Analysis
-
max time kernel
141s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
15-10-2023 19:49
Static task
static1
Behavioral task
behavioral1
Sample
e8c9b7f59a3a01397d9e5a7be24aba70_exe32.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
e8c9b7f59a3a01397d9e5a7be24aba70_exe32.exe
Resource
win10v2004-20230915-en
General
-
Target
e8c9b7f59a3a01397d9e5a7be24aba70_exe32.exe
-
Size
71KB
-
MD5
e8c9b7f59a3a01397d9e5a7be24aba70
-
SHA1
80605c6bfd3d014b0cf22cd42f392cbf7ad8d111
-
SHA256
bdca0c7f1c605c0c7276aace42c629d34351a3a96bc1e6f92143a574d7056448
-
SHA512
a773374c95ca19f9b3c0a3db87aecb0ade48b646df35da62dc917380cac32af2b5ff83b4aea70dac4d1bdd28fd2c6c75c909ed4d2d8e0b77c36b3d3fb490e07c
-
SSDEEP
768:bhSksandb4GgyMsp4hyYtoVxYGm1ZAe0oAGA:bTsGpehyYtkYvnr0o9A
Malware Config
Extracted
sakula
http://vpn.premrera.com:443/viewpre.asp?cstring=%s&tom=%d&id=%d
http://vpn.premrera.com:443/photo/%s.jpg?id=%d
http://173.254.226.212:443/viewpre.asp?cstring=%s&tom=%d&id=%d
http://173.254.226.212:443/photo/%s.jpg?id=%d
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 2680 MediaCenter.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
e8c9b7f59a3a01397d9e5a7be24aba70_exe32.execmd.execmd.execmd.exedescription pid process target process PID 1760 wrote to memory of 4376 1760 e8c9b7f59a3a01397d9e5a7be24aba70_exe32.exe cmd.exe PID 1760 wrote to memory of 4376 1760 e8c9b7f59a3a01397d9e5a7be24aba70_exe32.exe cmd.exe PID 1760 wrote to memory of 4376 1760 e8c9b7f59a3a01397d9e5a7be24aba70_exe32.exe cmd.exe PID 1760 wrote to memory of 4892 1760 e8c9b7f59a3a01397d9e5a7be24aba70_exe32.exe cmd.exe PID 1760 wrote to memory of 4892 1760 e8c9b7f59a3a01397d9e5a7be24aba70_exe32.exe cmd.exe PID 1760 wrote to memory of 4892 1760 e8c9b7f59a3a01397d9e5a7be24aba70_exe32.exe cmd.exe PID 1760 wrote to memory of 3804 1760 e8c9b7f59a3a01397d9e5a7be24aba70_exe32.exe cmd.exe PID 1760 wrote to memory of 3804 1760 e8c9b7f59a3a01397d9e5a7be24aba70_exe32.exe cmd.exe PID 1760 wrote to memory of 3804 1760 e8c9b7f59a3a01397d9e5a7be24aba70_exe32.exe cmd.exe PID 3804 wrote to memory of 4396 3804 cmd.exe PING.EXE PID 3804 wrote to memory of 4396 3804 cmd.exe PING.EXE PID 3804 wrote to memory of 4396 3804 cmd.exe PING.EXE PID 4376 wrote to memory of 1100 4376 cmd.exe reg.exe PID 4376 wrote to memory of 1100 4376 cmd.exe reg.exe PID 4376 wrote to memory of 1100 4376 cmd.exe reg.exe PID 4892 wrote to memory of 2680 4892 cmd.exe MediaCenter.exe PID 4892 wrote to memory of 2680 4892 cmd.exe MediaCenter.exe PID 4892 wrote to memory of 2680 4892 cmd.exe MediaCenter.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e8c9b7f59a3a01397d9e5a7be24aba70_exe32.exe"C:\Users\Admin\AppData\Local\Temp\e8c9b7f59a3a01397d9e5a7be24aba70_exe32.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
PID:1100 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\e8c9b7f59a3a01397d9e5a7be24aba70_exe32.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:4396 -
C:\Windows\SysWOW64\cmd.execmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe3⤵
- Executes dropped EXE
PID:2680
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
71KB
MD548941d7f9ecdaff4cac38744c5963729
SHA181b197bc674aa67c3eef95807f2ba9e10a91a8f1
SHA25637d279b569e4e6ef6aa0e8d9392b9a3be97a1505c6004bf8bcb57f69810a57b5
SHA51262d0321ac0d7ef310062cb26b2a4a629711223c2176b1a41f1bd0b70478c68c7074512c8cfbea923d54fdc1ede06c42104a6e40d7bf409ea4896391022d6ea61
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
71KB
MD548941d7f9ecdaff4cac38744c5963729
SHA181b197bc674aa67c3eef95807f2ba9e10a91a8f1
SHA25637d279b569e4e6ef6aa0e8d9392b9a3be97a1505c6004bf8bcb57f69810a57b5
SHA51262d0321ac0d7ef310062cb26b2a4a629711223c2176b1a41f1bd0b70478c68c7074512c8cfbea923d54fdc1ede06c42104a6e40d7bf409ea4896391022d6ea61
-
memory/1760-0-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1760-1-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1760-3-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB