Analysis
-
max time kernel
140s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
21-10-2023 21:16
Behavioral task
behavioral1
Sample
NEAS.2f45c823eca44d5757b56ac23eda0f50.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.2f45c823eca44d5757b56ac23eda0f50.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.2f45c823eca44d5757b56ac23eda0f50.exe
-
Size
79KB
-
MD5
2f45c823eca44d5757b56ac23eda0f50
-
SHA1
69f8a634d00dab70cd802ef96d43c4d591793511
-
SHA256
cc00781153863a1b930cec0b6e13f590f0315be0553b736f334ffa12975b583b
-
SHA512
259e1bac878c21cc35d5375737fa26b4a87d35572dfaa4b175e2be2cd7d724921e843a84d16ef36daf308aeaf09808f1067ad39eb53ab42c200aa8494a236e26
-
SSDEEP
1536:MSoaj1hJL1S9t0MIeboal8bCKxo7h0RP0jwHVz30rtrop:M90hpgz6xGhTjwHN30BEp
Malware Config
Signatures
-
Sakula payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
NEAS.2f45c823eca44d5757b56ac23eda0f50.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation NEAS.2f45c823eca44d5757b56ac23eda0f50.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 2520 MediaCenter.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
NEAS.2f45c823eca44d5757b56ac23eda0f50.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" NEAS.2f45c823eca44d5757b56ac23eda0f50.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
NEAS.2f45c823eca44d5757b56ac23eda0f50.exedescription pid process Token: SeIncBasePriorityPrivilege 2960 NEAS.2f45c823eca44d5757b56ac23eda0f50.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
NEAS.2f45c823eca44d5757b56ac23eda0f50.execmd.exedescription pid process target process PID 2960 wrote to memory of 2520 2960 NEAS.2f45c823eca44d5757b56ac23eda0f50.exe MediaCenter.exe PID 2960 wrote to memory of 2520 2960 NEAS.2f45c823eca44d5757b56ac23eda0f50.exe MediaCenter.exe PID 2960 wrote to memory of 2520 2960 NEAS.2f45c823eca44d5757b56ac23eda0f50.exe MediaCenter.exe PID 2960 wrote to memory of 2808 2960 NEAS.2f45c823eca44d5757b56ac23eda0f50.exe cmd.exe PID 2960 wrote to memory of 2808 2960 NEAS.2f45c823eca44d5757b56ac23eda0f50.exe cmd.exe PID 2960 wrote to memory of 2808 2960 NEAS.2f45c823eca44d5757b56ac23eda0f50.exe cmd.exe PID 2808 wrote to memory of 5092 2808 cmd.exe PING.EXE PID 2808 wrote to memory of 5092 2808 cmd.exe PING.EXE PID 2808 wrote to memory of 5092 2808 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.2f45c823eca44d5757b56ac23eda0f50.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.2f45c823eca44d5757b56ac23eda0f50.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:2520 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\NEAS.2f45c823eca44d5757b56ac23eda0f50.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:5092
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
79KB
MD5ab7fa007c7c37dd68fbf599c76141c91
SHA1685427ce5b02d61beaab608f6d644d2b2e8bcf1c
SHA2564983ca4650d1c310ae122d3c5300d3208f2a9532f2024738d1866ef06bb524ce
SHA5122e44f887deb2954582d178d6003e86a6a26af16c80a575007d64a1ba361381ef69567fe746d78bb882cd6bbf0d977a33484db8b45ef6bc6bdc0ae7835b741ee4
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
79KB
MD5ab7fa007c7c37dd68fbf599c76141c91
SHA1685427ce5b02d61beaab608f6d644d2b2e8bcf1c
SHA2564983ca4650d1c310ae122d3c5300d3208f2a9532f2024738d1866ef06bb524ce
SHA5122e44f887deb2954582d178d6003e86a6a26af16c80a575007d64a1ba361381ef69567fe746d78bb882cd6bbf0d977a33484db8b45ef6bc6bdc0ae7835b741ee4