Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
25-10-2023 19:35
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.a6549d8fd84d82830947970626901a00_JC.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.a6549d8fd84d82830947970626901a00_JC.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.a6549d8fd84d82830947970626901a00_JC.exe
-
Size
72KB
-
MD5
a6549d8fd84d82830947970626901a00
-
SHA1
b3c175344c41ab9e55f65638df172416d027c20b
-
SHA256
89f63ace8b3fc8a20de4ee08ddf407d31ce045ed3d6d2f82101e567566c05935
-
SHA512
a1a919a286741a52fae8a211a8f3174b2373b9cddf493e419fb9f582eb23312ef9a06f805c09a1c5dbaba34bc23c12051ae84ea4980b593642f3907412c5edf0
-
SSDEEP
768:q7Xezc/T6Zp14hyYtoVxYF9mHfCBJTAIO3OtYVW6QptwyI:G6zqhyYtkYW/CPnO3ajwyI
Malware Config
Extracted
sakula
http://www.we11point.com:443/view.asp?cookie=%s&type=%d&vid=%d
http://www.we11point.com:443/photo/%s.jpg?vid=%d
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 1084 MediaCenter.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
NEAS.a6549d8fd84d82830947970626901a00_JC.execmd.execmd.exedescription pid process target process PID 848 wrote to memory of 1824 848 NEAS.a6549d8fd84d82830947970626901a00_JC.exe cmd.exe PID 848 wrote to memory of 1824 848 NEAS.a6549d8fd84d82830947970626901a00_JC.exe cmd.exe PID 848 wrote to memory of 1824 848 NEAS.a6549d8fd84d82830947970626901a00_JC.exe cmd.exe PID 848 wrote to memory of 1084 848 NEAS.a6549d8fd84d82830947970626901a00_JC.exe MediaCenter.exe PID 848 wrote to memory of 1084 848 NEAS.a6549d8fd84d82830947970626901a00_JC.exe MediaCenter.exe PID 848 wrote to memory of 1084 848 NEAS.a6549d8fd84d82830947970626901a00_JC.exe MediaCenter.exe PID 1824 wrote to memory of 1796 1824 cmd.exe reg.exe PID 1824 wrote to memory of 1796 1824 cmd.exe reg.exe PID 1824 wrote to memory of 1796 1824 cmd.exe reg.exe PID 848 wrote to memory of 4316 848 NEAS.a6549d8fd84d82830947970626901a00_JC.exe cmd.exe PID 848 wrote to memory of 4316 848 NEAS.a6549d8fd84d82830947970626901a00_JC.exe cmd.exe PID 848 wrote to memory of 4316 848 NEAS.a6549d8fd84d82830947970626901a00_JC.exe cmd.exe PID 4316 wrote to memory of 4000 4316 cmd.exe PING.EXE PID 4316 wrote to memory of 4000 4316 cmd.exe PING.EXE PID 4316 wrote to memory of 4000 4316 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.a6549d8fd84d82830947970626901a00_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.a6549d8fd84d82830947970626901a00_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:1084 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\NEAS.a6549d8fd84d82830947970626901a00_JC.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:4000
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
72KB
MD5963b5cbbd3e93f45989dc4a2246e27b5
SHA12a2227b211a4d12552eae68e6cf28e791c3ff40d
SHA256cf750d464a8f37580fd8991280cbbb2bf5f135a8d60052d9628b61cf78dadb56
SHA512ef61a26ee40459165c2ff418d52e5b071f8f635306a5f693ff6dbda849d081c7cf5492fbcfae60c32f78ec1b92b4839c6c29dea15afef146538a939a0fee4c04
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
72KB
MD5963b5cbbd3e93f45989dc4a2246e27b5
SHA12a2227b211a4d12552eae68e6cf28e791c3ff40d
SHA256cf750d464a8f37580fd8991280cbbb2bf5f135a8d60052d9628b61cf78dadb56
SHA512ef61a26ee40459165c2ff418d52e5b071f8f635306a5f693ff6dbda849d081c7cf5492fbcfae60c32f78ec1b92b4839c6c29dea15afef146538a939a0fee4c04
-
memory/848-0-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/848-1-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/848-2-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/848-7-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB