Analysis
-
max time kernel
117s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
22-10-2023 17:20
Behavioral task
behavioral1
Sample
NEAS.638e57b3d6a82c5b15ca02f4a8848060.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.638e57b3d6a82c5b15ca02f4a8848060.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.638e57b3d6a82c5b15ca02f4a8848060.exe
-
Size
99KB
-
MD5
638e57b3d6a82c5b15ca02f4a8848060
-
SHA1
26a875a620df731ae18e0e18c4353ec1a325bf71
-
SHA256
a8d225c95d3e0d293d460d9a5ce36496806410fe3365da16b9c801fa320bcc0b
-
SHA512
5bc833191a4f104fd569730185811c0f8dfce39f555f43836c50852fc7af2cc97fec20915b09b292cf10eafd9bc90873e435d36bf1035ddd9aac0363d6b5c3d0
-
SSDEEP
1536:Loaj1hJL1S9t0MIeboal8bCKxo7h0RPaaml0Nz30rtrtxA:c0hpgz6xGhZamyF30BZxA
Malware Config
Signatures
-
Sakula payload 9 IoCs
Processes:
resource yara_rule behavioral1/memory/2108-0-0x0000000000400000-0x000000000041B000-memory.dmp family_sakula \Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula \Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula behavioral1/memory/2648-11-0x0000000000400000-0x000000000041B000-memory.dmp family_sakula behavioral1/memory/2108-12-0x0000000000400000-0x000000000041B000-memory.dmp family_sakula behavioral1/memory/2648-15-0x0000000000400000-0x000000000041B000-memory.dmp family_sakula behavioral1/memory/2108-16-0x0000000000400000-0x000000000041B000-memory.dmp family_sakula -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2888 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 2648 MediaCenter.exe -
Loads dropped DLL 2 IoCs
Processes:
NEAS.638e57b3d6a82c5b15ca02f4a8848060.exepid process 2108 NEAS.638e57b3d6a82c5b15ca02f4a8848060.exe 2108 NEAS.638e57b3d6a82c5b15ca02f4a8848060.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
NEAS.638e57b3d6a82c5b15ca02f4a8848060.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" NEAS.638e57b3d6a82c5b15ca02f4a8848060.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
NEAS.638e57b3d6a82c5b15ca02f4a8848060.exedescription pid process Token: SeIncBasePriorityPrivilege 2108 NEAS.638e57b3d6a82c5b15ca02f4a8848060.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
NEAS.638e57b3d6a82c5b15ca02f4a8848060.execmd.exedescription pid process target process PID 2108 wrote to memory of 2648 2108 NEAS.638e57b3d6a82c5b15ca02f4a8848060.exe MediaCenter.exe PID 2108 wrote to memory of 2648 2108 NEAS.638e57b3d6a82c5b15ca02f4a8848060.exe MediaCenter.exe PID 2108 wrote to memory of 2648 2108 NEAS.638e57b3d6a82c5b15ca02f4a8848060.exe MediaCenter.exe PID 2108 wrote to memory of 2648 2108 NEAS.638e57b3d6a82c5b15ca02f4a8848060.exe MediaCenter.exe PID 2108 wrote to memory of 2888 2108 NEAS.638e57b3d6a82c5b15ca02f4a8848060.exe cmd.exe PID 2108 wrote to memory of 2888 2108 NEAS.638e57b3d6a82c5b15ca02f4a8848060.exe cmd.exe PID 2108 wrote to memory of 2888 2108 NEAS.638e57b3d6a82c5b15ca02f4a8848060.exe cmd.exe PID 2108 wrote to memory of 2888 2108 NEAS.638e57b3d6a82c5b15ca02f4a8848060.exe cmd.exe PID 2888 wrote to memory of 2736 2888 cmd.exe PING.EXE PID 2888 wrote to memory of 2736 2888 cmd.exe PING.EXE PID 2888 wrote to memory of 2736 2888 cmd.exe PING.EXE PID 2888 wrote to memory of 2736 2888 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.638e57b3d6a82c5b15ca02f4a8848060.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.638e57b3d6a82c5b15ca02f4a8848060.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:2648 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\NEAS.638e57b3d6a82c5b15ca02f4a8848060.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:2736
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
99KB
MD5d17c3cae69aee1c3d617c051c836f44d
SHA1ed4aa462ac71f355e909cf8d064407515d48e046
SHA256c11b2eac0248fc97970277f3447fd1d138f6f3e4566820d385fd29012cb65cec
SHA512dfa40af4e25353b4ae38be24f4ac0f8b28e3b2f9e768a2204dfd210d25953a3af5e25cc71fa90089b03da005d729a067640b342dcc3e1e2800396ecf5d9dcb5f
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
99KB
MD5d17c3cae69aee1c3d617c051c836f44d
SHA1ed4aa462ac71f355e909cf8d064407515d48e046
SHA256c11b2eac0248fc97970277f3447fd1d138f6f3e4566820d385fd29012cb65cec
SHA512dfa40af4e25353b4ae38be24f4ac0f8b28e3b2f9e768a2204dfd210d25953a3af5e25cc71fa90089b03da005d729a067640b342dcc3e1e2800396ecf5d9dcb5f
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
99KB
MD5d17c3cae69aee1c3d617c051c836f44d
SHA1ed4aa462ac71f355e909cf8d064407515d48e046
SHA256c11b2eac0248fc97970277f3447fd1d138f6f3e4566820d385fd29012cb65cec
SHA512dfa40af4e25353b4ae38be24f4ac0f8b28e3b2f9e768a2204dfd210d25953a3af5e25cc71fa90089b03da005d729a067640b342dcc3e1e2800396ecf5d9dcb5f
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
99KB
MD5d17c3cae69aee1c3d617c051c836f44d
SHA1ed4aa462ac71f355e909cf8d064407515d48e046
SHA256c11b2eac0248fc97970277f3447fd1d138f6f3e4566820d385fd29012cb65cec
SHA512dfa40af4e25353b4ae38be24f4ac0f8b28e3b2f9e768a2204dfd210d25953a3af5e25cc71fa90089b03da005d729a067640b342dcc3e1e2800396ecf5d9dcb5f
-
memory/2108-10-0x0000000000220000-0x000000000023B000-memory.dmpFilesize
108KB
-
memory/2108-8-0x0000000000220000-0x000000000023B000-memory.dmpFilesize
108KB
-
memory/2108-0-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2108-12-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2108-13-0x0000000000220000-0x000000000023B000-memory.dmpFilesize
108KB
-
memory/2108-14-0x0000000000220000-0x000000000023B000-memory.dmpFilesize
108KB
-
memory/2108-16-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2648-11-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2648-15-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB