Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
18-02-2025 08:11
General
-
Target
f9b1e031217e695b1a0186196e427da3d3bc8b69048d375b450c43ad17357e97.dll
-
Size
564KB
-
MD5
c97234c961cf01efb0a565d4582a6a88
-
SHA1
77578e03b74e67960ada2a63ff0caf4ed33ad39b
-
SHA256
f9b1e031217e695b1a0186196e427da3d3bc8b69048d375b450c43ad17357e97
-
SHA512
3d5120ab7e2c9a44e55475154eb19de7088c14e88a921d9fec4b672ff1050993e70e16609d668e5c90a42021c61fc57f3c80cbf85e0c18f1557e204eb50c3457
-
SSDEEP
12288:tehnaNPpSVZmNxRCwnwm3W3OHIIf5m9RhWFV2:teh0PpS6NxNnwYeOHXAhWT2
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
-
Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
-
Ramnit family
-
Sality
Sality is backdoor written in C++, first discovered in 2003.
-
Sality family
-
UAC bypass 3 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 6 IoCs
-
Executes dropped EXE 2 IoCs
-
Windows security modification 2 TTPs 7 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
UPX packed file 15 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 3 IoCs
-
Drops file in Windows directory 1 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 17 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 28 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f9b1e031217e695b1a0186196e427da3d3bc8b69048d375b450c43ad17357e97.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f9b1e031217e695b1a0186196e427da3d3bc8b69048d375b450c43ad17357e97.dll,#12⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe5⤵
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1928 CREDAT:17410 /prefetch:26⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5064 CREDAT:17410 /prefetch:26⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 6163⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4688 -ip 46881⤵
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
471B
MD5ea3f03c5b368ac9d09a5bb60fc7982c6
SHA16390751860b3be03d8dab99586daa226d3e0d8de
SHA2564f2e2602ea6f7c43a4af3f99a407f710df7de999d4f35d0629b7a80ef18ae43c
SHA512dc3a0402b58d18fd1ac1f0acf31a5af64e900a2ee12e77b09cec272357e4b9f902fb9fbb453f5064517f2e91d9dd7958f44d94c79a8bbd99de8afbf33c3035ac
-
Filesize
400B
MD5afdb8ebcde93cc0123bc07f36269e0df
SHA1f2e2895c4299b03694b8e42fa36755767cdc1e82
SHA2567fb81e219560fc646aa0d1c20b7c4a610be489b7b69f712614eca74bb6498b9f
SHA5127db5d966248237e8b95ebddcc0c58fcc4bca743493cb05b7afbf4bfdf0482435787fb15502165b9788c9c9aaf13328203ec8b7a40389f9c362eb62ba600b6dfe
-
Filesize
400B
MD517d1f55843b9196006445cc115a8f887
SHA185730339336d25f2c59c40a082191b67864be61c
SHA2568d2d15fc8311ff5365149a7a650a877eb3ea6a029fcff68a8ecc5f9c32e5a0b5
SHA512c09a323df96f1c30ee9bce1dcba88efc2fa6f0d8d02dd498c143c1ec7e2fdf55522191ab9dba1f01b664194072436e204c92d6534d7a3c306d11a57880642817
-
Filesize
4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
Filesize
5KB
MD541c6845eb2956fc19484761f3d61eed1
SHA12eb6c51f1943c5fbbf9c3f63e24dbea64d649909
SHA25681c73d92fcf1d596387373bc6a8184350ce9e2029abf4624758901f3c5517417
SHA51225bd381212fbefc4cefb8df75cfebba1b18f0a566bfbfeedcef75047e18aede9ef8a779789959723a4493c3b60e45b75c98aeee21747232df46a3ab8a5abf245
-
Filesize
3KB
MD5b0230f74c934c4dd01491776c7c9d0b5
SHA12d7342ad1ac6c7c15194f2e3f22978b1ba7e092d
SHA25691ea77f60f7271f4904992f83fc9d8ac191683f12f6863b7de1a1dab440b3ac1
SHA5120151c7ffd9db425b08ef2cdb7f05e5fa9c697cbc33f27c463ef919fa1054a0efb79891dd6ecbfdb0e7897d3ffd6dab768d173a39544860860e7818d1dfb447cb
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
164KB
MD5a3b1f1c4cd75bea10095e054f990bf1d
SHA115bf037b2166d2533e12bbec9f1d5f9a3ad8c81b
SHA256a4c51942f696650a7ce0530a88c3742380ac82bc1ddc75c24d1417f0958caaee
SHA5127457591c9676baa6043e4c3ae6ede364f19964c4e4e6a91a06e148221402791cabf9d5ab2bfcb629120ab136fee0a2994c0830f7cbfb112c5c6b07109b6a1a94
-
Filesize
16.6MB
-
Filesize
132KB
-
Filesize
16.6MB
-
Filesize
40KB
-
Filesize
208KB
-
Filesize
16.6MB
-
Filesize
16KB
-
Filesize
16.6MB
-
Filesize
132KB
-
Filesize
16.6MB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
84KB
-
Filesize
556KB
-
Filesize
556KB
-
Filesize
4KB
-
Filesize
132KB
-
Filesize
208KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
132KB
-
Filesize
208KB