Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
26-10-2023 02:29
Behavioral task
behavioral1
Sample
NEAS.9b5484509eba9951ca1814ef508ff380.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.9b5484509eba9951ca1814ef508ff380.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.9b5484509eba9951ca1814ef508ff380.exe
-
Size
100KB
-
MD5
9b5484509eba9951ca1814ef508ff380
-
SHA1
6ce50ea29c17a2d3f75a5e0c6f2dc8ada124b4b3
-
SHA256
c6b206b72d3d925c0f3d71335f95b462cebba31993c0ab7bc04c185886ed73a4
-
SHA512
a3fbcf68d975b162a326e275d59e69270abad7848c6f1bb4d06e850e902982723919bfb7b1a47d11ee0765206b3f0fa7fd42ebbb6ff95000011d61b40369bc21
-
SSDEEP
1536:Loaj1hJL1S9t0MIeboal8bCKxo7h0RPaaml0Nz30rtrsx7:c0hpgz6xGhZamyF30Box7
Malware Config
Signatures
-
Sakula payload 9 IoCs
Processes:
resource yara_rule behavioral1/memory/1880-0-0x0000000000400000-0x000000000041B000-memory.dmp family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula \Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula behavioral1/memory/2872-10-0x0000000000400000-0x000000000041B000-memory.dmp family_sakula \Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula behavioral1/memory/1880-11-0x0000000000400000-0x000000000041B000-memory.dmp family_sakula behavioral1/memory/2872-14-0x0000000000400000-0x000000000041B000-memory.dmp family_sakula behavioral1/memory/1880-15-0x0000000000400000-0x000000000041B000-memory.dmp family_sakula -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2800 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 2872 MediaCenter.exe -
Loads dropped DLL 2 IoCs
Processes:
NEAS.9b5484509eba9951ca1814ef508ff380.exepid process 1880 NEAS.9b5484509eba9951ca1814ef508ff380.exe 1880 NEAS.9b5484509eba9951ca1814ef508ff380.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
NEAS.9b5484509eba9951ca1814ef508ff380.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" NEAS.9b5484509eba9951ca1814ef508ff380.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
NEAS.9b5484509eba9951ca1814ef508ff380.exedescription pid process Token: SeIncBasePriorityPrivilege 1880 NEAS.9b5484509eba9951ca1814ef508ff380.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
NEAS.9b5484509eba9951ca1814ef508ff380.execmd.exedescription pid process target process PID 1880 wrote to memory of 2872 1880 NEAS.9b5484509eba9951ca1814ef508ff380.exe MediaCenter.exe PID 1880 wrote to memory of 2872 1880 NEAS.9b5484509eba9951ca1814ef508ff380.exe MediaCenter.exe PID 1880 wrote to memory of 2872 1880 NEAS.9b5484509eba9951ca1814ef508ff380.exe MediaCenter.exe PID 1880 wrote to memory of 2872 1880 NEAS.9b5484509eba9951ca1814ef508ff380.exe MediaCenter.exe PID 1880 wrote to memory of 2800 1880 NEAS.9b5484509eba9951ca1814ef508ff380.exe cmd.exe PID 1880 wrote to memory of 2800 1880 NEAS.9b5484509eba9951ca1814ef508ff380.exe cmd.exe PID 1880 wrote to memory of 2800 1880 NEAS.9b5484509eba9951ca1814ef508ff380.exe cmd.exe PID 1880 wrote to memory of 2800 1880 NEAS.9b5484509eba9951ca1814ef508ff380.exe cmd.exe PID 2800 wrote to memory of 3004 2800 cmd.exe PING.EXE PID 2800 wrote to memory of 3004 2800 cmd.exe PING.EXE PID 2800 wrote to memory of 3004 2800 cmd.exe PING.EXE PID 2800 wrote to memory of 3004 2800 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.9b5484509eba9951ca1814ef508ff380.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.9b5484509eba9951ca1814ef508ff380.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:2872 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\NEAS.9b5484509eba9951ca1814ef508ff380.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:3004
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
100KB
MD57924402c04a873d2069ec803bf62a3c7
SHA17173559150e780210db4945dede1be3ae7079377
SHA25637f0bbec83f647d90d6ea6c2aae7a6fad81a6c770fde3ea8d742be30aee15bfc
SHA512b11081fe27710f63be001470deffef7303502c39ea31eef7d77fcd08bda72865165f6fe3d979ff875b850dad11b2030125f85bba79dcdc4f8894792a91cf6cfe
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
100KB
MD57924402c04a873d2069ec803bf62a3c7
SHA17173559150e780210db4945dede1be3ae7079377
SHA25637f0bbec83f647d90d6ea6c2aae7a6fad81a6c770fde3ea8d742be30aee15bfc
SHA512b11081fe27710f63be001470deffef7303502c39ea31eef7d77fcd08bda72865165f6fe3d979ff875b850dad11b2030125f85bba79dcdc4f8894792a91cf6cfe
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
100KB
MD57924402c04a873d2069ec803bf62a3c7
SHA17173559150e780210db4945dede1be3ae7079377
SHA25637f0bbec83f647d90d6ea6c2aae7a6fad81a6c770fde3ea8d742be30aee15bfc
SHA512b11081fe27710f63be001470deffef7303502c39ea31eef7d77fcd08bda72865165f6fe3d979ff875b850dad11b2030125f85bba79dcdc4f8894792a91cf6cfe
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
100KB
MD57924402c04a873d2069ec803bf62a3c7
SHA17173559150e780210db4945dede1be3ae7079377
SHA25637f0bbec83f647d90d6ea6c2aae7a6fad81a6c770fde3ea8d742be30aee15bfc
SHA512b11081fe27710f63be001470deffef7303502c39ea31eef7d77fcd08bda72865165f6fe3d979ff875b850dad11b2030125f85bba79dcdc4f8894792a91cf6cfe
-
memory/1880-0-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1880-8-0x00000000003B0000-0x00000000003CB000-memory.dmpFilesize
108KB
-
memory/1880-11-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1880-12-0x00000000003B0000-0x00000000003CB000-memory.dmpFilesize
108KB
-
memory/1880-13-0x00000000003B0000-0x00000000003CB000-memory.dmpFilesize
108KB
-
memory/1880-15-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2872-10-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2872-14-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB