Analysis
-
max time kernel
141s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
27-10-2023 01:35
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.b7f5edce3547da45966a78dea9d6ba90_JC.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.b7f5edce3547da45966a78dea9d6ba90_JC.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.b7f5edce3547da45966a78dea9d6ba90_JC.exe
-
Size
38KB
-
MD5
b7f5edce3547da45966a78dea9d6ba90
-
SHA1
85ad447a9456a5ec344ea6b6557722904d5497f0
-
SHA256
919b7ab3ae3534b5f996d231b269f9d1e72830a17d96cd350ce320c3ad5cd6aa
-
SHA512
a9d6db8cef21464008d078d5e042899a26046fb3ff88d253be341d02100bcebf55e5b18f6858ee9d75a9620a2a76817c5105c92eb991f2a6036d927b8ed2f74f
-
SSDEEP
768:u7Xezc/T6Zp14hyYtoVxYF9mHF1yD3BmNV5:a6zqhyYtkYWI3Bm
Malware Config
Extracted
sakula
http://www.we11point.com:443/view.asp?cookie=%s&type=%d&vid=%d
http://www.we11point.com:443/photo/%s.jpg?vid=%d
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 4000 MediaCenter.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
NEAS.b7f5edce3547da45966a78dea9d6ba90_JC.execmd.execmd.exedescription pid process target process PID 224 wrote to memory of 4164 224 NEAS.b7f5edce3547da45966a78dea9d6ba90_JC.exe cmd.exe PID 224 wrote to memory of 4164 224 NEAS.b7f5edce3547da45966a78dea9d6ba90_JC.exe cmd.exe PID 224 wrote to memory of 4164 224 NEAS.b7f5edce3547da45966a78dea9d6ba90_JC.exe cmd.exe PID 224 wrote to memory of 4000 224 NEAS.b7f5edce3547da45966a78dea9d6ba90_JC.exe MediaCenter.exe PID 224 wrote to memory of 4000 224 NEAS.b7f5edce3547da45966a78dea9d6ba90_JC.exe MediaCenter.exe PID 224 wrote to memory of 4000 224 NEAS.b7f5edce3547da45966a78dea9d6ba90_JC.exe MediaCenter.exe PID 4164 wrote to memory of 2188 4164 cmd.exe reg.exe PID 4164 wrote to memory of 2188 4164 cmd.exe reg.exe PID 4164 wrote to memory of 2188 4164 cmd.exe reg.exe PID 224 wrote to memory of 3052 224 NEAS.b7f5edce3547da45966a78dea9d6ba90_JC.exe cmd.exe PID 224 wrote to memory of 3052 224 NEAS.b7f5edce3547da45966a78dea9d6ba90_JC.exe cmd.exe PID 224 wrote to memory of 3052 224 NEAS.b7f5edce3547da45966a78dea9d6ba90_JC.exe cmd.exe PID 3052 wrote to memory of 1780 3052 cmd.exe PING.EXE PID 3052 wrote to memory of 1780 3052 cmd.exe PING.EXE PID 3052 wrote to memory of 1780 3052 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.b7f5edce3547da45966a78dea9d6ba90_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.b7f5edce3547da45966a78dea9d6ba90_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:4000 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\NEAS.b7f5edce3547da45966a78dea9d6ba90_JC.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:1780
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
38KB
MD501a8cc7a5505cf93139b167ffa1b94ac
SHA168f1c2a2475c76d6ba9f9ad0240842102b3b865c
SHA25642b47508eba7ea09cc6a2967404bb7520626307d469e575d446f48581aa1023e
SHA512131f1481b53194c17a02c480434beb58bb74a3a88c569166753366926039964c7cd791138beda20906c8a9829b3451464ca1c79388ca93ab48380c3059127913
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
38KB
MD501a8cc7a5505cf93139b167ffa1b94ac
SHA168f1c2a2475c76d6ba9f9ad0240842102b3b865c
SHA25642b47508eba7ea09cc6a2967404bb7520626307d469e575d446f48581aa1023e
SHA512131f1481b53194c17a02c480434beb58bb74a3a88c569166753366926039964c7cd791138beda20906c8a9829b3451464ca1c79388ca93ab48380c3059127913
-
memory/224-0-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/224-1-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/224-2-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/224-7-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB