Analysis
-
max time kernel
141s -
max time network
159s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
13-10-2023 19:46
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.1cf23f1a8d357c5e5466acdb7ed4dca0.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.1cf23f1a8d357c5e5466acdb7ed4dca0.exe
Resource
win10v2004-20230915-en
General
-
Target
NEAS.1cf23f1a8d357c5e5466acdb7ed4dca0.exe
-
Size
32KB
-
MD5
1cf23f1a8d357c5e5466acdb7ed4dca0
-
SHA1
ac7db1ace1a395b4eb815ff51f83349da9d97ae6
-
SHA256
7111f7cdfe1b2b426fd0d98360f19b581896dde6f77997abaf6fededba0c420d
-
SHA512
189d5168d41c2e1f4e1ff11faab3119e10f4715ac1e9a1ffe171a28033c63a79803a831be84afe6998821920d7dcdd07918cd63bd3beb7c300b1d8c1447f27fb
-
SSDEEP
384:vnyhSksAVndb4G3w2NMsG9OqvhyY3Q6oVxYv0Dq6ULdAeMB:KhSksandb4GgyMsp4hyYtoVxYUZ
Malware Config
Extracted
sakula
http://vpn.premrera.com:443/viewpre.asp?cstring=%s&tom=%d&id=%d
http://vpn.premrera.com:443/photo/%s.jpg?id=%d
http://173.254.226.212:443/viewpre.asp?cstring=%s&tom=%d&id=%d
http://173.254.226.212:443/photo/%s.jpg?id=%d
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2704 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 2652 MediaCenter.exe -
Loads dropped DLL 2 IoCs
Processes:
cmd.exepid process 3068 cmd.exe 3068 cmd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
NEAS.1cf23f1a8d357c5e5466acdb7ed4dca0.execmd.execmd.execmd.exedescription pid process target process PID 2692 wrote to memory of 2368 2692 NEAS.1cf23f1a8d357c5e5466acdb7ed4dca0.exe cmd.exe PID 2692 wrote to memory of 2368 2692 NEAS.1cf23f1a8d357c5e5466acdb7ed4dca0.exe cmd.exe PID 2692 wrote to memory of 2368 2692 NEAS.1cf23f1a8d357c5e5466acdb7ed4dca0.exe cmd.exe PID 2692 wrote to memory of 2368 2692 NEAS.1cf23f1a8d357c5e5466acdb7ed4dca0.exe cmd.exe PID 2692 wrote to memory of 3068 2692 NEAS.1cf23f1a8d357c5e5466acdb7ed4dca0.exe cmd.exe PID 2692 wrote to memory of 3068 2692 NEAS.1cf23f1a8d357c5e5466acdb7ed4dca0.exe cmd.exe PID 2692 wrote to memory of 3068 2692 NEAS.1cf23f1a8d357c5e5466acdb7ed4dca0.exe cmd.exe PID 2692 wrote to memory of 3068 2692 NEAS.1cf23f1a8d357c5e5466acdb7ed4dca0.exe cmd.exe PID 2692 wrote to memory of 2704 2692 NEAS.1cf23f1a8d357c5e5466acdb7ed4dca0.exe cmd.exe PID 2692 wrote to memory of 2704 2692 NEAS.1cf23f1a8d357c5e5466acdb7ed4dca0.exe cmd.exe PID 2692 wrote to memory of 2704 2692 NEAS.1cf23f1a8d357c5e5466acdb7ed4dca0.exe cmd.exe PID 2692 wrote to memory of 2704 2692 NEAS.1cf23f1a8d357c5e5466acdb7ed4dca0.exe cmd.exe PID 3068 wrote to memory of 2652 3068 cmd.exe MediaCenter.exe PID 3068 wrote to memory of 2652 3068 cmd.exe MediaCenter.exe PID 3068 wrote to memory of 2652 3068 cmd.exe MediaCenter.exe PID 3068 wrote to memory of 2652 3068 cmd.exe MediaCenter.exe PID 2368 wrote to memory of 1720 2368 cmd.exe reg.exe PID 2368 wrote to memory of 1720 2368 cmd.exe reg.exe PID 2368 wrote to memory of 1720 2368 cmd.exe reg.exe PID 2368 wrote to memory of 1720 2368 cmd.exe reg.exe PID 2704 wrote to memory of 2624 2704 cmd.exe PING.EXE PID 2704 wrote to memory of 2624 2704 cmd.exe PING.EXE PID 2704 wrote to memory of 2624 2704 cmd.exe PING.EXE PID 2704 wrote to memory of 2624 2704 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.1cf23f1a8d357c5e5466acdb7ed4dca0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.1cf23f1a8d357c5e5466acdb7ed4dca0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
PID:1720 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\NEAS.1cf23f1a8d357c5e5466acdb7ed4dca0.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:2624 -
C:\Windows\SysWOW64\cmd.execmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe3⤵
- Executes dropped EXE
PID:2652
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
32KB
MD50b0eb4435d189829761fb935d047051d
SHA1f42707bb6b9687f5b2172a50bbe325bfcd1156b0
SHA25606588a9b1df750f826df0decf1584f2d3596acc21b125390ec473e986b6c3be5
SHA51269e21955f2517121b2c3a939eb82020d109e552e148f764b1fab27d9f158a82a867b387a4ec3ceb1b30ccbf869feec7794f1ae7616ff662a88467bfb578f7701
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
32KB
MD50b0eb4435d189829761fb935d047051d
SHA1f42707bb6b9687f5b2172a50bbe325bfcd1156b0
SHA25606588a9b1df750f826df0decf1584f2d3596acc21b125390ec473e986b6c3be5
SHA51269e21955f2517121b2c3a939eb82020d109e552e148f764b1fab27d9f158a82a867b387a4ec3ceb1b30ccbf869feec7794f1ae7616ff662a88467bfb578f7701
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
32KB
MD50b0eb4435d189829761fb935d047051d
SHA1f42707bb6b9687f5b2172a50bbe325bfcd1156b0
SHA25606588a9b1df750f826df0decf1584f2d3596acc21b125390ec473e986b6c3be5
SHA51269e21955f2517121b2c3a939eb82020d109e552e148f764b1fab27d9f158a82a867b387a4ec3ceb1b30ccbf869feec7794f1ae7616ff662a88467bfb578f7701
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
32KB
MD50b0eb4435d189829761fb935d047051d
SHA1f42707bb6b9687f5b2172a50bbe325bfcd1156b0
SHA25606588a9b1df750f826df0decf1584f2d3596acc21b125390ec473e986b6c3be5
SHA51269e21955f2517121b2c3a939eb82020d109e552e148f764b1fab27d9f158a82a867b387a4ec3ceb1b30ccbf869feec7794f1ae7616ff662a88467bfb578f7701
-
memory/2692-0-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2692-2-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB