Analysis
-
max time kernel
143s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
22-10-2023 17:20
Behavioral task
behavioral1
Sample
NEAS.638e57b3d6a82c5b15ca02f4a8848060.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.638e57b3d6a82c5b15ca02f4a8848060.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.638e57b3d6a82c5b15ca02f4a8848060.exe
-
Size
99KB
-
MD5
638e57b3d6a82c5b15ca02f4a8848060
-
SHA1
26a875a620df731ae18e0e18c4353ec1a325bf71
-
SHA256
a8d225c95d3e0d293d460d9a5ce36496806410fe3365da16b9c801fa320bcc0b
-
SHA512
5bc833191a4f104fd569730185811c0f8dfce39f555f43836c50852fc7af2cc97fec20915b09b292cf10eafd9bc90873e435d36bf1035ddd9aac0363d6b5c3d0
-
SSDEEP
1536:Loaj1hJL1S9t0MIeboal8bCKxo7h0RPaaml0Nz30rtrtxA:c0hpgz6xGhZamyF30BZxA
Malware Config
Signatures
-
Sakula payload 7 IoCs
Processes:
resource yara_rule behavioral2/memory/4808-0-0x0000000000400000-0x000000000041B000-memory.dmp family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula behavioral2/memory/3876-4-0x0000000000400000-0x000000000041B000-memory.dmp family_sakula behavioral2/memory/4808-6-0x0000000000400000-0x000000000041B000-memory.dmp family_sakula behavioral2/memory/3876-7-0x0000000000400000-0x000000000041B000-memory.dmp family_sakula behavioral2/memory/4808-8-0x0000000000400000-0x000000000041B000-memory.dmp family_sakula -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
NEAS.638e57b3d6a82c5b15ca02f4a8848060.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation NEAS.638e57b3d6a82c5b15ca02f4a8848060.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 3876 MediaCenter.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
NEAS.638e57b3d6a82c5b15ca02f4a8848060.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" NEAS.638e57b3d6a82c5b15ca02f4a8848060.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
NEAS.638e57b3d6a82c5b15ca02f4a8848060.exedescription pid process Token: SeIncBasePriorityPrivilege 4808 NEAS.638e57b3d6a82c5b15ca02f4a8848060.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
NEAS.638e57b3d6a82c5b15ca02f4a8848060.execmd.exedescription pid process target process PID 4808 wrote to memory of 3876 4808 NEAS.638e57b3d6a82c5b15ca02f4a8848060.exe MediaCenter.exe PID 4808 wrote to memory of 3876 4808 NEAS.638e57b3d6a82c5b15ca02f4a8848060.exe MediaCenter.exe PID 4808 wrote to memory of 3876 4808 NEAS.638e57b3d6a82c5b15ca02f4a8848060.exe MediaCenter.exe PID 4808 wrote to memory of 4856 4808 NEAS.638e57b3d6a82c5b15ca02f4a8848060.exe cmd.exe PID 4808 wrote to memory of 4856 4808 NEAS.638e57b3d6a82c5b15ca02f4a8848060.exe cmd.exe PID 4808 wrote to memory of 4856 4808 NEAS.638e57b3d6a82c5b15ca02f4a8848060.exe cmd.exe PID 4856 wrote to memory of 392 4856 cmd.exe PING.EXE PID 4856 wrote to memory of 392 4856 cmd.exe PING.EXE PID 4856 wrote to memory of 392 4856 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.638e57b3d6a82c5b15ca02f4a8848060.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.638e57b3d6a82c5b15ca02f4a8848060.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:3876 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\NEAS.638e57b3d6a82c5b15ca02f4a8848060.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:392
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
99KB
MD509dfdc848bcbbba411e39e911796519c
SHA14c870dd0acde48df726354eddae45bce24b420d0
SHA25642b990e73e2a20b5de65f55543e7042769769095e725c8c0503f726986c871f6
SHA51217fcefb939e64b644d29843b742fbf61ad060394f6b9697bad26d75a95cc7afbc3fe3c2554dc5fc12b5abd2db838367aa675f25b10aa18d79c0643c832c855a2
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
99KB
MD509dfdc848bcbbba411e39e911796519c
SHA14c870dd0acde48df726354eddae45bce24b420d0
SHA25642b990e73e2a20b5de65f55543e7042769769095e725c8c0503f726986c871f6
SHA51217fcefb939e64b644d29843b742fbf61ad060394f6b9697bad26d75a95cc7afbc3fe3c2554dc5fc12b5abd2db838367aa675f25b10aa18d79c0643c832c855a2
-
memory/3876-4-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/3876-7-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/4808-0-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/4808-6-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/4808-8-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB