Analysis
-
max time kernel
33s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
21-10-2023 21:16
Behavioral task
behavioral1
Sample
NEAS.2f45c823eca44d5757b56ac23eda0f50.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.2f45c823eca44d5757b56ac23eda0f50.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.2f45c823eca44d5757b56ac23eda0f50.exe
-
Size
79KB
-
MD5
2f45c823eca44d5757b56ac23eda0f50
-
SHA1
69f8a634d00dab70cd802ef96d43c4d591793511
-
SHA256
cc00781153863a1b930cec0b6e13f590f0315be0553b736f334ffa12975b583b
-
SHA512
259e1bac878c21cc35d5375737fa26b4a87d35572dfaa4b175e2be2cd7d724921e843a84d16ef36daf308aeaf09808f1067ad39eb53ab42c200aa8494a236e26
-
SSDEEP
1536:MSoaj1hJL1S9t0MIeboal8bCKxo7h0RP0jwHVz30rtrop:M90hpgz6xGhTjwHN30BEp
Malware Config
Signatures
-
Sakula payload 4 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula \Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula \Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 2348 MediaCenter.exe -
Loads dropped DLL 2 IoCs
Processes:
NEAS.2f45c823eca44d5757b56ac23eda0f50.exepid process 2968 NEAS.2f45c823eca44d5757b56ac23eda0f50.exe 2968 NEAS.2f45c823eca44d5757b56ac23eda0f50.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
NEAS.2f45c823eca44d5757b56ac23eda0f50.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" NEAS.2f45c823eca44d5757b56ac23eda0f50.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
NEAS.2f45c823eca44d5757b56ac23eda0f50.exedescription pid process Token: SeIncBasePriorityPrivilege 2968 NEAS.2f45c823eca44d5757b56ac23eda0f50.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
NEAS.2f45c823eca44d5757b56ac23eda0f50.exedescription pid process target process PID 2968 wrote to memory of 2348 2968 NEAS.2f45c823eca44d5757b56ac23eda0f50.exe MediaCenter.exe PID 2968 wrote to memory of 2348 2968 NEAS.2f45c823eca44d5757b56ac23eda0f50.exe MediaCenter.exe PID 2968 wrote to memory of 2348 2968 NEAS.2f45c823eca44d5757b56ac23eda0f50.exe MediaCenter.exe PID 2968 wrote to memory of 2348 2968 NEAS.2f45c823eca44d5757b56ac23eda0f50.exe MediaCenter.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.2f45c823eca44d5757b56ac23eda0f50.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.2f45c823eca44d5757b56ac23eda0f50.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:2348
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
79KB
MD53c024b345bc37a8104a3ee9074af2703
SHA101a055fb5db08d03c18d1b1be4316f0f94ebafff
SHA2565c96268f9d885de90bdd63464cdd0a533e5b461db2482fc9d92ab154c7a23197
SHA5125042748da1416c7168693a401386a92e4fea880d4b898299cec5870557f1daafc7bfdf4822213e7e2a3260d996abccd460cb0eabf969e45a6157e7fdb0f8da84
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
79KB
MD53c024b345bc37a8104a3ee9074af2703
SHA101a055fb5db08d03c18d1b1be4316f0f94ebafff
SHA2565c96268f9d885de90bdd63464cdd0a533e5b461db2482fc9d92ab154c7a23197
SHA5125042748da1416c7168693a401386a92e4fea880d4b898299cec5870557f1daafc7bfdf4822213e7e2a3260d996abccd460cb0eabf969e45a6157e7fdb0f8da84
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
79KB
MD53c024b345bc37a8104a3ee9074af2703
SHA101a055fb5db08d03c18d1b1be4316f0f94ebafff
SHA2565c96268f9d885de90bdd63464cdd0a533e5b461db2482fc9d92ab154c7a23197
SHA5125042748da1416c7168693a401386a92e4fea880d4b898299cec5870557f1daafc7bfdf4822213e7e2a3260d996abccd460cb0eabf969e45a6157e7fdb0f8da84
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
79KB
MD53c024b345bc37a8104a3ee9074af2703
SHA101a055fb5db08d03c18d1b1be4316f0f94ebafff
SHA2565c96268f9d885de90bdd63464cdd0a533e5b461db2482fc9d92ab154c7a23197
SHA5125042748da1416c7168693a401386a92e4fea880d4b898299cec5870557f1daafc7bfdf4822213e7e2a3260d996abccd460cb0eabf969e45a6157e7fdb0f8da84