Analysis
-
max time kernel
138s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
24-10-2023 20:47
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.d1ae88b6359c014db3936ee49b49ae10.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.d1ae88b6359c014db3936ee49b49ae10.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.d1ae88b6359c014db3936ee49b49ae10.exe
-
Size
76KB
-
MD5
d1ae88b6359c014db3936ee49b49ae10
-
SHA1
fe4b9dfed33cbf0ef5faedcf4bac33f8910d28be
-
SHA256
63021500b354f3f4e5a97eefcc5c97958377945ca6cb90c9b9242b1e3eecfd03
-
SHA512
2546cbe0da5451df23a30b085d81af08e09ceadb0660e67d89d7855c47fd3615c8835c40e1cb0363edc00dd7a7765e2bcb86612043df6b5f8ea20e08b4100924
-
SSDEEP
768:FhSksandb4GgyMsp4hyYtoVxYGm1ZAIPsED3VK2+ZtyOjgO4r9vFAg2rqK:FTsGpehyYtkYvnbYTjipvF2L
Malware Config
Extracted
sakula
http://vpn.premrera.com:443/viewpre.asp?cstring=%s&tom=%d&id=%d
http://vpn.premrera.com:443/photo/%s.jpg?id=%d
http://173.254.226.212:443/viewpre.asp?cstring=%s&tom=%d&id=%d
http://173.254.226.212:443/photo/%s.jpg?id=%d
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2344 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 2712 MediaCenter.exe -
Loads dropped DLL 2 IoCs
Processes:
cmd.exepid process 2920 cmd.exe 2920 cmd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
NEAS.d1ae88b6359c014db3936ee49b49ae10.execmd.execmd.execmd.exedescription pid process target process PID 1732 wrote to memory of 1944 1732 NEAS.d1ae88b6359c014db3936ee49b49ae10.exe cmd.exe PID 1732 wrote to memory of 1944 1732 NEAS.d1ae88b6359c014db3936ee49b49ae10.exe cmd.exe PID 1732 wrote to memory of 1944 1732 NEAS.d1ae88b6359c014db3936ee49b49ae10.exe cmd.exe PID 1732 wrote to memory of 1944 1732 NEAS.d1ae88b6359c014db3936ee49b49ae10.exe cmd.exe PID 1732 wrote to memory of 2920 1732 NEAS.d1ae88b6359c014db3936ee49b49ae10.exe cmd.exe PID 1732 wrote to memory of 2920 1732 NEAS.d1ae88b6359c014db3936ee49b49ae10.exe cmd.exe PID 1732 wrote to memory of 2920 1732 NEAS.d1ae88b6359c014db3936ee49b49ae10.exe cmd.exe PID 1732 wrote to memory of 2920 1732 NEAS.d1ae88b6359c014db3936ee49b49ae10.exe cmd.exe PID 1732 wrote to memory of 2344 1732 NEAS.d1ae88b6359c014db3936ee49b49ae10.exe cmd.exe PID 1732 wrote to memory of 2344 1732 NEAS.d1ae88b6359c014db3936ee49b49ae10.exe cmd.exe PID 1732 wrote to memory of 2344 1732 NEAS.d1ae88b6359c014db3936ee49b49ae10.exe cmd.exe PID 1732 wrote to memory of 2344 1732 NEAS.d1ae88b6359c014db3936ee49b49ae10.exe cmd.exe PID 1944 wrote to memory of 2412 1944 cmd.exe reg.exe PID 1944 wrote to memory of 2412 1944 cmd.exe reg.exe PID 1944 wrote to memory of 2412 1944 cmd.exe reg.exe PID 1944 wrote to memory of 2412 1944 cmd.exe reg.exe PID 2920 wrote to memory of 2712 2920 cmd.exe MediaCenter.exe PID 2920 wrote to memory of 2712 2920 cmd.exe MediaCenter.exe PID 2920 wrote to memory of 2712 2920 cmd.exe MediaCenter.exe PID 2920 wrote to memory of 2712 2920 cmd.exe MediaCenter.exe PID 2344 wrote to memory of 2676 2344 cmd.exe PING.EXE PID 2344 wrote to memory of 2676 2344 cmd.exe PING.EXE PID 2344 wrote to memory of 2676 2344 cmd.exe PING.EXE PID 2344 wrote to memory of 2676 2344 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.d1ae88b6359c014db3936ee49b49ae10.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.d1ae88b6359c014db3936ee49b49ae10.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
PID:2412 -
C:\Windows\SysWOW64\cmd.execmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe3⤵
- Executes dropped EXE
PID:2712 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\NEAS.d1ae88b6359c014db3936ee49b49ae10.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:2676
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
76KB
MD5d69d40a5ffdfb9b60dc1c15f9844e081
SHA1c0febc09d2b42a1c2d4d2e3f6cd861e452ca2eb6
SHA256e1d54459e593bea1d4a3ec9b9fd25ada31abc8130782c8dadd1d382b3c1c25ba
SHA512937286c259f72e04c6cae899416a41627053c3a9834b7072b54eac6d4503359d5f593bd073e55b05e287228b6fbd2dae153deac633eeafcc9f9806231b5b1796
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
76KB
MD5d69d40a5ffdfb9b60dc1c15f9844e081
SHA1c0febc09d2b42a1c2d4d2e3f6cd861e452ca2eb6
SHA256e1d54459e593bea1d4a3ec9b9fd25ada31abc8130782c8dadd1d382b3c1c25ba
SHA512937286c259f72e04c6cae899416a41627053c3a9834b7072b54eac6d4503359d5f593bd073e55b05e287228b6fbd2dae153deac633eeafcc9f9806231b5b1796
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
76KB
MD5d69d40a5ffdfb9b60dc1c15f9844e081
SHA1c0febc09d2b42a1c2d4d2e3f6cd861e452ca2eb6
SHA256e1d54459e593bea1d4a3ec9b9fd25ada31abc8130782c8dadd1d382b3c1c25ba
SHA512937286c259f72e04c6cae899416a41627053c3a9834b7072b54eac6d4503359d5f593bd073e55b05e287228b6fbd2dae153deac633eeafcc9f9806231b5b1796
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
76KB
MD5d69d40a5ffdfb9b60dc1c15f9844e081
SHA1c0febc09d2b42a1c2d4d2e3f6cd861e452ca2eb6
SHA256e1d54459e593bea1d4a3ec9b9fd25ada31abc8130782c8dadd1d382b3c1c25ba
SHA512937286c259f72e04c6cae899416a41627053c3a9834b7072b54eac6d4503359d5f593bd073e55b05e287228b6fbd2dae153deac633eeafcc9f9806231b5b1796
-
memory/1732-0-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1732-1-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1732-3-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2712-9-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2920-7-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2920-10-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB