Analysis
-
max time kernel
145s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
22-10-2023 17:21
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.74eae433c4c76159c103d97ea1d68d90.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.74eae433c4c76159c103d97ea1d68d90.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.74eae433c4c76159c103d97ea1d68d90.exe
-
Size
36KB
-
MD5
74eae433c4c76159c103d97ea1d68d90
-
SHA1
0664fd661264b603977fd8d17052daf597afc765
-
SHA256
25ca717d28c3290c4223378c3c4d50be2da1381ba74bebc7e488065135e93c89
-
SHA512
354403bc7b8735ebeea53228a0ca2349bb8d6ed9e5b44b122e465e07f9b6c5dad0259005c32441ec8790858bce48deaa1703e2c57a7b1b8865c266eefe0a66fe
-
SSDEEP
768:TwbYGCv4nuEcJpQK4TQbtKvXwXgA9lJJea+yGCJQqeWnAEv2647D0:TwbYP4nuEApQK4TQbtY2gA9DX+ytBOq
Malware Config
Signatures
-
Sakula payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/1080-5-0x0000000000400000-0x000000000041A000-memory.dmp family_sakula behavioral2/memory/1988-7-0x0000000000400000-0x000000000041A000-memory.dmp family_sakula behavioral2/memory/1080-12-0x0000000000400000-0x000000000041A000-memory.dmp family_sakula behavioral2/memory/1988-17-0x0000000000400000-0x000000000041A000-memory.dmp family_sakula -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
NEAS.74eae433c4c76159c103d97ea1d68d90.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3777073499-70821052-905318652-1000\Control Panel\International\Geo\Nation NEAS.74eae433c4c76159c103d97ea1d68d90.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 1988 MediaCenter.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
NEAS.74eae433c4c76159c103d97ea1d68d90.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" NEAS.74eae433c4c76159c103d97ea1d68d90.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
NEAS.74eae433c4c76159c103d97ea1d68d90.exedescription pid process Token: SeIncBasePriorityPrivilege 1080 NEAS.74eae433c4c76159c103d97ea1d68d90.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
NEAS.74eae433c4c76159c103d97ea1d68d90.execmd.exedescription pid process target process PID 1080 wrote to memory of 1988 1080 NEAS.74eae433c4c76159c103d97ea1d68d90.exe MediaCenter.exe PID 1080 wrote to memory of 1988 1080 NEAS.74eae433c4c76159c103d97ea1d68d90.exe MediaCenter.exe PID 1080 wrote to memory of 1988 1080 NEAS.74eae433c4c76159c103d97ea1d68d90.exe MediaCenter.exe PID 1080 wrote to memory of 2524 1080 NEAS.74eae433c4c76159c103d97ea1d68d90.exe cmd.exe PID 1080 wrote to memory of 2524 1080 NEAS.74eae433c4c76159c103d97ea1d68d90.exe cmd.exe PID 1080 wrote to memory of 2524 1080 NEAS.74eae433c4c76159c103d97ea1d68d90.exe cmd.exe PID 2524 wrote to memory of 1852 2524 cmd.exe PING.EXE PID 2524 wrote to memory of 1852 2524 cmd.exe PING.EXE PID 2524 wrote to memory of 1852 2524 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.74eae433c4c76159c103d97ea1d68d90.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.74eae433c4c76159c103d97ea1d68d90.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:1988 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\NEAS.74eae433c4c76159c103d97ea1d68d90.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:1852
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
36KB
MD5e6e4b0ffe31271765fa8679ed4f8ce42
SHA1bf877a42dd348f22066fce20a460ce06ff54a5d8
SHA256f980e74fd4536551efc7c097c44992047219c972d396fee0958050a3f884f0de
SHA512417af16ee7e2292988cb1b9a1ee49e477aed7ba9f4237c539680828ecf5f8e4549d0d77b98b28ef3e29d990593001da92ccbca97972e7e4b2fcd642bf5da3c83
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
36KB
MD5e6e4b0ffe31271765fa8679ed4f8ce42
SHA1bf877a42dd348f22066fce20a460ce06ff54a5d8
SHA256f980e74fd4536551efc7c097c44992047219c972d396fee0958050a3f884f0de
SHA512417af16ee7e2292988cb1b9a1ee49e477aed7ba9f4237c539680828ecf5f8e4549d0d77b98b28ef3e29d990593001da92ccbca97972e7e4b2fcd642bf5da3c83
-
memory/1080-0-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1080-5-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1080-12-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1988-7-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1988-17-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB