Analysis
-
max time kernel
143s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
26-10-2023 02:29
Behavioral task
behavioral1
Sample
NEAS.9b5484509eba9951ca1814ef508ff380.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.9b5484509eba9951ca1814ef508ff380.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.9b5484509eba9951ca1814ef508ff380.exe
-
Size
100KB
-
MD5
9b5484509eba9951ca1814ef508ff380
-
SHA1
6ce50ea29c17a2d3f75a5e0c6f2dc8ada124b4b3
-
SHA256
c6b206b72d3d925c0f3d71335f95b462cebba31993c0ab7bc04c185886ed73a4
-
SHA512
a3fbcf68d975b162a326e275d59e69270abad7848c6f1bb4d06e850e902982723919bfb7b1a47d11ee0765206b3f0fa7fd42ebbb6ff95000011d61b40369bc21
-
SSDEEP
1536:Loaj1hJL1S9t0MIeboal8bCKxo7h0RPaaml0Nz30rtrsx7:c0hpgz6xGhZamyF30Box7
Malware Config
Signatures
-
Sakula payload 6 IoCs
Processes:
resource yara_rule behavioral2/memory/4328-0-0x0000000000400000-0x000000000041B000-memory.dmp family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula behavioral2/memory/4328-5-0x0000000000400000-0x000000000041B000-memory.dmp family_sakula behavioral2/memory/4052-6-0x0000000000400000-0x000000000041B000-memory.dmp family_sakula behavioral2/memory/4328-7-0x0000000000400000-0x000000000041B000-memory.dmp family_sakula -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
NEAS.9b5484509eba9951ca1814ef508ff380.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000\Control Panel\International\Geo\Nation NEAS.9b5484509eba9951ca1814ef508ff380.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 4052 MediaCenter.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
NEAS.9b5484509eba9951ca1814ef508ff380.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" NEAS.9b5484509eba9951ca1814ef508ff380.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
NEAS.9b5484509eba9951ca1814ef508ff380.exedescription pid process Token: SeIncBasePriorityPrivilege 4328 NEAS.9b5484509eba9951ca1814ef508ff380.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
NEAS.9b5484509eba9951ca1814ef508ff380.execmd.exedescription pid process target process PID 4328 wrote to memory of 4052 4328 NEAS.9b5484509eba9951ca1814ef508ff380.exe MediaCenter.exe PID 4328 wrote to memory of 4052 4328 NEAS.9b5484509eba9951ca1814ef508ff380.exe MediaCenter.exe PID 4328 wrote to memory of 4052 4328 NEAS.9b5484509eba9951ca1814ef508ff380.exe MediaCenter.exe PID 4328 wrote to memory of 556 4328 NEAS.9b5484509eba9951ca1814ef508ff380.exe cmd.exe PID 4328 wrote to memory of 556 4328 NEAS.9b5484509eba9951ca1814ef508ff380.exe cmd.exe PID 4328 wrote to memory of 556 4328 NEAS.9b5484509eba9951ca1814ef508ff380.exe cmd.exe PID 556 wrote to memory of 3976 556 cmd.exe PING.EXE PID 556 wrote to memory of 3976 556 cmd.exe PING.EXE PID 556 wrote to memory of 3976 556 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.9b5484509eba9951ca1814ef508ff380.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.9b5484509eba9951ca1814ef508ff380.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:4052 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\NEAS.9b5484509eba9951ca1814ef508ff380.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:3976
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
100KB
MD5cc3e7b5f93d50da439a89da96d1f2b8e
SHA18e55afe254af47b94c63a7e501468c703d64578d
SHA256d29b0573d3781741a11ce5617c6c726d9bed1382afc0b6cae32c86068a40bccf
SHA5122c8b38174d6499a0adaee0e21168f20f7b6fbcc34e814c96ccc1340c5c8faddcc89408dda55b9833799f61e3d544190d172d819aaf578a934c27042673fb535d
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
100KB
MD5cc3e7b5f93d50da439a89da96d1f2b8e
SHA18e55afe254af47b94c63a7e501468c703d64578d
SHA256d29b0573d3781741a11ce5617c6c726d9bed1382afc0b6cae32c86068a40bccf
SHA5122c8b38174d6499a0adaee0e21168f20f7b6fbcc34e814c96ccc1340c5c8faddcc89408dda55b9833799f61e3d544190d172d819aaf578a934c27042673fb535d
-
memory/4052-6-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/4328-0-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/4328-5-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/4328-7-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB