Analysis
-
max time kernel
143s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
16-10-2023 18:20
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.4b55f3df2821daf0e027191ee5d28460.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.4b55f3df2821daf0e027191ee5d28460.exe
Resource
win10v2004-20230915-en
General
-
Target
NEAS.4b55f3df2821daf0e027191ee5d28460.exe
-
Size
72KB
-
MD5
4b55f3df2821daf0e027191ee5d28460
-
SHA1
12f3a63ae06416f251dcd23723a5b5dcd59ff1f1
-
SHA256
475930304ddec613ea123921dbabe479adeb1f66f44b7e1799c54518c998be6c
-
SHA512
924bb313211ce3854b4ef25eb6cf2d72a723e442dd75189276882c1b4fc391a9c4768e77b3923185d285fe6dbcc9d41054b5d271bfbba4f101138f248e3ae02d
-
SSDEEP
768:q7Xezc/T6Zp14hyYtoVxYF9mHfCBJTAIO3OtYVW6QptwyX:G6zqhyYtkYW/CPnO3ajwyX
Malware Config
Extracted
sakula
http://www.we11point.com:443/view.asp?cookie=%s&type=%d&vid=%d
http://www.we11point.com:443/photo/%s.jpg?vid=%d
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 2032 MediaCenter.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
NEAS.4b55f3df2821daf0e027191ee5d28460.execmd.execmd.exedescription pid process target process PID 2508 wrote to memory of 1968 2508 NEAS.4b55f3df2821daf0e027191ee5d28460.exe cmd.exe PID 2508 wrote to memory of 1968 2508 NEAS.4b55f3df2821daf0e027191ee5d28460.exe cmd.exe PID 2508 wrote to memory of 1968 2508 NEAS.4b55f3df2821daf0e027191ee5d28460.exe cmd.exe PID 2508 wrote to memory of 2032 2508 NEAS.4b55f3df2821daf0e027191ee5d28460.exe MediaCenter.exe PID 2508 wrote to memory of 2032 2508 NEAS.4b55f3df2821daf0e027191ee5d28460.exe MediaCenter.exe PID 2508 wrote to memory of 2032 2508 NEAS.4b55f3df2821daf0e027191ee5d28460.exe MediaCenter.exe PID 1968 wrote to memory of 1976 1968 cmd.exe reg.exe PID 1968 wrote to memory of 1976 1968 cmd.exe reg.exe PID 1968 wrote to memory of 1976 1968 cmd.exe reg.exe PID 2508 wrote to memory of 4764 2508 NEAS.4b55f3df2821daf0e027191ee5d28460.exe cmd.exe PID 2508 wrote to memory of 4764 2508 NEAS.4b55f3df2821daf0e027191ee5d28460.exe cmd.exe PID 2508 wrote to memory of 4764 2508 NEAS.4b55f3df2821daf0e027191ee5d28460.exe cmd.exe PID 4764 wrote to memory of 2720 4764 cmd.exe PING.EXE PID 4764 wrote to memory of 2720 4764 cmd.exe PING.EXE PID 4764 wrote to memory of 2720 4764 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.4b55f3df2821daf0e027191ee5d28460.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.4b55f3df2821daf0e027191ee5d28460.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:2032 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\NEAS.4b55f3df2821daf0e027191ee5d28460.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:2720
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
72KB
MD51e3e627f04f9f7d7b65727e8c31de62a
SHA19792867b29b1465ea37b959c64777145ac639670
SHA256c3c77c2b16aa029f07694165e6b92d59df9af2013172ac66f278b96b9bc61f69
SHA51265d41afef2527705512f637395b05e1d02cff26351cb88580c6a7201f340943f0ac0223ce5fd17065656fb4e2bf07d704f323fe25631b7f234d0937bcd8ce805
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
72KB
MD51e3e627f04f9f7d7b65727e8c31de62a
SHA19792867b29b1465ea37b959c64777145ac639670
SHA256c3c77c2b16aa029f07694165e6b92d59df9af2013172ac66f278b96b9bc61f69
SHA51265d41afef2527705512f637395b05e1d02cff26351cb88580c6a7201f340943f0ac0223ce5fd17065656fb4e2bf07d704f323fe25631b7f234d0937bcd8ce805
-
memory/2508-0-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2508-1-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2508-6-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB