Analysis
-
max time kernel
148s -
max time network
159s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
27-10-2023 01:35
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.b7f5edce3547da45966a78dea9d6ba90_JC.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.b7f5edce3547da45966a78dea9d6ba90_JC.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.b7f5edce3547da45966a78dea9d6ba90_JC.exe
-
Size
38KB
-
MD5
b7f5edce3547da45966a78dea9d6ba90
-
SHA1
85ad447a9456a5ec344ea6b6557722904d5497f0
-
SHA256
919b7ab3ae3534b5f996d231b269f9d1e72830a17d96cd350ce320c3ad5cd6aa
-
SHA512
a9d6db8cef21464008d078d5e042899a26046fb3ff88d253be341d02100bcebf55e5b18f6858ee9d75a9620a2a76817c5105c92eb991f2a6036d927b8ed2f74f
-
SSDEEP
768:u7Xezc/T6Zp14hyYtoVxYF9mHF1yD3BmNV5:a6zqhyYtkYWI3Bm
Malware Config
Extracted
sakula
http://www.we11point.com:443/view.asp?cookie=%s&type=%d&vid=%d
http://www.we11point.com:443/photo/%s.jpg?vid=%d
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2596 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 2552 MediaCenter.exe -
Loads dropped DLL 2 IoCs
Processes:
NEAS.b7f5edce3547da45966a78dea9d6ba90_JC.exepid process 2076 NEAS.b7f5edce3547da45966a78dea9d6ba90_JC.exe 2076 NEAS.b7f5edce3547da45966a78dea9d6ba90_JC.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
NEAS.b7f5edce3547da45966a78dea9d6ba90_JC.execmd.execmd.exedescription pid process target process PID 2076 wrote to memory of 2680 2076 NEAS.b7f5edce3547da45966a78dea9d6ba90_JC.exe cmd.exe PID 2076 wrote to memory of 2680 2076 NEAS.b7f5edce3547da45966a78dea9d6ba90_JC.exe cmd.exe PID 2076 wrote to memory of 2680 2076 NEAS.b7f5edce3547da45966a78dea9d6ba90_JC.exe cmd.exe PID 2076 wrote to memory of 2680 2076 NEAS.b7f5edce3547da45966a78dea9d6ba90_JC.exe cmd.exe PID 2076 wrote to memory of 2552 2076 NEAS.b7f5edce3547da45966a78dea9d6ba90_JC.exe MediaCenter.exe PID 2076 wrote to memory of 2552 2076 NEAS.b7f5edce3547da45966a78dea9d6ba90_JC.exe MediaCenter.exe PID 2076 wrote to memory of 2552 2076 NEAS.b7f5edce3547da45966a78dea9d6ba90_JC.exe MediaCenter.exe PID 2076 wrote to memory of 2552 2076 NEAS.b7f5edce3547da45966a78dea9d6ba90_JC.exe MediaCenter.exe PID 2680 wrote to memory of 2872 2680 cmd.exe reg.exe PID 2680 wrote to memory of 2872 2680 cmd.exe reg.exe PID 2680 wrote to memory of 2872 2680 cmd.exe reg.exe PID 2680 wrote to memory of 2872 2680 cmd.exe reg.exe PID 2076 wrote to memory of 2596 2076 NEAS.b7f5edce3547da45966a78dea9d6ba90_JC.exe cmd.exe PID 2076 wrote to memory of 2596 2076 NEAS.b7f5edce3547da45966a78dea9d6ba90_JC.exe cmd.exe PID 2076 wrote to memory of 2596 2076 NEAS.b7f5edce3547da45966a78dea9d6ba90_JC.exe cmd.exe PID 2076 wrote to memory of 2596 2076 NEAS.b7f5edce3547da45966a78dea9d6ba90_JC.exe cmd.exe PID 2596 wrote to memory of 2636 2596 cmd.exe PING.EXE PID 2596 wrote to memory of 2636 2596 cmd.exe PING.EXE PID 2596 wrote to memory of 2636 2596 cmd.exe PING.EXE PID 2596 wrote to memory of 2636 2596 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.b7f5edce3547da45966a78dea9d6ba90_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.b7f5edce3547da45966a78dea9d6ba90_JC.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:2552 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\NEAS.b7f5edce3547da45966a78dea9d6ba90_JC.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:2636
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
38KB
MD5052fde65ef722e35bec2fd544af69f44
SHA1432de3f3613d250e5868f00275ae27041c82082e
SHA256c9edf6a89aacb3df4811852a70adab3c800f8081198ec39c7f6b77e4fde5a346
SHA512b2fb7f54499fd66a6f0710c4d12d672014aa4493adecffe23924c538e146981396ae7e0572509c6799d21a07b6491dea6e0f2c160a6aa900eb4be0404a571e14
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
38KB
MD5052fde65ef722e35bec2fd544af69f44
SHA1432de3f3613d250e5868f00275ae27041c82082e
SHA256c9edf6a89aacb3df4811852a70adab3c800f8081198ec39c7f6b77e4fde5a346
SHA512b2fb7f54499fd66a6f0710c4d12d672014aa4493adecffe23924c538e146981396ae7e0572509c6799d21a07b6491dea6e0f2c160a6aa900eb4be0404a571e14
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
38KB
MD5052fde65ef722e35bec2fd544af69f44
SHA1432de3f3613d250e5868f00275ae27041c82082e
SHA256c9edf6a89aacb3df4811852a70adab3c800f8081198ec39c7f6b77e4fde5a346
SHA512b2fb7f54499fd66a6f0710c4d12d672014aa4493adecffe23924c538e146981396ae7e0572509c6799d21a07b6491dea6e0f2c160a6aa900eb4be0404a571e14
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
38KB
MD5052fde65ef722e35bec2fd544af69f44
SHA1432de3f3613d250e5868f00275ae27041c82082e
SHA256c9edf6a89aacb3df4811852a70adab3c800f8081198ec39c7f6b77e4fde5a346
SHA512b2fb7f54499fd66a6f0710c4d12d672014aa4493adecffe23924c538e146981396ae7e0572509c6799d21a07b6491dea6e0f2c160a6aa900eb4be0404a571e14
-
memory/2076-0-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2076-1-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2076-9-0x0000000000220000-0x000000000022A000-memory.dmpFilesize
40KB
-
memory/2076-12-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2076-13-0x0000000000220000-0x000000000022A000-memory.dmpFilesize
40KB
-
memory/2552-11-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB