Analysis
-
max time kernel
155s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
16-10-2023 18:48
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.fcd95c36c15206b4e16a09f4e5ebc960.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.fcd95c36c15206b4e16a09f4e5ebc960.exe
Resource
win10v2004-20230915-en
General
-
Target
NEAS.fcd95c36c15206b4e16a09f4e5ebc960.exe
-
Size
40KB
-
MD5
fcd95c36c15206b4e16a09f4e5ebc960
-
SHA1
7cdf76b1fb29a154c897a4817ffa488c3de0a566
-
SHA256
fef2acf953872c647eed62a75f0a70dab2c2ace2fbf04519df01b68bfdf9e590
-
SHA512
19783deb866ebb206db025f6868b205d95955f2ccde8de8135b0b33cb99c9f4158826a600fd98b33582745bad0a95f445c2a2b2812398838307c702c885e59a1
-
SSDEEP
768:q7Xezc/T6Zp14hyYtoVxYF9mHfCBJTAIO3OtYVn:G6zqhyYtkYW/CPnO3P
Malware Config
Extracted
sakula
http://www.we11point.com:443/view.asp?cookie=%s&type=%d&vid=%d
http://www.we11point.com:443/photo/%s.jpg?vid=%d
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 1924 MediaCenter.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
NEAS.fcd95c36c15206b4e16a09f4e5ebc960.execmd.execmd.exedescription pid process target process PID 4540 wrote to memory of 5072 4540 NEAS.fcd95c36c15206b4e16a09f4e5ebc960.exe cmd.exe PID 4540 wrote to memory of 5072 4540 NEAS.fcd95c36c15206b4e16a09f4e5ebc960.exe cmd.exe PID 4540 wrote to memory of 5072 4540 NEAS.fcd95c36c15206b4e16a09f4e5ebc960.exe cmd.exe PID 4540 wrote to memory of 1924 4540 NEAS.fcd95c36c15206b4e16a09f4e5ebc960.exe MediaCenter.exe PID 4540 wrote to memory of 1924 4540 NEAS.fcd95c36c15206b4e16a09f4e5ebc960.exe MediaCenter.exe PID 4540 wrote to memory of 1924 4540 NEAS.fcd95c36c15206b4e16a09f4e5ebc960.exe MediaCenter.exe PID 5072 wrote to memory of 4920 5072 cmd.exe reg.exe PID 5072 wrote to memory of 4920 5072 cmd.exe reg.exe PID 5072 wrote to memory of 4920 5072 cmd.exe reg.exe PID 4540 wrote to memory of 4700 4540 NEAS.fcd95c36c15206b4e16a09f4e5ebc960.exe cmd.exe PID 4540 wrote to memory of 4700 4540 NEAS.fcd95c36c15206b4e16a09f4e5ebc960.exe cmd.exe PID 4540 wrote to memory of 4700 4540 NEAS.fcd95c36c15206b4e16a09f4e5ebc960.exe cmd.exe PID 4700 wrote to memory of 3752 4700 cmd.exe PING.EXE PID 4700 wrote to memory of 3752 4700 cmd.exe PING.EXE PID 4700 wrote to memory of 3752 4700 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.fcd95c36c15206b4e16a09f4e5ebc960.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.fcd95c36c15206b4e16a09f4e5ebc960.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:1924 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\NEAS.fcd95c36c15206b4e16a09f4e5ebc960.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:3752
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
40KB
MD5bb495231a9913355776468aff33956c4
SHA149832e140d69c7d4d7443d0556700f3925b9c9bd
SHA256efbe43104c9d723903fa9402e30d1d497e9f3567719a502101679aab0692eaef
SHA512b9e48f3b60b6c2668bff4ea6b7f883f428b42f64451969844acb8b5a16ed67b951142f06118716eb26af10f7ee397b853d608e2f723a404cd3e796d3206a6ecc
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
40KB
MD5bb495231a9913355776468aff33956c4
SHA149832e140d69c7d4d7443d0556700f3925b9c9bd
SHA256efbe43104c9d723903fa9402e30d1d497e9f3567719a502101679aab0692eaef
SHA512b9e48f3b60b6c2668bff4ea6b7f883f428b42f64451969844acb8b5a16ed67b951142f06118716eb26af10f7ee397b853d608e2f723a404cd3e796d3206a6ecc
-
memory/4540-0-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/4540-1-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/4540-2-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/4540-7-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB