Analysis
-
max time kernel
128s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
08-09-2023 18:21
Behavioral task
behavioral1
Sample
bccf42d805b13678fb0459ece5aa915fexeexeexe_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
bccf42d805b13678fb0459ece5aa915fexeexeexe_JC.exe
Resource
win10v2004-20230831-en
General
-
Target
bccf42d805b13678fb0459ece5aa915fexeexeexe_JC.exe
-
Size
212KB
-
MD5
bccf42d805b13678fb0459ece5aa915f
-
SHA1
307c9a9e7440de03c051736a5977662d5546bcae
-
SHA256
f1600f2961c2101189dd6666935d4e7c2af69aacce417b527e41584b53bc4225
-
SHA512
25fa07e0c2c54b59d03a801e3fada1a61c73e813f52c1dced31d335ee1cffd78537859b55797c1a12ad225f4ea59eee96316af8315e1c170cf643d8b386435ba
-
SSDEEP
1536:VtQFl29mEkE0L1rDEKrxZKF2zf9g2Pl7W/MwbxMX++pdz30rtr8gjXjp0ManB/:429DkEGRQixVSjLc130BYgjXjpWnB/
Malware Config
Extracted
sakula
www.polarroute.com
Signatures
-
Sakula payload 7 IoCs
Processes:
resource yara_rule behavioral2/memory/520-0-0x0000000000400000-0x0000000000435000-memory.dmp family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula behavioral2/memory/4148-4-0x0000000000400000-0x0000000000435000-memory.dmp family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula behavioral2/memory/520-6-0x0000000000400000-0x0000000000435000-memory.dmp family_sakula behavioral2/memory/4148-7-0x0000000000400000-0x0000000000435000-memory.dmp family_sakula behavioral2/memory/520-8-0x0000000000400000-0x0000000000435000-memory.dmp family_sakula -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
bccf42d805b13678fb0459ece5aa915fexeexeexe_JC.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2474409663-2236862430-1045297337-1000\Control Panel\International\Geo\Nation bccf42d805b13678fb0459ece5aa915fexeexeexe_JC.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 4148 MediaCenter.exe -
Processes:
resource yara_rule behavioral2/memory/520-0-0x0000000000400000-0x0000000000435000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe upx behavioral2/memory/4148-4-0x0000000000400000-0x0000000000435000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe upx behavioral2/memory/520-6-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/4148-7-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/520-8-0x0000000000400000-0x0000000000435000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
bccf42d805b13678fb0459ece5aa915fexeexeexe_JC.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" bccf42d805b13678fb0459ece5aa915fexeexeexe_JC.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
bccf42d805b13678fb0459ece5aa915fexeexeexe_JC.exedescription pid process Token: SeIncBasePriorityPrivilege 520 bccf42d805b13678fb0459ece5aa915fexeexeexe_JC.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
bccf42d805b13678fb0459ece5aa915fexeexeexe_JC.execmd.exedescription pid process target process PID 520 wrote to memory of 4148 520 bccf42d805b13678fb0459ece5aa915fexeexeexe_JC.exe MediaCenter.exe PID 520 wrote to memory of 4148 520 bccf42d805b13678fb0459ece5aa915fexeexeexe_JC.exe MediaCenter.exe PID 520 wrote to memory of 4148 520 bccf42d805b13678fb0459ece5aa915fexeexeexe_JC.exe MediaCenter.exe PID 520 wrote to memory of 1400 520 bccf42d805b13678fb0459ece5aa915fexeexeexe_JC.exe cmd.exe PID 520 wrote to memory of 1400 520 bccf42d805b13678fb0459ece5aa915fexeexeexe_JC.exe cmd.exe PID 520 wrote to memory of 1400 520 bccf42d805b13678fb0459ece5aa915fexeexeexe_JC.exe cmd.exe PID 1400 wrote to memory of 3792 1400 cmd.exe PING.EXE PID 1400 wrote to memory of 3792 1400 cmd.exe PING.EXE PID 1400 wrote to memory of 3792 1400 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\bccf42d805b13678fb0459ece5aa915fexeexeexe_JC.exe"C:\Users\Admin\AppData\Local\Temp\bccf42d805b13678fb0459ece5aa915fexeexeexe_JC.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\bccf42d805b13678fb0459ece5aa915fexeexeexe_JC.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
212KB
MD5484726c9046c6ed73a8244bea1e06c2e
SHA169b2ee9321097586334cfd5202baa4012aba95aa
SHA2562f24710dfb232ac0cd111567494a3954929fbde868fab1db139fdc23c715949f
SHA512280e41ec67496aa67904ce3e5b98dd564fb2e71920167fc8072c04b44b507112bffde6804934ba90ff336d7fc62cc16e26bab2e718954fcdfd112007839dc5f3
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
212KB
MD5484726c9046c6ed73a8244bea1e06c2e
SHA169b2ee9321097586334cfd5202baa4012aba95aa
SHA2562f24710dfb232ac0cd111567494a3954929fbde868fab1db139fdc23c715949f
SHA512280e41ec67496aa67904ce3e5b98dd564fb2e71920167fc8072c04b44b507112bffde6804934ba90ff336d7fc62cc16e26bab2e718954fcdfd112007839dc5f3
-
memory/520-0-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/520-6-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/520-8-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/4148-4-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/4148-7-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB