Overview

overview

10

Static

static

3

7d4b38a47c...cs.exe

windows7-x64

10

7d4b38a47c...cs.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    118s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    29-06-2024 07:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7d4b38a47cbe2abdae8cde0ee7614767b6f794db043a315b2f0b662a2ab3a01e_NeikiAnalytics.exe

  • Size

    512KB

  • MD5

    0fb95ce36a58a53d928a075414074630

  • SHA1

    4548fad0f0b824e8289155080e50b94af4297042

  • SHA256

    7d4b38a47cbe2abdae8cde0ee7614767b6f794db043a315b2f0b662a2ab3a01e

  • SHA512

    5b3c842b1d700c326c7052d89e8d33206957a4223cd1594d8b05a9029a866f35804076a9c9ff6c628f2bba49d4ac08edba47ae18a118953e15b0ec8f75c436c8

  • SSDEEP

    12288:VtQsjr1agUc7iGZDZyRrvgggdiIhw25dT:P9jrQQuGKrgtdiIhw25l

Score
10/10
salitybackdoorupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx

Processes

  • C:\Users\Admin\AppData\Local\Temp\7d4b38a47cbe2abdae8cde0ee7614767b6f794db043a315b2f0b662a2ab3a01e_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\7d4b38a47cbe2abdae8cde0ee7614767b6f794db043a315b2f0b662a2ab3a01e_NeikiAnalytics.exe"
    1⤵
      PID:1748

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\0F760CCD_Rar\7d4b38a47cbe2abdae8cde0ee7614767b6f794db043a315b2f0b662a2ab3a01e_NeikiAnalytics.exe
      Filesize

      444KB

      MD5

      f2f1876f765e2ccd6479896f45119d00

      SHA1

      df50e24224127ceb429c38b34109528787f516a7

      SHA256

      c46f5716fb43f51174102365a321861aa7dd879adf3ecd7f7b11054e6a6a9ab1

      SHA512

      4d35c6b103b283faeeedc80797d8d74847ec70f49456b24df2c780d1df945467e5f91b3026b9231b471764cee632ea9cb5000e074d683c91a4f2fa191e0c295d

      Download Submit
    • memory/1748-0-0x0000000000400000-0x0000000000473000-memory.dmp
      Filesize

      460KB

      Download
    • memory/1748-9-0x0000000000400000-0x0000000000473000-memory.dmp
      Filesize

      460KB

      Download
    • memory/1748-10-0x0000000001DA0000-0x0000000002E5A000-memory.dmp
      Filesize

      16.7MB

      Download
    • memory/1748-1-0x0000000001DA0000-0x0000000002E5A000-memory.dmp
      Filesize

      16.7MB

      Download
    • memory/1748-11-0x0000000001DA0000-0x0000000002E5A000-memory.dmp
      Filesize

      16.7MB

      Download