sality | ed4fcc5e4fdb0e6898ffbdcfe8cdbf6e98e7ea83a5dc7d3bb808966bcd740a3d

General

Target
ed4fcc5e4fdb0e6898ffbdcfe8cdbf6e98e7ea83a5dc7d3bb808966bcd740a3d.exe
Size 641KB
Sample261027-e686psbv2j
SHA256 ed4fcc5e4fdb0e6898ffbdcfe8cdbf6e98e7ea83a5dc7d3bb808966bcd740a3d
MD5 51cbead6c3c8c1c667f3399f2f1be0f9
SHA1 219898b0145fe9947640d0a315a80a09350f57a1
SHA512 c372c9d0a2e1ab73c77220304d2a299d9fdc84c28d649babbf4337e3294a9ef149409646c2e8d5dcaae3151470da195256cc14383ffecf3e71c3dbd038dd39ac
SSDEEP 12288:DpbraQBVterMIztyCK5x8CBmn+RrNbEyWYa0Ie1vUx9Vz:Dp6QjGZyCA8CBmn+RrNj9ay5Iz
TLSH
T167D4AF71F6D18537D12B1BB48C1B9269A8397F102E28644E7BED2D0C9F3D78139292E7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor defense_evasion discovery execution sality trojan upx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif

Signatures

Family: Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

Windows security bypass 2 TTPs 6 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	ed4fcc5e4fdb0e6898ffbdcfe8cdbf6e98e7ea83a5dc7d3bb808966bcd740a3d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	ed4fcc5e4fdb0e6898ffbdcfe8cdbf6e98e7ea83a5dc7d3bb808966bcd740a3d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	ed4fcc5e4fdb0e6898ffbdcfe8cdbf6e98e7ea83a5dc7d3bb808966bcd740a3d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	ed4fcc5e4fdb0e6898ffbdcfe8cdbf6e98e7ea83a5dc7d3bb808966bcd740a3d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	ed4fcc5e4fdb0e6898ffbdcfe8cdbf6e98e7ea83a5dc7d3bb808966bcd740a3d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	ed4fcc5e4fdb0e6898ffbdcfe8cdbf6e98e7ea83a5dc7d3bb808966bcd740a3d.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	cmd.exe

Windows security modification 2 TTPs 7 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	ed4fcc5e4fdb0e6898ffbdcfe8cdbf6e98e7ea83a5dc7d3bb808966bcd740a3d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	ed4fcc5e4fdb0e6898ffbdcfe8cdbf6e98e7ea83a5dc7d3bb808966bcd740a3d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	ed4fcc5e4fdb0e6898ffbdcfe8cdbf6e98e7ea83a5dc7d3bb808966bcd740a3d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	ed4fcc5e4fdb0e6898ffbdcfe8cdbf6e98e7ea83a5dc7d3bb808966bcd740a3d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	ed4fcc5e4fdb0e6898ffbdcfe8cdbf6e98e7ea83a5dc7d3bb808966bcd740a3d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	ed4fcc5e4fdb0e6898ffbdcfe8cdbf6e98e7ea83a5dc7d3bb808966bcd740a3d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	ed4fcc5e4fdb0e6898ffbdcfe8cdbf6e98e7ea83a5dc7d3bb808966bcd740a3d.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1016-10-0x0000000000830000-0x00000000018EA000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	ed4fcc5e4fdb0e6898ffbdcfe8cdbf6e98e7ea83a5dc7d3bb808966bcd740a3d.exe
File created	C:\Windows\Logo1_.exe	ed4fcc5e4fdb0e6898ffbdcfe8cdbf6e98e7ea83a5dc7d3bb808966bcd740a3d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4524	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ed4fcc5e4fdb0e6898ffbdcfe8cdbf6e98e7ea83a5dc7d3bb808966bcd740a3d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4524	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1016 wrote to memory of 4524	1016	ed4fcc5e4fdb0e6898ffbdcfe8cdbf6e98e7ea83a5dc7d3bb808966bcd740a3d.exe	86

C:\Users\Admin\AppData\Local\Temp\ed4fcc5e4fdb0e6898ffbdcfe8cdbf6e98e7ea83a5dc7d3bb808966bcd740a3d.exe
"C:\Users\Admin\AppData\Local\Temp\ed4fcc5e4fdb0e6898ffbdcfe8cdbf6e98e7ea83a5dc7d3bb808966bcd740a3d.exe"
1⤵
- Windows security bypass
- Windows security modification
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1016
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E9C.bat
  2⤵
  - Checks computer location settings
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

$$a9E9C.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a9E9C.bat
Size 722B
SHA256 47296a6cc88904ff19c32015a4c00e6297296d5b9599ae3a450b27999f9b34c2
MD5 b25622f499c5a3e2d7d708cb2408f494
SHA1 849d223702ee2ac93dfb9d874a008d4a0e8e4d27
SHA512 113c2a76b02e75bd8f0049d50e9f3263869f5a742933befd322f5470f3ee310420337914a3f76c48014211fe3b679a7f20fe5b4ac871bc57c9f39c65aa21d451
TLSH
T1AB01960E6382ABAF745678E765365DED80E74B992BCE325446308439228B42B7FDA131
MD5 SHA1 SHA512 TLSH

Submit Download

ed4fcc5e4fdb0e6898ffbdcfe8cdbf6e98e7ea83a5dc7d3bb808966bcd740a3d.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\ed4fcc5e4fdb0e6898ffbdcfe8cdbf6e98e7ea83a5dc7d3bb808966bcd740a3d.exe.exe
Size 614KB
SHA256 c6c34f3829cbcfe75ad2f94e37ffdbedcae91d1f4cd70dfb2ffdc9e079da1e4d
MD5 51a63e2576b7f797df446b6086c8fb09
SHA1 f70fbdbbc908dfa908b17b58c79c7dbd33c3fdc8
SHA512 b1eb79a7200101da91419dfb709bde0a12773db48d7b5a487cb3ce67a170f96e072189f19502dec61449d823abdc466d49a5e04a55d66a4f6025e5422053c40f
SSDEEP 12288:5raQBVterMIztyCK5x8CBmn+RrNbEyWYa0Ie1vUx9Vz:YQjGZyCA8CBmn+RrNj9ay5Iz
TLSH
T11BD4AF71F6D18537D12B1BB48C1B9269A8397F102E28644E7BED2D0C9F3D78139292E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1016-0-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/1016-9-0x0000000000400000-0x0000000000445000-memory.dmp

Download

memory/1016-10-0x0000000000830000-0x00000000018EA000-memory.dmp

Download

memory/1016-14-0x0000000000830000-0x00000000018EA000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads