Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
16-10-2023 18:16
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.31aa06702e3563d705d5f9f20a96bae0.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.31aa06702e3563d705d5f9f20a96bae0.exe
Resource
win10v2004-20230915-en
General
-
Target
NEAS.31aa06702e3563d705d5f9f20a96bae0.exe
-
Size
37KB
-
MD5
31aa06702e3563d705d5f9f20a96bae0
-
SHA1
56aa666b4acdbe881f8d50c734f57bdeba58949c
-
SHA256
f988e1706878a2e93a7331ad1ec76c43fef3f9320d8c5795834e4717dcbeb2ef
-
SHA512
b8c3b3145f441bd7bf0bcff759177aecd9fbba1326cc9c3274084f3f0d4498c38f16add98da8180e9e93bb37e017a9a62ff415523b006956865617d1d537cba7
-
SSDEEP
768:D7Xezc/T6Zp14hyYtoVxYF9mH8VQ1PcPW/M9ze:n6zqhyYtkYWRPTEze
Malware Config
Extracted
sakula
http://www.we11point.com:443/view.asp?cookie=%s&type=%d&vid=%d
http://www.we11point.com:443/photo/%s.jpg?vid=%d
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 4348 MediaCenter.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
NEAS.31aa06702e3563d705d5f9f20a96bae0.execmd.execmd.exedescription pid process target process PID 4244 wrote to memory of 4892 4244 NEAS.31aa06702e3563d705d5f9f20a96bae0.exe cmd.exe PID 4244 wrote to memory of 4892 4244 NEAS.31aa06702e3563d705d5f9f20a96bae0.exe cmd.exe PID 4244 wrote to memory of 4892 4244 NEAS.31aa06702e3563d705d5f9f20a96bae0.exe cmd.exe PID 4244 wrote to memory of 4348 4244 NEAS.31aa06702e3563d705d5f9f20a96bae0.exe MediaCenter.exe PID 4244 wrote to memory of 4348 4244 NEAS.31aa06702e3563d705d5f9f20a96bae0.exe MediaCenter.exe PID 4244 wrote to memory of 4348 4244 NEAS.31aa06702e3563d705d5f9f20a96bae0.exe MediaCenter.exe PID 4892 wrote to memory of 4948 4892 cmd.exe reg.exe PID 4892 wrote to memory of 4948 4892 cmd.exe reg.exe PID 4892 wrote to memory of 4948 4892 cmd.exe reg.exe PID 4244 wrote to memory of 3460 4244 NEAS.31aa06702e3563d705d5f9f20a96bae0.exe cmd.exe PID 4244 wrote to memory of 3460 4244 NEAS.31aa06702e3563d705d5f9f20a96bae0.exe cmd.exe PID 4244 wrote to memory of 3460 4244 NEAS.31aa06702e3563d705d5f9f20a96bae0.exe cmd.exe PID 3460 wrote to memory of 2132 3460 cmd.exe PING.EXE PID 3460 wrote to memory of 2132 3460 cmd.exe PING.EXE PID 3460 wrote to memory of 2132 3460 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.31aa06702e3563d705d5f9f20a96bae0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.31aa06702e3563d705d5f9f20a96bae0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:4348 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\NEAS.31aa06702e3563d705d5f9f20a96bae0.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:2132
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
37KB
MD5035790c5b0c2e161504cf584e6c6cf99
SHA1d2a8b29af9b5b4b7cc4b0783812a6127e9dbfe2a
SHA256bcf249397d40080849cf1a4bbbcf4fd05b8b6a6194aab612b155f9cc5e03e66f
SHA51248bb111fc432fec0606bf92280e5bdf229757942e667f8e3335c9d2c8d674e56d9ce981f94764e5f374bcb0078063a87b9e1519898b1dc3d7725505623d39b7e
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
37KB
MD5035790c5b0c2e161504cf584e6c6cf99
SHA1d2a8b29af9b5b4b7cc4b0783812a6127e9dbfe2a
SHA256bcf249397d40080849cf1a4bbbcf4fd05b8b6a6194aab612b155f9cc5e03e66f
SHA51248bb111fc432fec0606bf92280e5bdf229757942e667f8e3335c9d2c8d674e56d9ce981f94764e5f374bcb0078063a87b9e1519898b1dc3d7725505623d39b7e
-
memory/4244-0-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/4244-6-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/4348-5-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB