Analysis
-
max time kernel
140s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
17-10-2023 21:51
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.3004e60797cdd74b27819ffb5ffef2b0_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.3004e60797cdd74b27819ffb5ffef2b0_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
NEAS.3004e60797cdd74b27819ffb5ffef2b0_JC.exe
-
Size
71KB
-
MD5
3004e60797cdd74b27819ffb5ffef2b0
-
SHA1
8c2fd283c7bf498efd3c20bf4cc224648d7dcb52
-
SHA256
82bb4fe580e2d7ece683c8d0fc74f2968f029c75e685eb5181bc81fdbb576039
-
SHA512
49bff79d90a1f766a07617111cd164caef4714fa5e012480e0b653b6a4b02e9f4ebca4ca782c27d84c0017fbc20f5f263a439de8c0d35935ab1addd60d3932d2
-
SSDEEP
768:bhSksandb4GgyMsp4hyYtoVxYGm1ZAe0oAGo:bTsGpehyYtkYvnr0o9o
Malware Config
Extracted
sakula
http://vpn.premrera.com:443/viewpre.asp?cstring=%s&tom=%d&id=%d
http://vpn.premrera.com:443/photo/%s.jpg?id=%d
http://173.254.226.212:443/viewpre.asp?cstring=%s&tom=%d&id=%d
http://173.254.226.212:443/photo/%s.jpg?id=%d
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 4148 MediaCenter.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
NEAS.3004e60797cdd74b27819ffb5ffef2b0_JC.execmd.execmd.execmd.exedescription pid process target process PID 3036 wrote to memory of 3052 3036 NEAS.3004e60797cdd74b27819ffb5ffef2b0_JC.exe cmd.exe PID 3036 wrote to memory of 3052 3036 NEAS.3004e60797cdd74b27819ffb5ffef2b0_JC.exe cmd.exe PID 3036 wrote to memory of 3052 3036 NEAS.3004e60797cdd74b27819ffb5ffef2b0_JC.exe cmd.exe PID 3036 wrote to memory of 2204 3036 NEAS.3004e60797cdd74b27819ffb5ffef2b0_JC.exe cmd.exe PID 3036 wrote to memory of 2204 3036 NEAS.3004e60797cdd74b27819ffb5ffef2b0_JC.exe cmd.exe PID 3036 wrote to memory of 2204 3036 NEAS.3004e60797cdd74b27819ffb5ffef2b0_JC.exe cmd.exe PID 3036 wrote to memory of 3572 3036 NEAS.3004e60797cdd74b27819ffb5ffef2b0_JC.exe cmd.exe PID 3036 wrote to memory of 3572 3036 NEAS.3004e60797cdd74b27819ffb5ffef2b0_JC.exe cmd.exe PID 3036 wrote to memory of 3572 3036 NEAS.3004e60797cdd74b27819ffb5ffef2b0_JC.exe cmd.exe PID 3052 wrote to memory of 4316 3052 cmd.exe reg.exe PID 3052 wrote to memory of 4316 3052 cmd.exe reg.exe PID 3052 wrote to memory of 4316 3052 cmd.exe reg.exe PID 3572 wrote to memory of 1876 3572 cmd.exe PING.EXE PID 3572 wrote to memory of 1876 3572 cmd.exe PING.EXE PID 3572 wrote to memory of 1876 3572 cmd.exe PING.EXE PID 2204 wrote to memory of 4148 2204 cmd.exe MediaCenter.exe PID 2204 wrote to memory of 4148 2204 cmd.exe MediaCenter.exe PID 2204 wrote to memory of 4148 2204 cmd.exe MediaCenter.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.3004e60797cdd74b27819ffb5ffef2b0_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.3004e60797cdd74b27819ffb5ffef2b0_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
PID:4316 -
C:\Windows\SysWOW64\cmd.execmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe3⤵
- Executes dropped EXE
PID:4148 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\NEAS.3004e60797cdd74b27819ffb5ffef2b0_JC.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:1876
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
71KB
MD5625838939c8f1281d01504b0da26e4cf
SHA1f8cb5192ee899d5f69ec1b8d81e1ab6a50fcea92
SHA256aabd7c59fdb647cfbc2896def738916b9e96783f01e8d52d6d7d77f9e998ba7b
SHA512e831f8578f5f8a92a64950a28a92fad61244f91648977c375f73b3e1e2586b75cc93b57e9e72372f73a7d85285309bac04fc6341f89011113bf2679fe246cc26
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
71KB
MD5625838939c8f1281d01504b0da26e4cf
SHA1f8cb5192ee899d5f69ec1b8d81e1ab6a50fcea92
SHA256aabd7c59fdb647cfbc2896def738916b9e96783f01e8d52d6d7d77f9e998ba7b
SHA512e831f8578f5f8a92a64950a28a92fad61244f91648977c375f73b3e1e2586b75cc93b57e9e72372f73a7d85285309bac04fc6341f89011113bf2679fe246cc26
-
memory/3036-0-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/3036-1-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/3036-2-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/3036-4-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/4148-8-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/4148-9-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB