Analysis
-
max time kernel
158s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
26-10-2023 19:43
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.582caefe13bda3894d0ebbf6fa396ca0_JC.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
NEAS.582caefe13bda3894d0ebbf6fa396ca0_JC.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.582caefe13bda3894d0ebbf6fa396ca0_JC.exe
-
Size
72KB
-
MD5
582caefe13bda3894d0ebbf6fa396ca0
-
SHA1
535061c4120076749220b134fe7834d5c1be5725
-
SHA256
5de08d92f9bec7c08bf0ea54746c1588c656b2d071fb9fd3a54c0527e2b130b8
-
SHA512
75e71e5adc468118eaf1cd5ec832bad0ffb824a534c0a0a862c71a15e49f3b4f5d9356bb698eb28c5f3c5b198149789ea77b40e6929e449ae4f3e2186fd1faa2
-
SSDEEP
768:q7Xezc/T6Zp14hyYtoVxYF9mHfCBJTAIO3OtYVW6QptwyR:G6zqhyYtkYW/CPnO3ajwyR
Malware Config
Extracted
sakula
http://www.we11point.com:443/view.asp?cookie=%s&type=%d&vid=%d
http://www.we11point.com:443/photo/%s.jpg?vid=%d
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 2568 MediaCenter.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
NEAS.582caefe13bda3894d0ebbf6fa396ca0_JC.execmd.execmd.exedescription pid process target process PID 2304 wrote to memory of 1364 2304 NEAS.582caefe13bda3894d0ebbf6fa396ca0_JC.exe cmd.exe PID 2304 wrote to memory of 1364 2304 NEAS.582caefe13bda3894d0ebbf6fa396ca0_JC.exe cmd.exe PID 2304 wrote to memory of 1364 2304 NEAS.582caefe13bda3894d0ebbf6fa396ca0_JC.exe cmd.exe PID 2304 wrote to memory of 2568 2304 NEAS.582caefe13bda3894d0ebbf6fa396ca0_JC.exe MediaCenter.exe PID 2304 wrote to memory of 2568 2304 NEAS.582caefe13bda3894d0ebbf6fa396ca0_JC.exe MediaCenter.exe PID 2304 wrote to memory of 2568 2304 NEAS.582caefe13bda3894d0ebbf6fa396ca0_JC.exe MediaCenter.exe PID 1364 wrote to memory of 5072 1364 cmd.exe reg.exe PID 1364 wrote to memory of 5072 1364 cmd.exe reg.exe PID 1364 wrote to memory of 5072 1364 cmd.exe reg.exe PID 2304 wrote to memory of 4460 2304 NEAS.582caefe13bda3894d0ebbf6fa396ca0_JC.exe cmd.exe PID 2304 wrote to memory of 4460 2304 NEAS.582caefe13bda3894d0ebbf6fa396ca0_JC.exe cmd.exe PID 2304 wrote to memory of 4460 2304 NEAS.582caefe13bda3894d0ebbf6fa396ca0_JC.exe cmd.exe PID 4460 wrote to memory of 3872 4460 cmd.exe PING.EXE PID 4460 wrote to memory of 3872 4460 cmd.exe PING.EXE PID 4460 wrote to memory of 3872 4460 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.582caefe13bda3894d0ebbf6fa396ca0_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.582caefe13bda3894d0ebbf6fa396ca0_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:2568 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\NEAS.582caefe13bda3894d0ebbf6fa396ca0_JC.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:3872
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
72KB
MD5fe66e0182a4b649cb8f65fe6d501f587
SHA1b0ffdb015d28af00a15af8467ecd34f4fba7ae3b
SHA2564420160f174e76e64a30ea72e9fe2345e067d99db4da4cffe445d117299392a5
SHA512b357b6b8dcb688ca30457ddd7f79f202cdaf2eb9874d08c0eb7c6ef1f7925e51326783bd73544624e14bbe1b157204fb85f073966832e8dbce9becf4b9da5422
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
72KB
MD5fe66e0182a4b649cb8f65fe6d501f587
SHA1b0ffdb015d28af00a15af8467ecd34f4fba7ae3b
SHA2564420160f174e76e64a30ea72e9fe2345e067d99db4da4cffe445d117299392a5
SHA512b357b6b8dcb688ca30457ddd7f79f202cdaf2eb9874d08c0eb7c6ef1f7925e51326783bd73544624e14bbe1b157204fb85f073966832e8dbce9becf4b9da5422
-
memory/2304-0-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2304-1-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2304-6-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB