Analysis
-
max time kernel
127s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
21-10-2023 21:14
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.1dc74e2aff4dbcee2d1555ae9530da50.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.1dc74e2aff4dbcee2d1555ae9530da50.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.1dc74e2aff4dbcee2d1555ae9530da50.exe
-
Size
27KB
-
MD5
1dc74e2aff4dbcee2d1555ae9530da50
-
SHA1
074744dd9a96d91900ab1c8dce417aae7a2407aa
-
SHA256
c8feedbae6121eb725bd26332685c1b0aed12be1339160d3c6dce038baad81ba
-
SHA512
c11b795c88dce6fc6dfbc1cc613c61a6f0359bc9ff595de018d1a9da4e8e277d31c7d7352c8ea556fed84fa4c633a97fe8b3bc469e1446ff686cd013f9fdfd05
-
SSDEEP
384:am7SCFozc/T94Umdjpxq4TqvhyY3Q6oVxYU3llDT64LdAeMvVG:l7Xezc/T6Zp14hyYtoVxYPLVG
Malware Config
Extracted
sakula
http://www.we11point.com:443/view.asp?cookie=%s&type=%d&vid=%d
http://www.we11point.com:443/photo/%s.jpg?vid=%d
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2616 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 2512 MediaCenter.exe -
Loads dropped DLL 2 IoCs
Processes:
NEAS.1dc74e2aff4dbcee2d1555ae9530da50.exepid process 2904 NEAS.1dc74e2aff4dbcee2d1555ae9530da50.exe 2904 NEAS.1dc74e2aff4dbcee2d1555ae9530da50.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
NEAS.1dc74e2aff4dbcee2d1555ae9530da50.execmd.execmd.exedescription pid process target process PID 2904 wrote to memory of 2496 2904 NEAS.1dc74e2aff4dbcee2d1555ae9530da50.exe cmd.exe PID 2904 wrote to memory of 2496 2904 NEAS.1dc74e2aff4dbcee2d1555ae9530da50.exe cmd.exe PID 2904 wrote to memory of 2496 2904 NEAS.1dc74e2aff4dbcee2d1555ae9530da50.exe cmd.exe PID 2904 wrote to memory of 2496 2904 NEAS.1dc74e2aff4dbcee2d1555ae9530da50.exe cmd.exe PID 2904 wrote to memory of 2512 2904 NEAS.1dc74e2aff4dbcee2d1555ae9530da50.exe MediaCenter.exe PID 2904 wrote to memory of 2512 2904 NEAS.1dc74e2aff4dbcee2d1555ae9530da50.exe MediaCenter.exe PID 2904 wrote to memory of 2512 2904 NEAS.1dc74e2aff4dbcee2d1555ae9530da50.exe MediaCenter.exe PID 2904 wrote to memory of 2512 2904 NEAS.1dc74e2aff4dbcee2d1555ae9530da50.exe MediaCenter.exe PID 2496 wrote to memory of 2288 2496 cmd.exe reg.exe PID 2496 wrote to memory of 2288 2496 cmd.exe reg.exe PID 2496 wrote to memory of 2288 2496 cmd.exe reg.exe PID 2496 wrote to memory of 2288 2496 cmd.exe reg.exe PID 2904 wrote to memory of 2616 2904 NEAS.1dc74e2aff4dbcee2d1555ae9530da50.exe cmd.exe PID 2904 wrote to memory of 2616 2904 NEAS.1dc74e2aff4dbcee2d1555ae9530da50.exe cmd.exe PID 2904 wrote to memory of 2616 2904 NEAS.1dc74e2aff4dbcee2d1555ae9530da50.exe cmd.exe PID 2904 wrote to memory of 2616 2904 NEAS.1dc74e2aff4dbcee2d1555ae9530da50.exe cmd.exe PID 2616 wrote to memory of 2576 2616 cmd.exe PING.EXE PID 2616 wrote to memory of 2576 2616 cmd.exe PING.EXE PID 2616 wrote to memory of 2576 2616 cmd.exe PING.EXE PID 2616 wrote to memory of 2576 2616 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.1dc74e2aff4dbcee2d1555ae9530da50.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.1dc74e2aff4dbcee2d1555ae9530da50.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:2512 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\NEAS.1dc74e2aff4dbcee2d1555ae9530da50.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:2576
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
27KB
MD5a3f575a5313e4f00f6221940a9868c9c
SHA13a199913c787bbc888f408d5517e2de6b464131c
SHA2563535d26f1d4fe364a767f617c993da53af6add365e1d6571b5905c5884f731d4
SHA51284c02551d8d1af76a897fb3000929cb186af7346e0bffea3e5b8613ae8e75736173ea6a85a202bff6e8a6d525cf93673bbb1808ca2e178184f39a20a10e3505e
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
27KB
MD5a3f575a5313e4f00f6221940a9868c9c
SHA13a199913c787bbc888f408d5517e2de6b464131c
SHA2563535d26f1d4fe364a767f617c993da53af6add365e1d6571b5905c5884f731d4
SHA51284c02551d8d1af76a897fb3000929cb186af7346e0bffea3e5b8613ae8e75736173ea6a85a202bff6e8a6d525cf93673bbb1808ca2e178184f39a20a10e3505e
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
27KB
MD5a3f575a5313e4f00f6221940a9868c9c
SHA13a199913c787bbc888f408d5517e2de6b464131c
SHA2563535d26f1d4fe364a767f617c993da53af6add365e1d6571b5905c5884f731d4
SHA51284c02551d8d1af76a897fb3000929cb186af7346e0bffea3e5b8613ae8e75736173ea6a85a202bff6e8a6d525cf93673bbb1808ca2e178184f39a20a10e3505e
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
27KB
MD5a3f575a5313e4f00f6221940a9868c9c
SHA13a199913c787bbc888f408d5517e2de6b464131c
SHA2563535d26f1d4fe364a767f617c993da53af6add365e1d6571b5905c5884f731d4
SHA51284c02551d8d1af76a897fb3000929cb186af7346e0bffea3e5b8613ae8e75736173ea6a85a202bff6e8a6d525cf93673bbb1808ca2e178184f39a20a10e3505e
-
memory/2904-0-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/2904-9-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB