Analysis
-
max time kernel
175s -
max time network
205s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
17-10-2023 21:51
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.3004e60797cdd74b27819ffb5ffef2b0_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.3004e60797cdd74b27819ffb5ffef2b0_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
NEAS.3004e60797cdd74b27819ffb5ffef2b0_JC.exe
-
Size
71KB
-
MD5
3004e60797cdd74b27819ffb5ffef2b0
-
SHA1
8c2fd283c7bf498efd3c20bf4cc224648d7dcb52
-
SHA256
82bb4fe580e2d7ece683c8d0fc74f2968f029c75e685eb5181bc81fdbb576039
-
SHA512
49bff79d90a1f766a07617111cd164caef4714fa5e012480e0b653b6a4b02e9f4ebca4ca782c27d84c0017fbc20f5f263a439de8c0d35935ab1addd60d3932d2
-
SSDEEP
768:bhSksandb4GgyMsp4hyYtoVxYGm1ZAe0oAGo:bTsGpehyYtkYvnr0o9o
Malware Config
Extracted
sakula
http://vpn.premrera.com:443/viewpre.asp?cstring=%s&tom=%d&id=%d
http://vpn.premrera.com:443/photo/%s.jpg?id=%d
http://173.254.226.212:443/viewpre.asp?cstring=%s&tom=%d&id=%d
http://173.254.226.212:443/photo/%s.jpg?id=%d
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 3000 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 2808 MediaCenter.exe -
Loads dropped DLL 2 IoCs
Processes:
cmd.exepid process 2796 cmd.exe 2796 cmd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
NEAS.3004e60797cdd74b27819ffb5ffef2b0_JC.execmd.execmd.execmd.exedescription pid process target process PID 2664 wrote to memory of 2740 2664 NEAS.3004e60797cdd74b27819ffb5ffef2b0_JC.exe cmd.exe PID 2664 wrote to memory of 2740 2664 NEAS.3004e60797cdd74b27819ffb5ffef2b0_JC.exe cmd.exe PID 2664 wrote to memory of 2740 2664 NEAS.3004e60797cdd74b27819ffb5ffef2b0_JC.exe cmd.exe PID 2664 wrote to memory of 2740 2664 NEAS.3004e60797cdd74b27819ffb5ffef2b0_JC.exe cmd.exe PID 2664 wrote to memory of 2796 2664 NEAS.3004e60797cdd74b27819ffb5ffef2b0_JC.exe cmd.exe PID 2664 wrote to memory of 2796 2664 NEAS.3004e60797cdd74b27819ffb5ffef2b0_JC.exe cmd.exe PID 2664 wrote to memory of 2796 2664 NEAS.3004e60797cdd74b27819ffb5ffef2b0_JC.exe cmd.exe PID 2664 wrote to memory of 2796 2664 NEAS.3004e60797cdd74b27819ffb5ffef2b0_JC.exe cmd.exe PID 2664 wrote to memory of 3000 2664 NEAS.3004e60797cdd74b27819ffb5ffef2b0_JC.exe cmd.exe PID 2664 wrote to memory of 3000 2664 NEAS.3004e60797cdd74b27819ffb5ffef2b0_JC.exe cmd.exe PID 2664 wrote to memory of 3000 2664 NEAS.3004e60797cdd74b27819ffb5ffef2b0_JC.exe cmd.exe PID 2664 wrote to memory of 3000 2664 NEAS.3004e60797cdd74b27819ffb5ffef2b0_JC.exe cmd.exe PID 3000 wrote to memory of 2552 3000 cmd.exe PING.EXE PID 3000 wrote to memory of 2552 3000 cmd.exe PING.EXE PID 3000 wrote to memory of 2552 3000 cmd.exe PING.EXE PID 3000 wrote to memory of 2552 3000 cmd.exe PING.EXE PID 2740 wrote to memory of 2544 2740 cmd.exe reg.exe PID 2740 wrote to memory of 2544 2740 cmd.exe reg.exe PID 2740 wrote to memory of 2544 2740 cmd.exe reg.exe PID 2740 wrote to memory of 2544 2740 cmd.exe reg.exe PID 2796 wrote to memory of 2808 2796 cmd.exe MediaCenter.exe PID 2796 wrote to memory of 2808 2796 cmd.exe MediaCenter.exe PID 2796 wrote to memory of 2808 2796 cmd.exe MediaCenter.exe PID 2796 wrote to memory of 2808 2796 cmd.exe MediaCenter.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.3004e60797cdd74b27819ffb5ffef2b0_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.3004e60797cdd74b27819ffb5ffef2b0_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
PID:2544 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\NEAS.3004e60797cdd74b27819ffb5ffef2b0_JC.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:2552 -
C:\Windows\SysWOW64\cmd.execmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe3⤵
- Executes dropped EXE
PID:2808
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
71KB
MD588471073103524b08ce13cbb52cabb8a
SHA12c67b438eee3883cf7e0e1fd8c70985245ddc593
SHA2560b6b7810ade40b1ea7cbb7c7715d6d54c95f9f09f83bdc38b94abb394d9e902c
SHA512d773b2fd9c113f9bfb0788fddf530032de56bfce2968f20c35fbe935b1718879cabbca8a3e72c0ede635fef851d64aedcbc7ae0267ce3b4ee396c38ba7de3d5e
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
71KB
MD588471073103524b08ce13cbb52cabb8a
SHA12c67b438eee3883cf7e0e1fd8c70985245ddc593
SHA2560b6b7810ade40b1ea7cbb7c7715d6d54c95f9f09f83bdc38b94abb394d9e902c
SHA512d773b2fd9c113f9bfb0788fddf530032de56bfce2968f20c35fbe935b1718879cabbca8a3e72c0ede635fef851d64aedcbc7ae0267ce3b4ee396c38ba7de3d5e
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
71KB
MD588471073103524b08ce13cbb52cabb8a
SHA12c67b438eee3883cf7e0e1fd8c70985245ddc593
SHA2560b6b7810ade40b1ea7cbb7c7715d6d54c95f9f09f83bdc38b94abb394d9e902c
SHA512d773b2fd9c113f9bfb0788fddf530032de56bfce2968f20c35fbe935b1718879cabbca8a3e72c0ede635fef851d64aedcbc7ae0267ce3b4ee396c38ba7de3d5e
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
71KB
MD588471073103524b08ce13cbb52cabb8a
SHA12c67b438eee3883cf7e0e1fd8c70985245ddc593
SHA2560b6b7810ade40b1ea7cbb7c7715d6d54c95f9f09f83bdc38b94abb394d9e902c
SHA512d773b2fd9c113f9bfb0788fddf530032de56bfce2968f20c35fbe935b1718879cabbca8a3e72c0ede635fef851d64aedcbc7ae0267ce3b4ee396c38ba7de3d5e
-
memory/2664-1-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2664-3-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2664-4-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2664-0-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2796-8-0x00000000000B0000-0x00000000000BB000-memory.dmpFilesize
44KB
-
memory/2796-11-0x00000000000B0000-0x00000000000BB000-memory.dmpFilesize
44KB
-
memory/2796-12-0x00000000000B0000-0x00000000000BB000-memory.dmpFilesize
44KB
-
memory/2808-10-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2808-13-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB