Analysis
-
max time kernel
140s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
28-10-2023 04:31
Behavioral task
behavioral1
Sample
NEAS.346e98405290305ebf3f95411b795380_JC.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.346e98405290305ebf3f95411b795380_JC.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.346e98405290305ebf3f95411b795380_JC.exe
-
Size
99KB
-
MD5
346e98405290305ebf3f95411b795380
-
SHA1
6a5d16e22d35a2b74deac2c5b482980984f41031
-
SHA256
67c9ac0c939e0183fad7dec8e8ad2058139c8ee41ad684888234e4437b65c27d
-
SHA512
b62446c6e89da0f300c461c9aabdfe1a5052f5a01c1b3fba760384a1525d495a1788336ef95ecfabe60c94e90f872fae55bb0c4c4661d60b1e962446c5189c24
-
SSDEEP
1536:Loaj1hJL1S9t0MIeboal8bCKxo7h0RPaaml0Nz30rtrdxW:c0hpgz6xGhZamyF30BBxW
Malware Config
Signatures
-
Sakula payload 9 IoCs
Processes:
resource yara_rule behavioral1/memory/2576-0-0x0000000000400000-0x000000000041B000-memory.dmp family_sakula \Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula behavioral1/memory/2796-10-0x0000000000400000-0x000000000041B000-memory.dmp family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula \Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula behavioral1/memory/2576-11-0x0000000000400000-0x000000000041B000-memory.dmp family_sakula behavioral1/memory/2796-14-0x0000000000400000-0x000000000041B000-memory.dmp family_sakula behavioral1/memory/2576-15-0x0000000000400000-0x000000000041B000-memory.dmp family_sakula -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2656 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 2796 MediaCenter.exe -
Loads dropped DLL 2 IoCs
Processes:
NEAS.346e98405290305ebf3f95411b795380_JC.exepid process 2576 NEAS.346e98405290305ebf3f95411b795380_JC.exe 2576 NEAS.346e98405290305ebf3f95411b795380_JC.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
NEAS.346e98405290305ebf3f95411b795380_JC.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" NEAS.346e98405290305ebf3f95411b795380_JC.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
NEAS.346e98405290305ebf3f95411b795380_JC.exedescription pid process Token: SeIncBasePriorityPrivilege 2576 NEAS.346e98405290305ebf3f95411b795380_JC.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
NEAS.346e98405290305ebf3f95411b795380_JC.execmd.exedescription pid process target process PID 2576 wrote to memory of 2796 2576 NEAS.346e98405290305ebf3f95411b795380_JC.exe MediaCenter.exe PID 2576 wrote to memory of 2796 2576 NEAS.346e98405290305ebf3f95411b795380_JC.exe MediaCenter.exe PID 2576 wrote to memory of 2796 2576 NEAS.346e98405290305ebf3f95411b795380_JC.exe MediaCenter.exe PID 2576 wrote to memory of 2796 2576 NEAS.346e98405290305ebf3f95411b795380_JC.exe MediaCenter.exe PID 2576 wrote to memory of 2656 2576 NEAS.346e98405290305ebf3f95411b795380_JC.exe cmd.exe PID 2576 wrote to memory of 2656 2576 NEAS.346e98405290305ebf3f95411b795380_JC.exe cmd.exe PID 2576 wrote to memory of 2656 2576 NEAS.346e98405290305ebf3f95411b795380_JC.exe cmd.exe PID 2576 wrote to memory of 2656 2576 NEAS.346e98405290305ebf3f95411b795380_JC.exe cmd.exe PID 2656 wrote to memory of 2660 2656 cmd.exe PING.EXE PID 2656 wrote to memory of 2660 2656 cmd.exe PING.EXE PID 2656 wrote to memory of 2660 2656 cmd.exe PING.EXE PID 2656 wrote to memory of 2660 2656 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.346e98405290305ebf3f95411b795380_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.346e98405290305ebf3f95411b795380_JC.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:2796 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\NEAS.346e98405290305ebf3f95411b795380_JC.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:2660
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
99KB
MD53ff20341fb57dfd56a982e64f38a6752
SHA19b50b95a146102a7739761617e9f2d43165659b6
SHA256d86ce38a8e97ad5a4d819427efe21012c368cb55af2b30f5d2cf5d13d1047d9d
SHA512ded79a47194b9c98a2da939d0ef30801423eb9adcae1687cc0b2cecc36a85848407322b9004e02443aa0d11bf37429e159297188780a3474eacb7543d15a5d5a
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
99KB
MD53ff20341fb57dfd56a982e64f38a6752
SHA19b50b95a146102a7739761617e9f2d43165659b6
SHA256d86ce38a8e97ad5a4d819427efe21012c368cb55af2b30f5d2cf5d13d1047d9d
SHA512ded79a47194b9c98a2da939d0ef30801423eb9adcae1687cc0b2cecc36a85848407322b9004e02443aa0d11bf37429e159297188780a3474eacb7543d15a5d5a
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
99KB
MD53ff20341fb57dfd56a982e64f38a6752
SHA19b50b95a146102a7739761617e9f2d43165659b6
SHA256d86ce38a8e97ad5a4d819427efe21012c368cb55af2b30f5d2cf5d13d1047d9d
SHA512ded79a47194b9c98a2da939d0ef30801423eb9adcae1687cc0b2cecc36a85848407322b9004e02443aa0d11bf37429e159297188780a3474eacb7543d15a5d5a
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
99KB
MD53ff20341fb57dfd56a982e64f38a6752
SHA19b50b95a146102a7739761617e9f2d43165659b6
SHA256d86ce38a8e97ad5a4d819427efe21012c368cb55af2b30f5d2cf5d13d1047d9d
SHA512ded79a47194b9c98a2da939d0ef30801423eb9adcae1687cc0b2cecc36a85848407322b9004e02443aa0d11bf37429e159297188780a3474eacb7543d15a5d5a
-
memory/2576-0-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2576-8-0x0000000000250000-0x000000000026B000-memory.dmpFilesize
108KB
-
memory/2576-11-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2576-12-0x0000000000250000-0x000000000026B000-memory.dmpFilesize
108KB
-
memory/2576-13-0x0000000000250000-0x000000000026B000-memory.dmpFilesize
108KB
-
memory/2576-15-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2796-10-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2796-14-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB