Analysis
-
max time kernel
168s -
max time network
201s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
12-05-2022 18:37
Static task
static1
Behavioral task
behavioral1
Sample
2772c05ccb98243d81ffda3e7355aa4542b536267897bfcbc05fe74aea1efd69.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
2772c05ccb98243d81ffda3e7355aa4542b536267897bfcbc05fe74aea1efd69.exe
Resource
win10v2004-20220414-en
General
-
Target
2772c05ccb98243d81ffda3e7355aa4542b536267897bfcbc05fe74aea1efd69.exe
-
Size
29KB
-
MD5
024520b4edebd33be477effbb6bf2cd9
-
SHA1
1f334ce297995bfe213821b3f50ed67d35e1c543
-
SHA256
2772c05ccb98243d81ffda3e7355aa4542b536267897bfcbc05fe74aea1efd69
-
SHA512
279b492720a12ac276e399a339d581ed8889d22afd054eacd604da6b271725ee6d7ac41342fd03940ea28a9aabb7bc90c927b7d067bccabf72c429c8ffe74880
Malware Config
Signatures
-
suricata: ET MALWARE Possible DEEP PANDA C2 Activity
suricata: ET MALWARE Possible DEEP PANDA C2 Activity
-
suricata: ET MALWARE Possible Deep Panda - Sakula/Mivast RAT CnC Beacon 5
suricata: ET MALWARE Possible Deep Panda - Sakula/Mivast RAT CnC Beacon 5
-
suricata: ET MALWARE Sakula/Mivast C2 Activity
suricata: ET MALWARE Sakula/Mivast C2 Activity
-
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 3108 MediaCenter.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
2772c05ccb98243d81ffda3e7355aa4542b536267897bfcbc05fe74aea1efd69.execmd.execmd.execmd.exedescription pid process target process PID 4812 wrote to memory of 3920 4812 2772c05ccb98243d81ffda3e7355aa4542b536267897bfcbc05fe74aea1efd69.exe cmd.exe PID 4812 wrote to memory of 3920 4812 2772c05ccb98243d81ffda3e7355aa4542b536267897bfcbc05fe74aea1efd69.exe cmd.exe PID 4812 wrote to memory of 3920 4812 2772c05ccb98243d81ffda3e7355aa4542b536267897bfcbc05fe74aea1efd69.exe cmd.exe PID 4812 wrote to memory of 4852 4812 2772c05ccb98243d81ffda3e7355aa4542b536267897bfcbc05fe74aea1efd69.exe cmd.exe PID 4812 wrote to memory of 4852 4812 2772c05ccb98243d81ffda3e7355aa4542b536267897bfcbc05fe74aea1efd69.exe cmd.exe PID 4812 wrote to memory of 4852 4812 2772c05ccb98243d81ffda3e7355aa4542b536267897bfcbc05fe74aea1efd69.exe cmd.exe PID 4812 wrote to memory of 4272 4812 2772c05ccb98243d81ffda3e7355aa4542b536267897bfcbc05fe74aea1efd69.exe cmd.exe PID 4812 wrote to memory of 4272 4812 2772c05ccb98243d81ffda3e7355aa4542b536267897bfcbc05fe74aea1efd69.exe cmd.exe PID 4812 wrote to memory of 4272 4812 2772c05ccb98243d81ffda3e7355aa4542b536267897bfcbc05fe74aea1efd69.exe cmd.exe PID 4852 wrote to memory of 3108 4852 cmd.exe MediaCenter.exe PID 4852 wrote to memory of 3108 4852 cmd.exe MediaCenter.exe PID 4852 wrote to memory of 3108 4852 cmd.exe MediaCenter.exe PID 3920 wrote to memory of 3800 3920 cmd.exe reg.exe PID 3920 wrote to memory of 3800 3920 cmd.exe reg.exe PID 3920 wrote to memory of 3800 3920 cmd.exe reg.exe PID 4272 wrote to memory of 2788 4272 cmd.exe PING.EXE PID 4272 wrote to memory of 2788 4272 cmd.exe PING.EXE PID 4272 wrote to memory of 2788 4272 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\2772c05ccb98243d81ffda3e7355aa4542b536267897bfcbc05fe74aea1efd69.exe"C:\Users\Admin\AppData\Local\Temp\2772c05ccb98243d81ffda3e7355aa4542b536267897bfcbc05fe74aea1efd69.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\2772c05ccb98243d81ffda3e7355aa4542b536267897bfcbc05fe74aea1efd69.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
29KB
MD54b54ba85a78bdc0b43e627c059e33c53
SHA1e687898847b5fbb7675ab11296e4189e329787e3
SHA25605857b7cc6c719f0a148642d2de5b3541594e0d71c733c9482874cd59cfea0ae
SHA5129ca4363abcdc22c9b6bfd5dff750ead3781e425a6c719d3181c4a69833b872be63bc9fdb8b2a8bcf44157649cccb11771ac323ec367982cd5fd29d5f416a3dc2
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
29KB
MD54b54ba85a78bdc0b43e627c059e33c53
SHA1e687898847b5fbb7675ab11296e4189e329787e3
SHA25605857b7cc6c719f0a148642d2de5b3541594e0d71c733c9482874cd59cfea0ae
SHA5129ca4363abcdc22c9b6bfd5dff750ead3781e425a6c719d3181c4a69833b872be63bc9fdb8b2a8bcf44157649cccb11771ac323ec367982cd5fd29d5f416a3dc2
-
memory/2788-138-0x0000000000000000-mapping.dmp
-
memory/3108-134-0x0000000000000000-mapping.dmp
-
memory/3108-139-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3800-137-0x0000000000000000-mapping.dmp
-
memory/3920-131-0x0000000000000000-mapping.dmp
-
memory/4272-133-0x0000000000000000-mapping.dmp
-
memory/4812-130-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4852-132-0x0000000000000000-mapping.dmp