Analysis
-
max time kernel
146s -
max time network
164s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
16-10-2023 18:48
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.fcd95c36c15206b4e16a09f4e5ebc960.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.fcd95c36c15206b4e16a09f4e5ebc960.exe
Resource
win10v2004-20230915-en
General
-
Target
NEAS.fcd95c36c15206b4e16a09f4e5ebc960.exe
-
Size
40KB
-
MD5
fcd95c36c15206b4e16a09f4e5ebc960
-
SHA1
7cdf76b1fb29a154c897a4817ffa488c3de0a566
-
SHA256
fef2acf953872c647eed62a75f0a70dab2c2ace2fbf04519df01b68bfdf9e590
-
SHA512
19783deb866ebb206db025f6868b205d95955f2ccde8de8135b0b33cb99c9f4158826a600fd98b33582745bad0a95f445c2a2b2812398838307c702c885e59a1
-
SSDEEP
768:q7Xezc/T6Zp14hyYtoVxYF9mHfCBJTAIO3OtYVn:G6zqhyYtkYW/CPnO3P
Malware Config
Extracted
sakula
http://www.we11point.com:443/view.asp?cookie=%s&type=%d&vid=%d
http://www.we11point.com:443/photo/%s.jpg?vid=%d
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2552 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 3000 MediaCenter.exe -
Loads dropped DLL 2 IoCs
Processes:
NEAS.fcd95c36c15206b4e16a09f4e5ebc960.exepid process 2040 NEAS.fcd95c36c15206b4e16a09f4e5ebc960.exe 2040 NEAS.fcd95c36c15206b4e16a09f4e5ebc960.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
NEAS.fcd95c36c15206b4e16a09f4e5ebc960.execmd.execmd.exedescription pid process target process PID 2040 wrote to memory of 2412 2040 NEAS.fcd95c36c15206b4e16a09f4e5ebc960.exe cmd.exe PID 2040 wrote to memory of 2412 2040 NEAS.fcd95c36c15206b4e16a09f4e5ebc960.exe cmd.exe PID 2040 wrote to memory of 2412 2040 NEAS.fcd95c36c15206b4e16a09f4e5ebc960.exe cmd.exe PID 2040 wrote to memory of 2412 2040 NEAS.fcd95c36c15206b4e16a09f4e5ebc960.exe cmd.exe PID 2040 wrote to memory of 3000 2040 NEAS.fcd95c36c15206b4e16a09f4e5ebc960.exe MediaCenter.exe PID 2040 wrote to memory of 3000 2040 NEAS.fcd95c36c15206b4e16a09f4e5ebc960.exe MediaCenter.exe PID 2040 wrote to memory of 3000 2040 NEAS.fcd95c36c15206b4e16a09f4e5ebc960.exe MediaCenter.exe PID 2040 wrote to memory of 3000 2040 NEAS.fcd95c36c15206b4e16a09f4e5ebc960.exe MediaCenter.exe PID 2412 wrote to memory of 2120 2412 cmd.exe reg.exe PID 2412 wrote to memory of 2120 2412 cmd.exe reg.exe PID 2412 wrote to memory of 2120 2412 cmd.exe reg.exe PID 2412 wrote to memory of 2120 2412 cmd.exe reg.exe PID 2040 wrote to memory of 2552 2040 NEAS.fcd95c36c15206b4e16a09f4e5ebc960.exe cmd.exe PID 2040 wrote to memory of 2552 2040 NEAS.fcd95c36c15206b4e16a09f4e5ebc960.exe cmd.exe PID 2040 wrote to memory of 2552 2040 NEAS.fcd95c36c15206b4e16a09f4e5ebc960.exe cmd.exe PID 2040 wrote to memory of 2552 2040 NEAS.fcd95c36c15206b4e16a09f4e5ebc960.exe cmd.exe PID 2552 wrote to memory of 3028 2552 cmd.exe PING.EXE PID 2552 wrote to memory of 3028 2552 cmd.exe PING.EXE PID 2552 wrote to memory of 3028 2552 cmd.exe PING.EXE PID 2552 wrote to memory of 3028 2552 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.fcd95c36c15206b4e16a09f4e5ebc960.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.fcd95c36c15206b4e16a09f4e5ebc960.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:3000 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\NEAS.fcd95c36c15206b4e16a09f4e5ebc960.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:3028
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
40KB
MD569345e9e8f8e7a38901b31b0d9fcd709
SHA102271ca47af43fa7afc7f3b668791c79e8ea5cae
SHA25655cbc9f208a1ccbe45ef1d00cfdc8474d49c574c8d97604497e1168dc8e29e8c
SHA512c05b7decbc46c0a95aa95c621db6ccb1dde21fa12b15f6125caeb26ec4d792104534e39cec5e61ab5c4ff64f884df4dcd88967bd310c496f40f5dbc1476c3d73
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
40KB
MD569345e9e8f8e7a38901b31b0d9fcd709
SHA102271ca47af43fa7afc7f3b668791c79e8ea5cae
SHA25655cbc9f208a1ccbe45ef1d00cfdc8474d49c574c8d97604497e1168dc8e29e8c
SHA512c05b7decbc46c0a95aa95c621db6ccb1dde21fa12b15f6125caeb26ec4d792104534e39cec5e61ab5c4ff64f884df4dcd88967bd310c496f40f5dbc1476c3d73
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
40KB
MD569345e9e8f8e7a38901b31b0d9fcd709
SHA102271ca47af43fa7afc7f3b668791c79e8ea5cae
SHA25655cbc9f208a1ccbe45ef1d00cfdc8474d49c574c8d97604497e1168dc8e29e8c
SHA512c05b7decbc46c0a95aa95c621db6ccb1dde21fa12b15f6125caeb26ec4d792104534e39cec5e61ab5c4ff64f884df4dcd88967bd310c496f40f5dbc1476c3d73
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
40KB
MD569345e9e8f8e7a38901b31b0d9fcd709
SHA102271ca47af43fa7afc7f3b668791c79e8ea5cae
SHA25655cbc9f208a1ccbe45ef1d00cfdc8474d49c574c8d97604497e1168dc8e29e8c
SHA512c05b7decbc46c0a95aa95c621db6ccb1dde21fa12b15f6125caeb26ec4d792104534e39cec5e61ab5c4ff64f884df4dcd88967bd310c496f40f5dbc1476c3d73
-
memory/2040-0-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2040-1-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2040-5-0x0000000000220000-0x000000000022A000-memory.dmpFilesize
40KB
-
memory/2040-11-0x0000000000220000-0x000000000022A000-memory.dmpFilesize
40KB
-
memory/2040-12-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2040-14-0x0000000000220000-0x000000000022A000-memory.dmpFilesize
40KB
-
memory/2040-15-0x0000000000220000-0x000000000022A000-memory.dmpFilesize
40KB
-
memory/3000-13-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB