sality | 43184bd5162fb342e94f91e1b3df8891e2c3b9a9b060d57a4639c4d8fe8ad9f1

Analysis

max time kernel
15s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
30-06-2024 20:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

43184bd5162fb342e94f91e1b3df8891e2c3b9a9b060d57a4639c4d8fe8ad9f1.exe
Size

124KB
MD5

fed03e665695876114f9af0d1ec028bd
SHA1

ccd21ae940f58dfff9300884b2ae34e210605851
SHA256

43184bd5162fb342e94f91e1b3df8891e2c3b9a9b060d57a4639c4d8fe8ad9f1
SHA512

8ad296501d8ca61c870833233c598a9c1d493a249f129207239f2064bbbf1335acc12a9c1b2b804eb4a3da70e3e709e47478b3bbbd7287f8cb5b32922397a396
SSDEEP

3072:sftffjmN/8ftffjmNCekfgkgiutON7FtL2BEJb:0VfjmNsVfjmNVOgkgi12eb

Score

10^/10

sality backdoor evasion trojan upx

Malware Config

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Signatures

Modifies firewall policy service 3 TTPs 3 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

43184bd5162fb342e94f91e1b3df8891e2c3b9a9b060d57a4639c4d8fe8ad9f1.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	43184bd5162fb342e94f91e1b3df8891e2c3b9a9b060d57a4639c4d8fe8ad9f1.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	43184bd5162fb342e94f91e1b3df8891e2c3b9a9b060d57a4639c4d8fe8ad9f1.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	43184bd5162fb342e94f91e1b3df8891e2c3b9a9b060d57a4639c4d8fe8ad9f1.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality
UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1548.002

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

43184bd5162fb342e94f91e1b3df8891e2c3b9a9b060d57a4639c4d8fe8ad9f1.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 43184bd5162fb342e94f91e1b3df8891e2c3b9a9b060d57a4639c4d8fe8ad9f1.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	43184bd5162fb342e94f91e1b3df8891e2c3b9a9b060d57a4639c4d8fe8ad9f1.exe

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

43184bd5162fb342e94f91e1b3df8891e2c3b9a9b060d57a4639c4d8fe8ad9f1.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	43184bd5162fb342e94f91e1b3df8891e2c3b9a9b060d57a4639c4d8fe8ad9f1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	43184bd5162fb342e94f91e1b3df8891e2c3b9a9b060d57a4639c4d8fe8ad9f1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	43184bd5162fb342e94f91e1b3df8891e2c3b9a9b060d57a4639c4d8fe8ad9f1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	43184bd5162fb342e94f91e1b3df8891e2c3b9a9b060d57a4639c4d8fe8ad9f1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	43184bd5162fb342e94f91e1b3df8891e2c3b9a9b060d57a4639c4d8fe8ad9f1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	43184bd5162fb342e94f91e1b3df8891e2c3b9a9b060d57a4639c4d8fe8ad9f1.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4404-1-0x00000000007F0000-0x000000000187E000-memory.dmp	upx
behavioral2/memory/4404-9-0x00000000007F0000-0x000000000187E000-memory.dmp	upx
behavioral2/memory/4404-12-0x00000000007F0000-0x000000000187E000-memory.dmp	upx
behavioral2/memory/4404-15-0x00000000007F0000-0x000000000187E000-memory.dmp	upx
behavioral2/memory/4404-11-0x00000000007F0000-0x000000000187E000-memory.dmp	upx
behavioral2/memory/4404-10-0x00000000007F0000-0x000000000187E000-memory.dmp	upx
behavioral2/memory/4404-8-0x00000000007F0000-0x000000000187E000-memory.dmp	upx

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

43184bd5162fb342e94f91e1b3df8891e2c3b9a9b060d57a4639c4d8fe8ad9f1.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	43184bd5162fb342e94f91e1b3df8891e2c3b9a9b060d57a4639c4d8fe8ad9f1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	43184bd5162fb342e94f91e1b3df8891e2c3b9a9b060d57a4639c4d8fe8ad9f1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	43184bd5162fb342e94f91e1b3df8891e2c3b9a9b060d57a4639c4d8fe8ad9f1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	43184bd5162fb342e94f91e1b3df8891e2c3b9a9b060d57a4639c4d8fe8ad9f1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	43184bd5162fb342e94f91e1b3df8891e2c3b9a9b060d57a4639c4d8fe8ad9f1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	43184bd5162fb342e94f91e1b3df8891e2c3b9a9b060d57a4639c4d8fe8ad9f1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	43184bd5162fb342e94f91e1b3df8891e2c3b9a9b060d57a4639c4d8fe8ad9f1.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

43184bd5162fb342e94f91e1b3df8891e2c3b9a9b060d57a4639c4d8fe8ad9f1.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 43184bd5162fb342e94f91e1b3df8891e2c3b9a9b060d57a4639c4d8fe8ad9f1.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	43184bd5162fb342e94f91e1b3df8891e2c3b9a9b060d57a4639c4d8fe8ad9f1.exe

Drops file in Windows directory 3 IoCs

Processes:

43184bd5162fb342e94f91e1b3df8891e2c3b9a9b060d57a4639c4d8fe8ad9f1.exe

description	ioc	process
File created	C:\Windows\rundl132.exe	43184bd5162fb342e94f91e1b3df8891e2c3b9a9b060d57a4639c4d8fe8ad9f1.exe
File created	C:\Windows\Logo1_.exe	43184bd5162fb342e94f91e1b3df8891e2c3b9a9b060d57a4639c4d8fe8ad9f1.exe
File opened for modification	C:\Windows\SYSTEM.INI	43184bd5162fb342e94f91e1b3df8891e2c3b9a9b060d57a4639c4d8fe8ad9f1.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

43184bd5162fb342e94f91e1b3df8891e2c3b9a9b060d57a4639c4d8fe8ad9f1.exe

pid process

4404 43184bd5162fb342e94f91e1b3df8891e2c3b9a9b060d57a4639c4d8fe8ad9f1.exe
4404 43184bd5162fb342e94f91e1b3df8891e2c3b9a9b060d57a4639c4d8fe8ad9f1.exe

pid	process
4404	43184bd5162fb342e94f91e1b3df8891e2c3b9a9b060d57a4639c4d8fe8ad9f1.exe
4404	43184bd5162fb342e94f91e1b3df8891e2c3b9a9b060d57a4639c4d8fe8ad9f1.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

Processes:

43184bd5162fb342e94f91e1b3df8891e2c3b9a9b060d57a4639c4d8fe8ad9f1.exe

description	pid	process
Token: SeDebugPrivilege	4404	43184bd5162fb342e94f91e1b3df8891e2c3b9a9b060d57a4639c4d8fe8ad9f1.exe
Token: SeDebugPrivilege	4404	43184bd5162fb342e94f91e1b3df8891e2c3b9a9b060d57a4639c4d8fe8ad9f1.exe
Token: SeDebugPrivilege	4404	43184bd5162fb342e94f91e1b3df8891e2c3b9a9b060d57a4639c4d8fe8ad9f1.exe
Token: SeDebugPrivilege	4404	43184bd5162fb342e94f91e1b3df8891e2c3b9a9b060d57a4639c4d8fe8ad9f1.exe
Token: SeDebugPrivilege	4404	43184bd5162fb342e94f91e1b3df8891e2c3b9a9b060d57a4639c4d8fe8ad9f1.exe
Token: SeDebugPrivilege	4404	43184bd5162fb342e94f91e1b3df8891e2c3b9a9b060d57a4639c4d8fe8ad9f1.exe
Token: SeDebugPrivilege	4404	43184bd5162fb342e94f91e1b3df8891e2c3b9a9b060d57a4639c4d8fe8ad9f1.exe
Token: SeDebugPrivilege	4404	43184bd5162fb342e94f91e1b3df8891e2c3b9a9b060d57a4639c4d8fe8ad9f1.exe
Token: SeDebugPrivilege	4404	43184bd5162fb342e94f91e1b3df8891e2c3b9a9b060d57a4639c4d8fe8ad9f1.exe
Token: SeDebugPrivilege	4404	43184bd5162fb342e94f91e1b3df8891e2c3b9a9b060d57a4639c4d8fe8ad9f1.exe
Token: SeDebugPrivilege	4404	43184bd5162fb342e94f91e1b3df8891e2c3b9a9b060d57a4639c4d8fe8ad9f1.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

43184bd5162fb342e94f91e1b3df8891e2c3b9a9b060d57a4639c4d8fe8ad9f1.exe

description	pid	process	target process
PID 4404 wrote to memory of 800	4404	43184bd5162fb342e94f91e1b3df8891e2c3b9a9b060d57a4639c4d8fe8ad9f1.exe	cmd.exe
PID 4404 wrote to memory of 800	4404	43184bd5162fb342e94f91e1b3df8891e2c3b9a9b060d57a4639c4d8fe8ad9f1.exe	cmd.exe
PID 4404 wrote to memory of 800	4404	43184bd5162fb342e94f91e1b3df8891e2c3b9a9b060d57a4639c4d8fe8ad9f1.exe	cmd.exe
PID 4404 wrote to memory of 784	4404	43184bd5162fb342e94f91e1b3df8891e2c3b9a9b060d57a4639c4d8fe8ad9f1.exe	fontdrvhost.exe

System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

43184bd5162fb342e94f91e1b3df8891e2c3b9a9b060d57a4639c4d8fe8ad9f1.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 43184bd5162fb342e94f91e1b3df8891e2c3b9a9b060d57a4639c4d8fe8ad9f1.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	43184bd5162fb342e94f91e1b3df8891e2c3b9a9b060d57a4639c4d8fe8ad9f1.exe

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:784

C:\Users\Admin\AppData\Local\Temp\43184bd5162fb342e94f91e1b3df8891e2c3b9a9b060d57a4639c4d8fe8ad9f1.exe
"C:\Users\Admin\AppData\Local\Temp\43184bd5162fb342e94f91e1b3df8891e2c3b9a9b060d57a4639c4d8fe8ad9f1.exe"
1⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4404

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA8A.bat
2⤵
PID:800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3948 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:8
1⤵
PID:4512

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\$$aA8A.bat
Filesize
721B

MD5
2c4dca0ac2059672bd37905388171b41

SHA1
911bbf229ac52b6dacabb26f0d05f2386407f2c7

SHA256
3ad180b3a34fe558721d8193f29f852793c41b7de6638aa4390f458e94a226b5

SHA512
9fc1c16091d7a2bbea47285fd03011ad328ce8e327c0e2111c94803bca4351dc60f123156590357d95d477b62e6e21ee76aa41ad9f670b1722b0281456a3735d

Download Submit
C:\Users\Admin\AppData\Local\Temp\43184bd5162fb342e94f91e1b3df8891e2c3b9a9b060d57a4639c4d8fe8ad9f1.exe.exe
Filesize
98KB

MD5
23e3f5cd2f749216e2d1ffb9597155e2

SHA1
c2fb05b00f09a6072a76f01bdc2d46397cc815de

SHA256
261981cb1aa043a572cf4984a71372f36b66968412295b6dbced5c15bb1adccb

SHA512
51a42b8acf596cf3671247a07e552eeb596a727ff78d3049607cb5c3eceaa492ed5e127a37ec59932398bcc68899a90102ff463cf094013aeec2023ce7f89e7a

Download Submit
memory/4404-0-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4404-1-0x00000000007F0000-0x000000000187E000-memory.dmp

Filesize
16.6MB

Download
memory/4404-9-0x00000000007F0000-0x000000000187E000-memory.dmp

Filesize
16.6MB

Download
memory/4404-12-0x00000000007F0000-0x000000000187E000-memory.dmp

Filesize
16.6MB

Download
memory/4404-15-0x00000000007F0000-0x000000000187E000-memory.dmp

Filesize
16.6MB

Download
memory/4404-11-0x00000000007F0000-0x000000000187E000-memory.dmp

Filesize
16.6MB

Download
memory/4404-10-0x00000000007F0000-0x000000000187E000-memory.dmp

Filesize
16.6MB

Download
memory/4404-8-0x00000000007F0000-0x000000000187E000-memory.dmp

Filesize
16.6MB

Download
memory/4404-20-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download