Analysis
-
max time kernel
160s -
max time network
158s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
12-02-2022 04:47
Static task
static1
Behavioral task
behavioral1
Sample
1477dfba495387fba793ca53260285aafeea377caad8de3864225cf3051ad3f8.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
1477dfba495387fba793ca53260285aafeea377caad8de3864225cf3051ad3f8.exe
Resource
win10v2004-en-20220113
General
-
Target
1477dfba495387fba793ca53260285aafeea377caad8de3864225cf3051ad3f8.exe
-
Size
116KB
-
MD5
c1bfeaa5bee4756155b3ea80361b5e64
-
SHA1
30cf0dc55121516b3a24489cadf152c1f3758e34
-
SHA256
1477dfba495387fba793ca53260285aafeea377caad8de3864225cf3051ad3f8
-
SHA512
7cdbe1639e447c62475ea11fc6f771e4d82e21e57314ca3556fe83cc2eb9ea54bfb3093a054ad17dc0a0d8ea00ae4c3aab216e4e6ea8684118ba28a4458667ec
Malware Config
Signatures
-
Sakula Payload 4 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula behavioral1/memory/1524-59-0x0000000000400000-0x0000000000420000-memory.dmp family_sakula behavioral1/memory/1268-60-0x0000000000400000-0x0000000000420000-memory.dmp family_sakula -
suricata: ET MALWARE SUSPICIOUS UA (iexplore)
suricata: ET MALWARE SUSPICIOUS UA (iexplore)
-
suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1
suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1
-
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 1268 MediaCenter.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1692 cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
1477dfba495387fba793ca53260285aafeea377caad8de3864225cf3051ad3f8.exepid process 1524 1477dfba495387fba793ca53260285aafeea377caad8de3864225cf3051ad3f8.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
1477dfba495387fba793ca53260285aafeea377caad8de3864225cf3051ad3f8.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" 1477dfba495387fba793ca53260285aafeea377caad8de3864225cf3051ad3f8.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
1477dfba495387fba793ca53260285aafeea377caad8de3864225cf3051ad3f8.exedescription pid process Token: SeIncBasePriorityPrivilege 1524 1477dfba495387fba793ca53260285aafeea377caad8de3864225cf3051ad3f8.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
1477dfba495387fba793ca53260285aafeea377caad8de3864225cf3051ad3f8.execmd.exedescription pid process target process PID 1524 wrote to memory of 1268 1524 1477dfba495387fba793ca53260285aafeea377caad8de3864225cf3051ad3f8.exe MediaCenter.exe PID 1524 wrote to memory of 1268 1524 1477dfba495387fba793ca53260285aafeea377caad8de3864225cf3051ad3f8.exe MediaCenter.exe PID 1524 wrote to memory of 1268 1524 1477dfba495387fba793ca53260285aafeea377caad8de3864225cf3051ad3f8.exe MediaCenter.exe PID 1524 wrote to memory of 1268 1524 1477dfba495387fba793ca53260285aafeea377caad8de3864225cf3051ad3f8.exe MediaCenter.exe PID 1524 wrote to memory of 1692 1524 1477dfba495387fba793ca53260285aafeea377caad8de3864225cf3051ad3f8.exe cmd.exe PID 1524 wrote to memory of 1692 1524 1477dfba495387fba793ca53260285aafeea377caad8de3864225cf3051ad3f8.exe cmd.exe PID 1524 wrote to memory of 1692 1524 1477dfba495387fba793ca53260285aafeea377caad8de3864225cf3051ad3f8.exe cmd.exe PID 1524 wrote to memory of 1692 1524 1477dfba495387fba793ca53260285aafeea377caad8de3864225cf3051ad3f8.exe cmd.exe PID 1692 wrote to memory of 1048 1692 cmd.exe PING.EXE PID 1692 wrote to memory of 1048 1692 cmd.exe PING.EXE PID 1692 wrote to memory of 1048 1692 cmd.exe PING.EXE PID 1692 wrote to memory of 1048 1692 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\1477dfba495387fba793ca53260285aafeea377caad8de3864225cf3051ad3f8.exe"C:\Users\Admin\AppData\Local\Temp\1477dfba495387fba793ca53260285aafeea377caad8de3864225cf3051ad3f8.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:1268 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\1477dfba495387fba793ca53260285aafeea377caad8de3864225cf3051ad3f8.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:1048
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
9ba9243851b1c5fdb136c48504624e89
SHA1598f347a44831d3bb6aff57c2f744dd42d969e99
SHA256befa1aeb276cd60ba07fe5a7befbdbe64600520a40b5fc975b738079ab3379be
SHA51240aefe8caf5827f01de8e3a760496137202f7e384b57cdcff9eaa1962c2a001dec28e125aed7f7d73952ac216b5c2710932aee837588045d6b60a13dd31a74b2
-
MD5
9ba9243851b1c5fdb136c48504624e89
SHA1598f347a44831d3bb6aff57c2f744dd42d969e99
SHA256befa1aeb276cd60ba07fe5a7befbdbe64600520a40b5fc975b738079ab3379be
SHA51240aefe8caf5827f01de8e3a760496137202f7e384b57cdcff9eaa1962c2a001dec28e125aed7f7d73952ac216b5c2710932aee837588045d6b60a13dd31a74b2