Analysis
-
max time kernel
146s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
09-08-2023 13:53
Behavioral task
behavioral1
Sample
2feda3b406e459fa22da191c9bd2593f6476bb52167895eae4b4be82b6d0540c.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
2feda3b406e459fa22da191c9bd2593f6476bb52167895eae4b4be82b6d0540c.exe
Resource
win10v2004-20230703-en
General
-
Target
2feda3b406e459fa22da191c9bd2593f6476bb52167895eae4b4be82b6d0540c.exe
-
Size
101KB
-
MD5
31e86a3424261ddb573e49f4756bd004
-
SHA1
d90510ce9f324cf02be72002db685421af3c437d
-
SHA256
2feda3b406e459fa22da191c9bd2593f6476bb52167895eae4b4be82b6d0540c
-
SHA512
4e27b5009708d12cf72b42476e1b0101eb706c6784212872ffc70a70cb09364b45a3ba921c8eaf0ebd6d417460a08fa69695711efc7c13fadfa390565ae112af
-
SSDEEP
1536:0oaj1hJL1S9t0MIeboal8bCKxo7h0RP0IwHNz30rtroGCr2:P0hpgz6xGhTIwHF30BENr2
Malware Config
Signatures
-
Sakula payload 6 IoCs
Processes:
resource yara_rule behavioral2/memory/4176-133-0x0000000000520000-0x000000000053B000-memory.dmp family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula behavioral2/memory/4196-137-0x00000000003C0000-0x00000000003DB000-memory.dmp family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula behavioral2/memory/4176-139-0x0000000000520000-0x000000000053B000-memory.dmp family_sakula behavioral2/memory/4196-140-0x00000000003C0000-0x00000000003DB000-memory.dmp family_sakula -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 4196 MediaCenter.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
2feda3b406e459fa22da191c9bd2593f6476bb52167895eae4b4be82b6d0540c.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" 2feda3b406e459fa22da191c9bd2593f6476bb52167895eae4b4be82b6d0540c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
2feda3b406e459fa22da191c9bd2593f6476bb52167895eae4b4be82b6d0540c.exedescription pid process Token: SeIncBasePriorityPrivilege 4176 2feda3b406e459fa22da191c9bd2593f6476bb52167895eae4b4be82b6d0540c.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
2feda3b406e459fa22da191c9bd2593f6476bb52167895eae4b4be82b6d0540c.execmd.exedescription pid process target process PID 4176 wrote to memory of 4196 4176 2feda3b406e459fa22da191c9bd2593f6476bb52167895eae4b4be82b6d0540c.exe MediaCenter.exe PID 4176 wrote to memory of 4196 4176 2feda3b406e459fa22da191c9bd2593f6476bb52167895eae4b4be82b6d0540c.exe MediaCenter.exe PID 4176 wrote to memory of 4196 4176 2feda3b406e459fa22da191c9bd2593f6476bb52167895eae4b4be82b6d0540c.exe MediaCenter.exe PID 4176 wrote to memory of 1880 4176 2feda3b406e459fa22da191c9bd2593f6476bb52167895eae4b4be82b6d0540c.exe cmd.exe PID 4176 wrote to memory of 1880 4176 2feda3b406e459fa22da191c9bd2593f6476bb52167895eae4b4be82b6d0540c.exe cmd.exe PID 4176 wrote to memory of 1880 4176 2feda3b406e459fa22da191c9bd2593f6476bb52167895eae4b4be82b6d0540c.exe cmd.exe PID 1880 wrote to memory of 2836 1880 cmd.exe PING.EXE PID 1880 wrote to memory of 2836 1880 cmd.exe PING.EXE PID 1880 wrote to memory of 2836 1880 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\2feda3b406e459fa22da191c9bd2593f6476bb52167895eae4b4be82b6d0540c.exe"C:\Users\Admin\AppData\Local\Temp\2feda3b406e459fa22da191c9bd2593f6476bb52167895eae4b4be82b6d0540c.exe"1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\2feda3b406e459fa22da191c9bd2593f6476bb52167895eae4b4be82b6d0540c.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
101KB
MD5973981fe541ca39c6115007da3f083e6
SHA17fffa69ad0c0a879ef34024227fb96b8943e5c8c
SHA25662b4ae5f517bb3ec3f61fa21553a8ea46ef7c22be3e71f170b06a5715cf0d98a
SHA5128b91944f23cae203be669b852b402f0283c86616aa9f71e78037b14aa60ac5abc715759b60858801497d21ee1b97dfda9f1ababd954b42ef0820a2047864bdde
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
101KB
MD5973981fe541ca39c6115007da3f083e6
SHA17fffa69ad0c0a879ef34024227fb96b8943e5c8c
SHA25662b4ae5f517bb3ec3f61fa21553a8ea46ef7c22be3e71f170b06a5715cf0d98a
SHA5128b91944f23cae203be669b852b402f0283c86616aa9f71e78037b14aa60ac5abc715759b60858801497d21ee1b97dfda9f1ababd954b42ef0820a2047864bdde
-
memory/4176-133-0x0000000000520000-0x000000000053B000-memory.dmpFilesize
108KB
-
memory/4176-139-0x0000000000520000-0x000000000053B000-memory.dmpFilesize
108KB
-
memory/4196-137-0x00000000003C0000-0x00000000003DB000-memory.dmpFilesize
108KB
-
memory/4196-140-0x00000000003C0000-0x00000000003DB000-memory.dmpFilesize
108KB