Analysis
-
max time kernel
142s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
21-10-2023 21:14
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.1dc74e2aff4dbcee2d1555ae9530da50.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.1dc74e2aff4dbcee2d1555ae9530da50.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.1dc74e2aff4dbcee2d1555ae9530da50.exe
-
Size
27KB
-
MD5
1dc74e2aff4dbcee2d1555ae9530da50
-
SHA1
074744dd9a96d91900ab1c8dce417aae7a2407aa
-
SHA256
c8feedbae6121eb725bd26332685c1b0aed12be1339160d3c6dce038baad81ba
-
SHA512
c11b795c88dce6fc6dfbc1cc613c61a6f0359bc9ff595de018d1a9da4e8e277d31c7d7352c8ea556fed84fa4c633a97fe8b3bc469e1446ff686cd013f9fdfd05
-
SSDEEP
384:am7SCFozc/T94Umdjpxq4TqvhyY3Q6oVxYU3llDT64LdAeMvVG:l7Xezc/T6Zp14hyYtoVxYPLVG
Malware Config
Extracted
sakula
http://www.we11point.com:443/view.asp?cookie=%s&type=%d&vid=%d
http://www.we11point.com:443/photo/%s.jpg?vid=%d
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 2864 MediaCenter.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
NEAS.1dc74e2aff4dbcee2d1555ae9530da50.execmd.execmd.exedescription pid process target process PID 1508 wrote to memory of 3820 1508 NEAS.1dc74e2aff4dbcee2d1555ae9530da50.exe cmd.exe PID 1508 wrote to memory of 3820 1508 NEAS.1dc74e2aff4dbcee2d1555ae9530da50.exe cmd.exe PID 1508 wrote to memory of 3820 1508 NEAS.1dc74e2aff4dbcee2d1555ae9530da50.exe cmd.exe PID 1508 wrote to memory of 2864 1508 NEAS.1dc74e2aff4dbcee2d1555ae9530da50.exe MediaCenter.exe PID 1508 wrote to memory of 2864 1508 NEAS.1dc74e2aff4dbcee2d1555ae9530da50.exe MediaCenter.exe PID 1508 wrote to memory of 2864 1508 NEAS.1dc74e2aff4dbcee2d1555ae9530da50.exe MediaCenter.exe PID 3820 wrote to memory of 4024 3820 cmd.exe reg.exe PID 3820 wrote to memory of 4024 3820 cmd.exe reg.exe PID 3820 wrote to memory of 4024 3820 cmd.exe reg.exe PID 1508 wrote to memory of 4060 1508 NEAS.1dc74e2aff4dbcee2d1555ae9530da50.exe cmd.exe PID 1508 wrote to memory of 4060 1508 NEAS.1dc74e2aff4dbcee2d1555ae9530da50.exe cmd.exe PID 1508 wrote to memory of 4060 1508 NEAS.1dc74e2aff4dbcee2d1555ae9530da50.exe cmd.exe PID 4060 wrote to memory of 3692 4060 cmd.exe PING.EXE PID 4060 wrote to memory of 3692 4060 cmd.exe PING.EXE PID 4060 wrote to memory of 3692 4060 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.1dc74e2aff4dbcee2d1555ae9530da50.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.1dc74e2aff4dbcee2d1555ae9530da50.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:2864 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\NEAS.1dc74e2aff4dbcee2d1555ae9530da50.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:3692
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
27KB
MD533e3eab7191b7c216529b80ed689a421
SHA17d2a52d42faf0fed39ef4a7bc25c686ab0136a69
SHA256f9d2855afea03d95b826f8cbdcaac74b80f0b22f45f4d1cd60e5f6108fbdd460
SHA512d4647460afc5667d6ab8cfd859bfa704a2a29096d8d16d0d19c5febf876d50e51a4c45df489d56812967a205060a5168521f09717dffc66c4f3009bdeab28d4c
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
27KB
MD533e3eab7191b7c216529b80ed689a421
SHA17d2a52d42faf0fed39ef4a7bc25c686ab0136a69
SHA256f9d2855afea03d95b826f8cbdcaac74b80f0b22f45f4d1cd60e5f6108fbdd460
SHA512d4647460afc5667d6ab8cfd859bfa704a2a29096d8d16d0d19c5febf876d50e51a4c45df489d56812967a205060a5168521f09717dffc66c4f3009bdeab28d4c
-
memory/1508-0-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/1508-5-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB