Analysis
-
max time kernel
144s -
max time network
177s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
14-10-2023 03:40
Static task
static1
Behavioral task
behavioral1
Sample
cd64145da6ddb5857039ef96ca9b47d0_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
cd64145da6ddb5857039ef96ca9b47d0_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
cd64145da6ddb5857039ef96ca9b47d0_JC.exe
-
Size
42KB
-
MD5
cd64145da6ddb5857039ef96ca9b47d0
-
SHA1
75917fb5294498f70f1472aaafab27a892e3e614
-
SHA256
4e64e96e5f49908f9bd44176dbdd2012e84bb6e7bde72af419ada7e8a17e303a
-
SHA512
ae2a4586d7881811031e441b1ee62ee7a6bc6bbf1e86679c6ef5b695969e7426f7a6d3fff244a8e6cbcb50e31adf1e8ed76947123f898c79634f6df987329be2
-
SSDEEP
768:/hSksandb4GgyMsp4hyYtoVxYGm1q+R9cFDBMm:/TsGpehyYtkYvYm9cHMm
Malware Config
Extracted
sakula
http://vpn.premrera.com:443/viewpre.asp?cstring=%s&tom=%d&id=%d
http://vpn.premrera.com:443/photo/%s.jpg?id=%d
http://173.254.226.212:443/viewpre.asp?cstring=%s&tom=%d&id=%d
http://173.254.226.212:443/photo/%s.jpg?id=%d
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1908 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 2720 MediaCenter.exe -
Loads dropped DLL 2 IoCs
Processes:
cmd.exepid process 1376 cmd.exe 1376 cmd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
cd64145da6ddb5857039ef96ca9b47d0_JC.execmd.execmd.execmd.exedescription pid process target process PID 1692 wrote to memory of 2360 1692 cd64145da6ddb5857039ef96ca9b47d0_JC.exe cmd.exe PID 1692 wrote to memory of 2360 1692 cd64145da6ddb5857039ef96ca9b47d0_JC.exe cmd.exe PID 1692 wrote to memory of 2360 1692 cd64145da6ddb5857039ef96ca9b47d0_JC.exe cmd.exe PID 1692 wrote to memory of 2360 1692 cd64145da6ddb5857039ef96ca9b47d0_JC.exe cmd.exe PID 1692 wrote to memory of 1376 1692 cd64145da6ddb5857039ef96ca9b47d0_JC.exe cmd.exe PID 1692 wrote to memory of 1376 1692 cd64145da6ddb5857039ef96ca9b47d0_JC.exe cmd.exe PID 1692 wrote to memory of 1376 1692 cd64145da6ddb5857039ef96ca9b47d0_JC.exe cmd.exe PID 1692 wrote to memory of 1376 1692 cd64145da6ddb5857039ef96ca9b47d0_JC.exe cmd.exe PID 1692 wrote to memory of 1908 1692 cd64145da6ddb5857039ef96ca9b47d0_JC.exe cmd.exe PID 1692 wrote to memory of 1908 1692 cd64145da6ddb5857039ef96ca9b47d0_JC.exe cmd.exe PID 1692 wrote to memory of 1908 1692 cd64145da6ddb5857039ef96ca9b47d0_JC.exe cmd.exe PID 1692 wrote to memory of 1908 1692 cd64145da6ddb5857039ef96ca9b47d0_JC.exe cmd.exe PID 2360 wrote to memory of 2740 2360 cmd.exe reg.exe PID 2360 wrote to memory of 2740 2360 cmd.exe reg.exe PID 2360 wrote to memory of 2740 2360 cmd.exe reg.exe PID 2360 wrote to memory of 2740 2360 cmd.exe reg.exe PID 1908 wrote to memory of 2756 1908 cmd.exe PING.EXE PID 1908 wrote to memory of 2756 1908 cmd.exe PING.EXE PID 1908 wrote to memory of 2756 1908 cmd.exe PING.EXE PID 1908 wrote to memory of 2756 1908 cmd.exe PING.EXE PID 1376 wrote to memory of 2720 1376 cmd.exe MediaCenter.exe PID 1376 wrote to memory of 2720 1376 cmd.exe MediaCenter.exe PID 1376 wrote to memory of 2720 1376 cmd.exe MediaCenter.exe PID 1376 wrote to memory of 2720 1376 cmd.exe MediaCenter.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cd64145da6ddb5857039ef96ca9b47d0_JC.exe"C:\Users\Admin\AppData\Local\Temp\cd64145da6ddb5857039ef96ca9b47d0_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
PID:2740 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\cd64145da6ddb5857039ef96ca9b47d0_JC.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:2756 -
C:\Windows\SysWOW64\cmd.execmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe3⤵
- Executes dropped EXE
PID:2720
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD52b95f260ed966ac3570b1aa91283bc51
SHA119bc62b1bc4b8aea3081823f1b47f11706d0aa2a
SHA2564a924f731de5a9a74ab1ab9413b022ee22c235585b04d13b2927c49a1ed3de04
SHA51206dfb3b36436ace3a4b28ad3cccb1bced843902b2417a661d19ca79afa1602e4b396b2da4c69b1c73f0da112aef06e575e1cd2e896863fca20d92c2129a9e742
-
Filesize
42KB
MD52b95f260ed966ac3570b1aa91283bc51
SHA119bc62b1bc4b8aea3081823f1b47f11706d0aa2a
SHA2564a924f731de5a9a74ab1ab9413b022ee22c235585b04d13b2927c49a1ed3de04
SHA51206dfb3b36436ace3a4b28ad3cccb1bced843902b2417a661d19ca79afa1602e4b396b2da4c69b1c73f0da112aef06e575e1cd2e896863fca20d92c2129a9e742
-
Filesize
42KB
MD52b95f260ed966ac3570b1aa91283bc51
SHA119bc62b1bc4b8aea3081823f1b47f11706d0aa2a
SHA2564a924f731de5a9a74ab1ab9413b022ee22c235585b04d13b2927c49a1ed3de04
SHA51206dfb3b36436ace3a4b28ad3cccb1bced843902b2417a661d19ca79afa1602e4b396b2da4c69b1c73f0da112aef06e575e1cd2e896863fca20d92c2129a9e742
-
Filesize
42KB
MD52b95f260ed966ac3570b1aa91283bc51
SHA119bc62b1bc4b8aea3081823f1b47f11706d0aa2a
SHA2564a924f731de5a9a74ab1ab9413b022ee22c235585b04d13b2927c49a1ed3de04
SHA51206dfb3b36436ace3a4b28ad3cccb1bced843902b2417a661d19ca79afa1602e4b396b2da4c69b1c73f0da112aef06e575e1cd2e896863fca20d92c2129a9e742