGVwbG95LmphcgAtRGphdmEuc2VjdXJpdHkucG9saWN5PWZpbGU6QzpcUHJvZ3JhbSBGaWxlc1xKYXZhXGpyZTdcbGliXHNlY3VyaXR5XGphdmF3cy5wb2xpY3kALUR0cnVzdFByb3h5PXRydWUALVh2ZXJpZnk6cmVtb3RlAC1Eam5scHguaG9tZT1DOlxQcm9ncmFtIEZpbGVzXEphdmFcanJlN1xiaW4ALURqYXZhLnNlY3VyaXR5Lm1hbmFnZXIALURzdW4uYXd0Lndhcm11cD10cnVlAC1YYm9vdGNsYXNzcGF0aC9hOkM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmU3XGxpYlxqYXZhd3MuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmU3XGxpYlxkZXBsb3kuamFyO0M6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmU3XGxpYlxwbHVnaW4uamFyAC1EamRrLmRpc2FibGVMYXN0VXNhZ2VUcmFja2luZz10cnVlAC1Eam5scHguanZtPUM6XFByb2dyYW0gRmlsZXNcSmF2YVxqcmU3XGJpblxqYXZhdy5leGUALURqbmxweC52bWFyZ3M9TFVScVpHc3VaR2x6WVdKc1pVeGhjM1JWYzJGblpWUnlZV05yYVc1blBYUnlkV1VB -ma LVNTVkJhc2VsaW5lVXBkYXRlAC1ub3RXZWJKYXZh4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD5f9e48186bd918afaf08544e709341184
SHA1978f291344ab0d51dddcb661dbf05034073f15aa
SHA25632ec1dd00faab8c0fbd489644fef40f70a509fbdb578e1b9854876f380572ca4
SHA512f735a4d6dd3620a51c2e1454c2a105c83b76bf26b5f9f1df3ce79308b56c6a9789ed49e527eedbb1723714fffaac247b374f2f188dcdf53249fd65214e8dbb68
-
Filesize
685B
MD5c36daf3348b8f19571f11e9b1c113dcc
SHA1fdc130f6afbd66d1cd1e4a71d63f3a23c3341aad
SHA2568f25bd88141fb1320f8652d95720aa6b43e40c89810cba01ef1f802a2fef6cbc
SHA5123f665bc33885cbe26c4de44660c7b9ce031d5f3ee954293928f75184075fe924ce5d346fe9d7fc5d33a7879b9bc265099dff4e3b71e27b93a9629ca643fd5809
-
Filesize
12KB
MD5f47403fc5f6534d1eb5e6a4088c86d84
SHA1ed2116d28be10439a9f35145a21535ecfba196f5
SHA256ec77ef8b1cbf32edf02950406ca4fcb7edcef00bf498b1a714d734363881b97a
SHA512937af202eedc100d0cd146554cbd2a98c580210ece2f0e92a1f7d6d1dfc49cd9f0e47867e707fb6e57725ae62210d38af2df25062ac838e3ac42b3b4c37ec90d
-
Filesize
3KB
MD57b75869331a2bca770be76de3a8c20e0
SHA119016345b241357cd851655c28c3764d61b99685
SHA256116e9e9864df2d5bc426a6b246037de9e15911d547e390b6c28cf1bb05f21790
SHA5126848e636676578362ca5a10ab97bacdc633a6c9ee598dfe762f86cf0c941708e218c1df0eef410a98e51c662772b879fcab1537b918f5ba3fe4f503b379faec2
-
Filesize
8KB
MD5e90ffa3b58486aa9182336b0719c3c38
SHA16d2a188142f14856306b12d8b8a7594250607051
SHA256b9be6013fb46d3dc418867faeee5a32463a704164e1850a8c4aff2dd98fb482b
SHA5129e33387e212eb22b0ae0a817f3b6bfc1d8504f0f778c524cd4b8049a8f624135998b214845a649d39ef7a39ebb8cb4caf611fee379229726b7bec68e2e4ca855
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
16.6MB
-
Filesize
8KB
-
Filesize
16.6MB
-
Filesize
1.2MB
-
Filesize
2.4MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
2.4MB