Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
14-10-2023 14:02
Behavioral task
behavioral1
Sample
NEAS.1c1b19fed2e385b82c356d163a813060_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.1c1b19fed2e385b82c356d163a813060_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
NEAS.1c1b19fed2e385b82c356d163a813060_JC.exe
-
Size
212KB
-
MD5
1c1b19fed2e385b82c356d163a813060
-
SHA1
2c0a4fcd4e8c043a47e3a70498f8343808427b10
-
SHA256
61398e6b900f17750e3069094b2a560f7c58f4432d38e200837012cbe465a065
-
SHA512
792032b20956516eb4c2ecc69d73a6a8c1ba8a848e8da4f3ebec78de196aa2468f3f4cdaa8891b8b5f2ceb2be46e4e9edaddaa37000830947da39c8ffab00c5d
-
SSDEEP
1536:YtQFl29mEkE0L1rDEKrxZKF2zf9g2Pl7W/MwbxMX++pdz30rtr8gjXjp0hanBW:L29DkEGRQixVSjLc130BYgjXjpnnBW
Malware Config
Extracted
sakula
www.polarroute.com
Signatures
-
Sakula payload 7 IoCs
Processes:
resource yara_rule behavioral2/memory/3648-0-0x0000000000400000-0x0000000000435000-memory.dmp family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula behavioral2/memory/704-5-0x0000000000400000-0x0000000000435000-memory.dmp family_sakula behavioral2/memory/3648-6-0x0000000000400000-0x0000000000435000-memory.dmp family_sakula behavioral2/memory/704-7-0x0000000000400000-0x0000000000435000-memory.dmp family_sakula behavioral2/memory/3648-8-0x0000000000400000-0x0000000000435000-memory.dmp family_sakula -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
NEAS.1c1b19fed2e385b82c356d163a813060_JC.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation NEAS.1c1b19fed2e385b82c356d163a813060_JC.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 704 MediaCenter.exe -
Processes:
resource yara_rule behavioral2/memory/3648-0-0x0000000000400000-0x0000000000435000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe upx C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe upx behavioral2/memory/704-5-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/3648-6-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/704-7-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/3648-8-0x0000000000400000-0x0000000000435000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
NEAS.1c1b19fed2e385b82c356d163a813060_JC.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" NEAS.1c1b19fed2e385b82c356d163a813060_JC.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
NEAS.1c1b19fed2e385b82c356d163a813060_JC.exedescription pid process Token: SeIncBasePriorityPrivilege 3648 NEAS.1c1b19fed2e385b82c356d163a813060_JC.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
NEAS.1c1b19fed2e385b82c356d163a813060_JC.execmd.exedescription pid process target process PID 3648 wrote to memory of 704 3648 NEAS.1c1b19fed2e385b82c356d163a813060_JC.exe MediaCenter.exe PID 3648 wrote to memory of 704 3648 NEAS.1c1b19fed2e385b82c356d163a813060_JC.exe MediaCenter.exe PID 3648 wrote to memory of 704 3648 NEAS.1c1b19fed2e385b82c356d163a813060_JC.exe MediaCenter.exe PID 3648 wrote to memory of 3076 3648 NEAS.1c1b19fed2e385b82c356d163a813060_JC.exe cmd.exe PID 3648 wrote to memory of 3076 3648 NEAS.1c1b19fed2e385b82c356d163a813060_JC.exe cmd.exe PID 3648 wrote to memory of 3076 3648 NEAS.1c1b19fed2e385b82c356d163a813060_JC.exe cmd.exe PID 3076 wrote to memory of 4440 3076 cmd.exe PING.EXE PID 3076 wrote to memory of 4440 3076 cmd.exe PING.EXE PID 3076 wrote to memory of 4440 3076 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.1c1b19fed2e385b82c356d163a813060_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.1c1b19fed2e385b82c356d163a813060_JC.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:704 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\NEAS.1c1b19fed2e385b82c356d163a813060_JC.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:4440
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
212KB
MD5b9dda7326f8e35823b908a75bf90e2d3
SHA14080534a71a1cdd194c741c4c482021ecffd8707
SHA2566acf46ca71295bbe7d96f2d2bf9b66db19c18384df624557ba9319c802cc18b6
SHA5124eafe87e4cabc25c54e21c3603e1c1837aeff931ea5f8761713ffa8e9c8f08c943dd8dcca17c68b90705cc45c8695a5372fccfc96156969f83115da4bb5cb7fd
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
212KB
MD5b9dda7326f8e35823b908a75bf90e2d3
SHA14080534a71a1cdd194c741c4c482021ecffd8707
SHA2566acf46ca71295bbe7d96f2d2bf9b66db19c18384df624557ba9319c802cc18b6
SHA5124eafe87e4cabc25c54e21c3603e1c1837aeff931ea5f8761713ffa8e9c8f08c943dd8dcca17c68b90705cc45c8695a5372fccfc96156969f83115da4bb5cb7fd
-
memory/704-5-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/704-7-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/3648-0-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/3648-6-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/3648-8-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB