Analysis
-
max time kernel
147s -
max time network
167s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
16-10-2023 18:20
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.4b55f3df2821daf0e027191ee5d28460.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.4b55f3df2821daf0e027191ee5d28460.exe
Resource
win10v2004-20230915-en
General
-
Target
NEAS.4b55f3df2821daf0e027191ee5d28460.exe
-
Size
72KB
-
MD5
4b55f3df2821daf0e027191ee5d28460
-
SHA1
12f3a63ae06416f251dcd23723a5b5dcd59ff1f1
-
SHA256
475930304ddec613ea123921dbabe479adeb1f66f44b7e1799c54518c998be6c
-
SHA512
924bb313211ce3854b4ef25eb6cf2d72a723e442dd75189276882c1b4fc391a9c4768e77b3923185d285fe6dbcc9d41054b5d271bfbba4f101138f248e3ae02d
-
SSDEEP
768:q7Xezc/T6Zp14hyYtoVxYF9mHfCBJTAIO3OtYVW6QptwyX:G6zqhyYtkYW/CPnO3ajwyX
Malware Config
Extracted
sakula
http://www.we11point.com:443/view.asp?cookie=%s&type=%d&vid=%d
http://www.we11point.com:443/photo/%s.jpg?vid=%d
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 3028 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 2120 MediaCenter.exe -
Loads dropped DLL 2 IoCs
Processes:
NEAS.4b55f3df2821daf0e027191ee5d28460.exepid process 2176 NEAS.4b55f3df2821daf0e027191ee5d28460.exe 2176 NEAS.4b55f3df2821daf0e027191ee5d28460.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
NEAS.4b55f3df2821daf0e027191ee5d28460.execmd.execmd.exedescription pid process target process PID 2176 wrote to memory of 2832 2176 NEAS.4b55f3df2821daf0e027191ee5d28460.exe cmd.exe PID 2176 wrote to memory of 2832 2176 NEAS.4b55f3df2821daf0e027191ee5d28460.exe cmd.exe PID 2176 wrote to memory of 2832 2176 NEAS.4b55f3df2821daf0e027191ee5d28460.exe cmd.exe PID 2176 wrote to memory of 2832 2176 NEAS.4b55f3df2821daf0e027191ee5d28460.exe cmd.exe PID 2176 wrote to memory of 2120 2176 NEAS.4b55f3df2821daf0e027191ee5d28460.exe MediaCenter.exe PID 2176 wrote to memory of 2120 2176 NEAS.4b55f3df2821daf0e027191ee5d28460.exe MediaCenter.exe PID 2176 wrote to memory of 2120 2176 NEAS.4b55f3df2821daf0e027191ee5d28460.exe MediaCenter.exe PID 2176 wrote to memory of 2120 2176 NEAS.4b55f3df2821daf0e027191ee5d28460.exe MediaCenter.exe PID 2832 wrote to memory of 2692 2832 cmd.exe reg.exe PID 2832 wrote to memory of 2692 2832 cmd.exe reg.exe PID 2832 wrote to memory of 2692 2832 cmd.exe reg.exe PID 2832 wrote to memory of 2692 2832 cmd.exe reg.exe PID 2176 wrote to memory of 3028 2176 NEAS.4b55f3df2821daf0e027191ee5d28460.exe cmd.exe PID 2176 wrote to memory of 3028 2176 NEAS.4b55f3df2821daf0e027191ee5d28460.exe cmd.exe PID 2176 wrote to memory of 3028 2176 NEAS.4b55f3df2821daf0e027191ee5d28460.exe cmd.exe PID 2176 wrote to memory of 3028 2176 NEAS.4b55f3df2821daf0e027191ee5d28460.exe cmd.exe PID 3028 wrote to memory of 2484 3028 cmd.exe PING.EXE PID 3028 wrote to memory of 2484 3028 cmd.exe PING.EXE PID 3028 wrote to memory of 2484 3028 cmd.exe PING.EXE PID 3028 wrote to memory of 2484 3028 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.4b55f3df2821daf0e027191ee5d28460.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.4b55f3df2821daf0e027191ee5d28460.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:2120 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\NEAS.4b55f3df2821daf0e027191ee5d28460.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:2484
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
72KB
MD54002c9ef9e4253766ca69d641228fc94
SHA127bffc4911d448e0ebc714091edbf89c287c71a1
SHA256cfe2ab1e0c9b7f2d37172801d5c244901c6ec0f3c3f47a764e82381ab12a5716
SHA5126f4103ff1031fd7e1ea413735ab1be50cad5c4d7fc2d03a112e9066200bd652b16bf4833b83e904437361fc1cf3749c07c7b0b08e7cd0aa292a5e5936bd8cab4
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
72KB
MD54002c9ef9e4253766ca69d641228fc94
SHA127bffc4911d448e0ebc714091edbf89c287c71a1
SHA256cfe2ab1e0c9b7f2d37172801d5c244901c6ec0f3c3f47a764e82381ab12a5716
SHA5126f4103ff1031fd7e1ea413735ab1be50cad5c4d7fc2d03a112e9066200bd652b16bf4833b83e904437361fc1cf3749c07c7b0b08e7cd0aa292a5e5936bd8cab4
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
72KB
MD54002c9ef9e4253766ca69d641228fc94
SHA127bffc4911d448e0ebc714091edbf89c287c71a1
SHA256cfe2ab1e0c9b7f2d37172801d5c244901c6ec0f3c3f47a764e82381ab12a5716
SHA5126f4103ff1031fd7e1ea413735ab1be50cad5c4d7fc2d03a112e9066200bd652b16bf4833b83e904437361fc1cf3749c07c7b0b08e7cd0aa292a5e5936bd8cab4
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
72KB
MD54002c9ef9e4253766ca69d641228fc94
SHA127bffc4911d448e0ebc714091edbf89c287c71a1
SHA256cfe2ab1e0c9b7f2d37172801d5c244901c6ec0f3c3f47a764e82381ab12a5716
SHA5126f4103ff1031fd7e1ea413735ab1be50cad5c4d7fc2d03a112e9066200bd652b16bf4833b83e904437361fc1cf3749c07c7b0b08e7cd0aa292a5e5936bd8cab4
-
memory/2120-11-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2176-0-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2176-1-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2176-10-0x0000000000220000-0x000000000022A000-memory.dmpFilesize
40KB
-
memory/2176-12-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2176-13-0x0000000000220000-0x000000000022A000-memory.dmpFilesize
40KB