Analysis
-
max time kernel
143s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
13-10-2023 19:43
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.NEASe98b69ff231cf10e885c2421bd3c5fc5exe.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.NEASe98b69ff231cf10e885c2421bd3c5fc5exe.exe
Resource
win10v2004-20230915-en
General
-
Target
NEAS.NEASe98b69ff231cf10e885c2421bd3c5fc5exe.exe
-
Size
35KB
-
MD5
e98b69ff231cf10e885c2421bd3c5fc5
-
SHA1
88173852631dff2e54de5eff588b9c4d9b58758b
-
SHA256
389f4f8705e6017d42e3f637e5609c5d68fb1322ff836d354f99df9dbd374b8f
-
SHA512
6be189e42c93cc5cf7b3299d541e6aba23c9623a9d4df98fc44f6e1714d7ea627a76e5f08c72003c041dab84d061efca6573a7eca3130c8934d67237a37bbe09
-
SSDEEP
768:TwbYGCv4nuEcJpQK4TQbtKvXwXgA9lJJea+yGCJQqeWnAEv2647Dk:TwbYP4nuEApQK4TQbtY2gA9DX+ytBOu
Malware Config
Signatures
-
Sakula payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2372-12-0x0000000000400000-0x000000000041A000-memory.dmp family_sakula behavioral1/memory/2112-14-0x0000000000400000-0x000000000041A000-memory.dmp family_sakula behavioral1/memory/2372-21-0x0000000000400000-0x000000000041A000-memory.dmp family_sakula behavioral1/memory/2112-24-0x0000000000400000-0x000000000041A000-memory.dmp family_sakula -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2580 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 2112 MediaCenter.exe -
Loads dropped DLL 2 IoCs
Processes:
NEAS.NEASe98b69ff231cf10e885c2421bd3c5fc5exe.exepid process 2372 NEAS.NEASe98b69ff231cf10e885c2421bd3c5fc5exe.exe 2372 NEAS.NEASe98b69ff231cf10e885c2421bd3c5fc5exe.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
NEAS.NEASe98b69ff231cf10e885c2421bd3c5fc5exe.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" NEAS.NEASe98b69ff231cf10e885c2421bd3c5fc5exe.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
NEAS.NEASe98b69ff231cf10e885c2421bd3c5fc5exe.exedescription pid process Token: SeIncBasePriorityPrivilege 2372 NEAS.NEASe98b69ff231cf10e885c2421bd3c5fc5exe.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
NEAS.NEASe98b69ff231cf10e885c2421bd3c5fc5exe.execmd.exedescription pid process target process PID 2372 wrote to memory of 2112 2372 NEAS.NEASe98b69ff231cf10e885c2421bd3c5fc5exe.exe MediaCenter.exe PID 2372 wrote to memory of 2112 2372 NEAS.NEASe98b69ff231cf10e885c2421bd3c5fc5exe.exe MediaCenter.exe PID 2372 wrote to memory of 2112 2372 NEAS.NEASe98b69ff231cf10e885c2421bd3c5fc5exe.exe MediaCenter.exe PID 2372 wrote to memory of 2112 2372 NEAS.NEASe98b69ff231cf10e885c2421bd3c5fc5exe.exe MediaCenter.exe PID 2372 wrote to memory of 2580 2372 NEAS.NEASe98b69ff231cf10e885c2421bd3c5fc5exe.exe cmd.exe PID 2372 wrote to memory of 2580 2372 NEAS.NEASe98b69ff231cf10e885c2421bd3c5fc5exe.exe cmd.exe PID 2372 wrote to memory of 2580 2372 NEAS.NEASe98b69ff231cf10e885c2421bd3c5fc5exe.exe cmd.exe PID 2372 wrote to memory of 2580 2372 NEAS.NEASe98b69ff231cf10e885c2421bd3c5fc5exe.exe cmd.exe PID 2580 wrote to memory of 2480 2580 cmd.exe PING.EXE PID 2580 wrote to memory of 2480 2580 cmd.exe PING.EXE PID 2580 wrote to memory of 2480 2580 cmd.exe PING.EXE PID 2580 wrote to memory of 2480 2580 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEASe98b69ff231cf10e885c2421bd3c5fc5exe.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEASe98b69ff231cf10e885c2421bd3c5fc5exe.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:2112 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\NEAS.NEASe98b69ff231cf10e885c2421bd3c5fc5exe.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:2480
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
35KB
MD53728d958b963f2b1c8c3c113b9755c70
SHA186dff376ea2d365133acdd4992bb89f125e4560b
SHA2560fda813d80b87e36bb5624d3fb867bdd841f41d76af8f512e1bb93111802e1b3
SHA512d95f284d5d5c8925fe2075b7706d7ac5264c6ce4074346e796b6d07eaf311b120908992352479c5f4af299185940a196cfacc2acff470ad165f7a391403252ef
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
35KB
MD53728d958b963f2b1c8c3c113b9755c70
SHA186dff376ea2d365133acdd4992bb89f125e4560b
SHA2560fda813d80b87e36bb5624d3fb867bdd841f41d76af8f512e1bb93111802e1b3
SHA512d95f284d5d5c8925fe2075b7706d7ac5264c6ce4074346e796b6d07eaf311b120908992352479c5f4af299185940a196cfacc2acff470ad165f7a391403252ef
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
35KB
MD53728d958b963f2b1c8c3c113b9755c70
SHA186dff376ea2d365133acdd4992bb89f125e4560b
SHA2560fda813d80b87e36bb5624d3fb867bdd841f41d76af8f512e1bb93111802e1b3
SHA512d95f284d5d5c8925fe2075b7706d7ac5264c6ce4074346e796b6d07eaf311b120908992352479c5f4af299185940a196cfacc2acff470ad165f7a391403252ef
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
35KB
MD53728d958b963f2b1c8c3c113b9755c70
SHA186dff376ea2d365133acdd4992bb89f125e4560b
SHA2560fda813d80b87e36bb5624d3fb867bdd841f41d76af8f512e1bb93111802e1b3
SHA512d95f284d5d5c8925fe2075b7706d7ac5264c6ce4074346e796b6d07eaf311b120908992352479c5f4af299185940a196cfacc2acff470ad165f7a391403252ef
-
memory/2112-10-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/2112-14-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/2112-24-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/2372-11-0x0000000000220000-0x000000000023A000-memory.dmpFilesize
104KB
-
memory/2372-8-0x0000000000220000-0x000000000023A000-memory.dmpFilesize
104KB
-
memory/2372-0-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/2372-12-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/2372-13-0x0000000000220000-0x000000000023A000-memory.dmpFilesize
104KB
-
memory/2372-21-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB