Analysis
-
max time kernel
134s -
max time network
193s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
12-05-2022 15:55
Static task
static1
Behavioral task
behavioral1
Sample
6c001fd70ea1c71ff5074f615214944ebb666c591f7166673c5b038f41c83c64.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
6c001fd70ea1c71ff5074f615214944ebb666c591f7166673c5b038f41c83c64.exe
Resource
win10v2004-20220414-en
General
-
Target
6c001fd70ea1c71ff5074f615214944ebb666c591f7166673c5b038f41c83c64.exe
-
Size
42KB
-
MD5
0f4df6fa818ad0312e163b2d2be1552d
-
SHA1
27f15722c4d0066dca1ac15ec1801a3cfe08f788
-
SHA256
6c001fd70ea1c71ff5074f615214944ebb666c591f7166673c5b038f41c83c64
-
SHA512
97090a3b4bb3237e32fc240f05dcd02b17818788016db505643be368a248b81ee7478b782966969fd2d774ac77a164dd8dd520bd4fc959522acb8a22acc5609d
Malware Config
Signatures
-
suricata: ET MALWARE Possible DEEP PANDA C2 Activity
suricata: ET MALWARE Possible DEEP PANDA C2 Activity
-
suricata: ET MALWARE Possible Deep Panda - Sakula/Mivast RAT CnC Beacon 5
suricata: ET MALWARE Possible Deep Panda - Sakula/Mivast RAT CnC Beacon 5
-
suricata: ET MALWARE Sakula/Mivast C2 Activity
suricata: ET MALWARE Sakula/Mivast C2 Activity
-
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 1496 MediaCenter.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1004 cmd.exe -
Loads dropped DLL 2 IoCs
Processes:
cmd.exepid process 1036 cmd.exe 1036 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
6c001fd70ea1c71ff5074f615214944ebb666c591f7166673c5b038f41c83c64.execmd.execmd.execmd.exedescription pid process target process PID 1944 wrote to memory of 1352 1944 6c001fd70ea1c71ff5074f615214944ebb666c591f7166673c5b038f41c83c64.exe cmd.exe PID 1944 wrote to memory of 1352 1944 6c001fd70ea1c71ff5074f615214944ebb666c591f7166673c5b038f41c83c64.exe cmd.exe PID 1944 wrote to memory of 1352 1944 6c001fd70ea1c71ff5074f615214944ebb666c591f7166673c5b038f41c83c64.exe cmd.exe PID 1944 wrote to memory of 1352 1944 6c001fd70ea1c71ff5074f615214944ebb666c591f7166673c5b038f41c83c64.exe cmd.exe PID 1944 wrote to memory of 1036 1944 6c001fd70ea1c71ff5074f615214944ebb666c591f7166673c5b038f41c83c64.exe cmd.exe PID 1944 wrote to memory of 1036 1944 6c001fd70ea1c71ff5074f615214944ebb666c591f7166673c5b038f41c83c64.exe cmd.exe PID 1944 wrote to memory of 1036 1944 6c001fd70ea1c71ff5074f615214944ebb666c591f7166673c5b038f41c83c64.exe cmd.exe PID 1944 wrote to memory of 1036 1944 6c001fd70ea1c71ff5074f615214944ebb666c591f7166673c5b038f41c83c64.exe cmd.exe PID 1944 wrote to memory of 1004 1944 6c001fd70ea1c71ff5074f615214944ebb666c591f7166673c5b038f41c83c64.exe cmd.exe PID 1944 wrote to memory of 1004 1944 6c001fd70ea1c71ff5074f615214944ebb666c591f7166673c5b038f41c83c64.exe cmd.exe PID 1944 wrote to memory of 1004 1944 6c001fd70ea1c71ff5074f615214944ebb666c591f7166673c5b038f41c83c64.exe cmd.exe PID 1944 wrote to memory of 1004 1944 6c001fd70ea1c71ff5074f615214944ebb666c591f7166673c5b038f41c83c64.exe cmd.exe PID 1352 wrote to memory of 1008 1352 cmd.exe reg.exe PID 1352 wrote to memory of 1008 1352 cmd.exe reg.exe PID 1352 wrote to memory of 1008 1352 cmd.exe reg.exe PID 1352 wrote to memory of 1008 1352 cmd.exe reg.exe PID 1004 wrote to memory of 1804 1004 cmd.exe PING.EXE PID 1004 wrote to memory of 1804 1004 cmd.exe PING.EXE PID 1004 wrote to memory of 1804 1004 cmd.exe PING.EXE PID 1004 wrote to memory of 1804 1004 cmd.exe PING.EXE PID 1036 wrote to memory of 1496 1036 cmd.exe MediaCenter.exe PID 1036 wrote to memory of 1496 1036 cmd.exe MediaCenter.exe PID 1036 wrote to memory of 1496 1036 cmd.exe MediaCenter.exe PID 1036 wrote to memory of 1496 1036 cmd.exe MediaCenter.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c001fd70ea1c71ff5074f615214944ebb666c591f7166673c5b038f41c83c64.exe"C:\Users\Admin\AppData\Local\Temp\6c001fd70ea1c71ff5074f615214944ebb666c591f7166673c5b038f41c83c64.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\6c001fd70ea1c71ff5074f615214944ebb666c591f7166673c5b038f41c83c64.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.11⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
42KB
MD5d730fe31136ea434339d46d850984087
SHA1d9028794ae430b192859be4e977f7243ad97c22e
SHA256b9951c9a9c79049f9bc816b7373d77649e8e2bce37243eee94888cc940c98980
SHA512908a7b5f8fe05e214198b01474d9e3ec497df8a601cd43389467795635ae88d0c5cee571b181039fd0c90c67f3c26571eec44f5e0380dd142f7850dce936c47a
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
42KB
MD5d730fe31136ea434339d46d850984087
SHA1d9028794ae430b192859be4e977f7243ad97c22e
SHA256b9951c9a9c79049f9bc816b7373d77649e8e2bce37243eee94888cc940c98980
SHA512908a7b5f8fe05e214198b01474d9e3ec497df8a601cd43389467795635ae88d0c5cee571b181039fd0c90c67f3c26571eec44f5e0380dd142f7850dce936c47a
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
42KB
MD5d730fe31136ea434339d46d850984087
SHA1d9028794ae430b192859be4e977f7243ad97c22e
SHA256b9951c9a9c79049f9bc816b7373d77649e8e2bce37243eee94888cc940c98980
SHA512908a7b5f8fe05e214198b01474d9e3ec497df8a601cd43389467795635ae88d0c5cee571b181039fd0c90c67f3c26571eec44f5e0380dd142f7850dce936c47a
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
42KB
MD5d730fe31136ea434339d46d850984087
SHA1d9028794ae430b192859be4e977f7243ad97c22e
SHA256b9951c9a9c79049f9bc816b7373d77649e8e2bce37243eee94888cc940c98980
SHA512908a7b5f8fe05e214198b01474d9e3ec497df8a601cd43389467795635ae88d0c5cee571b181039fd0c90c67f3c26571eec44f5e0380dd142f7850dce936c47a
-
memory/1004-58-0x0000000000000000-mapping.dmp
-
memory/1008-59-0x0000000000000000-mapping.dmp
-
memory/1036-57-0x0000000000000000-mapping.dmp
-
memory/1352-56-0x0000000000000000-mapping.dmp
-
memory/1496-64-0x0000000000000000-mapping.dmp
-
memory/1496-67-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1804-60-0x0000000000000000-mapping.dmp
-
memory/1944-54-0x0000000075EF1000-0x0000000075EF3000-memory.dmpFilesize
8KB
-
memory/1944-55-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB