Analysis
-
max time kernel
146s -
max time network
168s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
16-10-2023 18:33
Behavioral task
behavioral1
Sample
NEAS.b6bf6da95e04ea9f27b588ce1ca2fdb0.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.b6bf6da95e04ea9f27b588ce1ca2fdb0.exe
Resource
win10v2004-20230915-en
General
-
Target
NEAS.b6bf6da95e04ea9f27b588ce1ca2fdb0.exe
-
Size
332KB
-
MD5
b6bf6da95e04ea9f27b588ce1ca2fdb0
-
SHA1
e11fdae1b3a6597aa05ebae41095db2922a57269
-
SHA256
7140dee86c66dbaf4f555f9c616b96dccd1cb6f112473a9210777a7818979c5a
-
SHA512
759465600d991a68d02919654fbb6c35cd48459b20323a554bfddcdc6648596b40d795e69665037aba6a3ef98ab0dc751257db47faab3347a6d1f085332e5665
-
SSDEEP
6144:Nj9c2WYd30BKmiPVpU3ypIPr3D3StNynyS/W:NSI2Ha
Malware Config
Extracted
sakula
www.savmpet.com
Signatures
-
Sakula payload 6 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula \Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula \Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula \Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2896 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
AdobeUpdate.exepid process 2568 AdobeUpdate.exe -
Loads dropped DLL 4 IoCs
Processes:
NEAS.b6bf6da95e04ea9f27b588ce1ca2fdb0.exeAdobeUpdate.exepid process 2004 NEAS.b6bf6da95e04ea9f27b588ce1ca2fdb0.exe 2568 AdobeUpdate.exe 2568 AdobeUpdate.exe 2568 AdobeUpdate.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
NEAS.b6bf6da95e04ea9f27b588ce1ca2fdb0.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AdobeUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\AdobeUpdate.exe" NEAS.b6bf6da95e04ea9f27b588ce1ca2fdb0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
NEAS.b6bf6da95e04ea9f27b588ce1ca2fdb0.exedescription pid process Token: SeIncBasePriorityPrivilege 2004 NEAS.b6bf6da95e04ea9f27b588ce1ca2fdb0.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
NEAS.b6bf6da95e04ea9f27b588ce1ca2fdb0.execmd.exedescription pid process target process PID 2004 wrote to memory of 2568 2004 NEAS.b6bf6da95e04ea9f27b588ce1ca2fdb0.exe AdobeUpdate.exe PID 2004 wrote to memory of 2568 2004 NEAS.b6bf6da95e04ea9f27b588ce1ca2fdb0.exe AdobeUpdate.exe PID 2004 wrote to memory of 2568 2004 NEAS.b6bf6da95e04ea9f27b588ce1ca2fdb0.exe AdobeUpdate.exe PID 2004 wrote to memory of 2568 2004 NEAS.b6bf6da95e04ea9f27b588ce1ca2fdb0.exe AdobeUpdate.exe PID 2004 wrote to memory of 2568 2004 NEAS.b6bf6da95e04ea9f27b588ce1ca2fdb0.exe AdobeUpdate.exe PID 2004 wrote to memory of 2568 2004 NEAS.b6bf6da95e04ea9f27b588ce1ca2fdb0.exe AdobeUpdate.exe PID 2004 wrote to memory of 2568 2004 NEAS.b6bf6da95e04ea9f27b588ce1ca2fdb0.exe AdobeUpdate.exe PID 2004 wrote to memory of 2896 2004 NEAS.b6bf6da95e04ea9f27b588ce1ca2fdb0.exe cmd.exe PID 2004 wrote to memory of 2896 2004 NEAS.b6bf6da95e04ea9f27b588ce1ca2fdb0.exe cmd.exe PID 2004 wrote to memory of 2896 2004 NEAS.b6bf6da95e04ea9f27b588ce1ca2fdb0.exe cmd.exe PID 2004 wrote to memory of 2896 2004 NEAS.b6bf6da95e04ea9f27b588ce1ca2fdb0.exe cmd.exe PID 2896 wrote to memory of 2652 2896 cmd.exe PING.EXE PID 2896 wrote to memory of 2652 2896 cmd.exe PING.EXE PID 2896 wrote to memory of 2652 2896 cmd.exe PING.EXE PID 2896 wrote to memory of 2652 2896 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.b6bf6da95e04ea9f27b588ce1ca2fdb0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.b6bf6da95e04ea9f27b588ce1ca2fdb0.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2568 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\NEAS.b6bf6da95e04ea9f27b588ce1ca2fdb0.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:2652
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeFilesize
332KB
MD523b0bf8318b16da12c4808eddd6ce006
SHA118e3a6acb73b85bd39b91b853438d920d31c226a
SHA256d572832be75f73bb05e3d48ece0c55daff19c469566c1d46a0673be5f8de9dff
SHA512b75e49c519a34304ab7b2cbeffa529dda9103421554bc088d188003bf87347bee171ca495d4fba1f8899f6c0a51f40a59a4cdb3dbe684098ca09b863908ba1e1
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeFilesize
332KB
MD523b0bf8318b16da12c4808eddd6ce006
SHA118e3a6acb73b85bd39b91b853438d920d31c226a
SHA256d572832be75f73bb05e3d48ece0c55daff19c469566c1d46a0673be5f8de9dff
SHA512b75e49c519a34304ab7b2cbeffa529dda9103421554bc088d188003bf87347bee171ca495d4fba1f8899f6c0a51f40a59a4cdb3dbe684098ca09b863908ba1e1
-
\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeFilesize
332KB
MD523b0bf8318b16da12c4808eddd6ce006
SHA118e3a6acb73b85bd39b91b853438d920d31c226a
SHA256d572832be75f73bb05e3d48ece0c55daff19c469566c1d46a0673be5f8de9dff
SHA512b75e49c519a34304ab7b2cbeffa529dda9103421554bc088d188003bf87347bee171ca495d4fba1f8899f6c0a51f40a59a4cdb3dbe684098ca09b863908ba1e1
-
\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeFilesize
332KB
MD523b0bf8318b16da12c4808eddd6ce006
SHA118e3a6acb73b85bd39b91b853438d920d31c226a
SHA256d572832be75f73bb05e3d48ece0c55daff19c469566c1d46a0673be5f8de9dff
SHA512b75e49c519a34304ab7b2cbeffa529dda9103421554bc088d188003bf87347bee171ca495d4fba1f8899f6c0a51f40a59a4cdb3dbe684098ca09b863908ba1e1
-
\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeFilesize
332KB
MD523b0bf8318b16da12c4808eddd6ce006
SHA118e3a6acb73b85bd39b91b853438d920d31c226a
SHA256d572832be75f73bb05e3d48ece0c55daff19c469566c1d46a0673be5f8de9dff
SHA512b75e49c519a34304ab7b2cbeffa529dda9103421554bc088d188003bf87347bee171ca495d4fba1f8899f6c0a51f40a59a4cdb3dbe684098ca09b863908ba1e1
-
\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeFilesize
332KB
MD523b0bf8318b16da12c4808eddd6ce006
SHA118e3a6acb73b85bd39b91b853438d920d31c226a
SHA256d572832be75f73bb05e3d48ece0c55daff19c469566c1d46a0673be5f8de9dff
SHA512b75e49c519a34304ab7b2cbeffa529dda9103421554bc088d188003bf87347bee171ca495d4fba1f8899f6c0a51f40a59a4cdb3dbe684098ca09b863908ba1e1