Analysis
-
max time kernel
147s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
03-06-2022 13:34
Static task
static1
Behavioral task
behavioral1
Sample
130d67c50bd649897b9198b090f6137b792a8415a03abf04b13063eaa93ac678.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
130d67c50bd649897b9198b090f6137b792a8415a03abf04b13063eaa93ac678.exe
Resource
win10v2004-20220414-en
General
-
Target
130d67c50bd649897b9198b090f6137b792a8415a03abf04b13063eaa93ac678.exe
-
Size
19KB
-
MD5
4f3cfe776b67016579985dcae493079c
-
SHA1
d7f77c3dabc8ee72bbaee9c8dcd5bfe79ce2f777
-
SHA256
130d67c50bd649897b9198b090f6137b792a8415a03abf04b13063eaa93ac678
-
SHA512
3b767573ad3919b7765a64ba31134e0a19a297fb72a4c9f7f89e72e3f9f0d1d69807a838d762c993cfa2bba1fa6f55c7c360296599b7f4d9e10c7923ae425066
Malware Config
Signatures
-
suricata: ET MALWARE Possible DEEP PANDA C2 Activity
suricata: ET MALWARE Possible DEEP PANDA C2 Activity
-
suricata: ET MALWARE Possible Deep Panda - Sakula/Mivast RAT CnC Beacon 5
suricata: ET MALWARE Possible Deep Panda - Sakula/Mivast RAT CnC Beacon 5
-
suricata: ET MALWARE Sakula/Mivast C2 Activity
suricata: ET MALWARE Sakula/Mivast C2 Activity
-
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 1924 MediaCenter.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
130d67c50bd649897b9198b090f6137b792a8415a03abf04b13063eaa93ac678.execmd.execmd.execmd.exedescription pid process target process PID 796 wrote to memory of 2216 796 130d67c50bd649897b9198b090f6137b792a8415a03abf04b13063eaa93ac678.exe cmd.exe PID 796 wrote to memory of 2216 796 130d67c50bd649897b9198b090f6137b792a8415a03abf04b13063eaa93ac678.exe cmd.exe PID 796 wrote to memory of 2216 796 130d67c50bd649897b9198b090f6137b792a8415a03abf04b13063eaa93ac678.exe cmd.exe PID 796 wrote to memory of 4548 796 130d67c50bd649897b9198b090f6137b792a8415a03abf04b13063eaa93ac678.exe cmd.exe PID 796 wrote to memory of 4548 796 130d67c50bd649897b9198b090f6137b792a8415a03abf04b13063eaa93ac678.exe cmd.exe PID 796 wrote to memory of 4548 796 130d67c50bd649897b9198b090f6137b792a8415a03abf04b13063eaa93ac678.exe cmd.exe PID 796 wrote to memory of 4540 796 130d67c50bd649897b9198b090f6137b792a8415a03abf04b13063eaa93ac678.exe cmd.exe PID 796 wrote to memory of 4540 796 130d67c50bd649897b9198b090f6137b792a8415a03abf04b13063eaa93ac678.exe cmd.exe PID 796 wrote to memory of 4540 796 130d67c50bd649897b9198b090f6137b792a8415a03abf04b13063eaa93ac678.exe cmd.exe PID 4548 wrote to memory of 1924 4548 cmd.exe MediaCenter.exe PID 4548 wrote to memory of 1924 4548 cmd.exe MediaCenter.exe PID 4548 wrote to memory of 1924 4548 cmd.exe MediaCenter.exe PID 2216 wrote to memory of 1936 2216 cmd.exe reg.exe PID 2216 wrote to memory of 1936 2216 cmd.exe reg.exe PID 2216 wrote to memory of 1936 2216 cmd.exe reg.exe PID 4540 wrote to memory of 2880 4540 cmd.exe PING.EXE PID 4540 wrote to memory of 2880 4540 cmd.exe PING.EXE PID 4540 wrote to memory of 2880 4540 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\130d67c50bd649897b9198b090f6137b792a8415a03abf04b13063eaa93ac678.exe"C:\Users\Admin\AppData\Local\Temp\130d67c50bd649897b9198b090f6137b792a8415a03abf04b13063eaa93ac678.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\130d67c50bd649897b9198b090f6137b792a8415a03abf04b13063eaa93ac678.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
19KB
MD540f379e5183102009bfe19e35bed7f79
SHA15b1e9abfc37e9df431ceb057a2561bd2d67d724d
SHA2560666f8aba38789da1e80ec5c231e1587d6c33188978b5fd5ffa223f569b1f3bd
SHA5124faf3bbbe52b915482d163de4d0863ac918e86b7f6d60fcd4964be0d4101ad8efe26b401309caf147209d634d5748a642509bacc68993dbc2de51144f924af84
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
19KB
MD540f379e5183102009bfe19e35bed7f79
SHA15b1e9abfc37e9df431ceb057a2561bd2d67d724d
SHA2560666f8aba38789da1e80ec5c231e1587d6c33188978b5fd5ffa223f569b1f3bd
SHA5124faf3bbbe52b915482d163de4d0863ac918e86b7f6d60fcd4964be0d4101ad8efe26b401309caf147209d634d5748a642509bacc68993dbc2de51144f924af84
-
memory/796-131-0x0000000000030000-0x0000000000034000-memory.dmpFilesize
16KB
-
memory/796-135-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/796-130-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1924-141-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1924-144-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1924-143-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1924-142-0x0000000000030000-0x0000000000034000-memory.dmpFilesize
16KB
-
memory/1924-136-0x0000000000000000-mapping.dmp
-
memory/1936-139-0x0000000000000000-mapping.dmp
-
memory/2216-132-0x0000000000000000-mapping.dmp
-
memory/2880-140-0x0000000000000000-mapping.dmp
-
memory/4540-134-0x0000000000000000-mapping.dmp
-
memory/4548-133-0x0000000000000000-mapping.dmp