Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20231025-en -
resource tags
arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system -
submitted
28-10-2023 03:55
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.e56fb73cfe202939d059074992d5d9f0_JC.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
NEAS.e56fb73cfe202939d059074992d5d9f0_JC.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.e56fb73cfe202939d059074992d5d9f0_JC.exe
-
Size
67KB
-
MD5
e56fb73cfe202939d059074992d5d9f0
-
SHA1
4780d88b03b29f128ae9ffbe6e3edb0e6e6ca7e1
-
SHA256
539e1f1ea8ceffde1a68570570da0e83c46aebaa82496d907eb21445f1cf9a49
-
SHA512
d598b2a46d78361472a49c81a81a3615531c8af7ff85e36b4bf99f94a61f71e01dcfcdd179dd3bf9c317dba65a89a7167e2a8eaab812562d749efd22a4d90d4c
-
SSDEEP
768:u7Xezc/T6Zp14hyYtoVxYF9mHF1yD3BmNV8PsED3VK2+ZtyOjgO4r9vFAg2rqf:a6zqhyYtkYWI3BDYTjipvF2i
Malware Config
Extracted
sakula
http://www.we11point.com:443/view.asp?cookie=%s&type=%d&vid=%d
http://www.we11point.com:443/photo/%s.jpg?vid=%d
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2504 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 1268 MediaCenter.exe -
Loads dropped DLL 2 IoCs
Processes:
NEAS.e56fb73cfe202939d059074992d5d9f0_JC.exepid process 2936 NEAS.e56fb73cfe202939d059074992d5d9f0_JC.exe 2936 NEAS.e56fb73cfe202939d059074992d5d9f0_JC.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
NEAS.e56fb73cfe202939d059074992d5d9f0_JC.execmd.execmd.exedescription pid process target process PID 2936 wrote to memory of 2224 2936 NEAS.e56fb73cfe202939d059074992d5d9f0_JC.exe cmd.exe PID 2936 wrote to memory of 2224 2936 NEAS.e56fb73cfe202939d059074992d5d9f0_JC.exe cmd.exe PID 2936 wrote to memory of 2224 2936 NEAS.e56fb73cfe202939d059074992d5d9f0_JC.exe cmd.exe PID 2936 wrote to memory of 2224 2936 NEAS.e56fb73cfe202939d059074992d5d9f0_JC.exe cmd.exe PID 2936 wrote to memory of 1268 2936 NEAS.e56fb73cfe202939d059074992d5d9f0_JC.exe MediaCenter.exe PID 2936 wrote to memory of 1268 2936 NEAS.e56fb73cfe202939d059074992d5d9f0_JC.exe MediaCenter.exe PID 2936 wrote to memory of 1268 2936 NEAS.e56fb73cfe202939d059074992d5d9f0_JC.exe MediaCenter.exe PID 2936 wrote to memory of 1268 2936 NEAS.e56fb73cfe202939d059074992d5d9f0_JC.exe MediaCenter.exe PID 2224 wrote to memory of 2160 2224 cmd.exe reg.exe PID 2224 wrote to memory of 2160 2224 cmd.exe reg.exe PID 2224 wrote to memory of 2160 2224 cmd.exe reg.exe PID 2224 wrote to memory of 2160 2224 cmd.exe reg.exe PID 2936 wrote to memory of 2504 2936 NEAS.e56fb73cfe202939d059074992d5d9f0_JC.exe cmd.exe PID 2936 wrote to memory of 2504 2936 NEAS.e56fb73cfe202939d059074992d5d9f0_JC.exe cmd.exe PID 2936 wrote to memory of 2504 2936 NEAS.e56fb73cfe202939d059074992d5d9f0_JC.exe cmd.exe PID 2936 wrote to memory of 2504 2936 NEAS.e56fb73cfe202939d059074992d5d9f0_JC.exe cmd.exe PID 2504 wrote to memory of 2656 2504 cmd.exe PING.EXE PID 2504 wrote to memory of 2656 2504 cmd.exe PING.EXE PID 2504 wrote to memory of 2656 2504 cmd.exe PING.EXE PID 2504 wrote to memory of 2656 2504 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.e56fb73cfe202939d059074992d5d9f0_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.e56fb73cfe202939d059074992d5d9f0_JC.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:1268 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\NEAS.e56fb73cfe202939d059074992d5d9f0_JC.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:2656
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
67KB
MD5308049bb907962ecdc4a46abaf0f2b80
SHA10ccf68e370ad862929d2943dad5aa02f0446fbb0
SHA256554e686e7588f652eaf159a5b1fb47037f22a4da98cd8664b4458c3371c4d05c
SHA512bc044e709c5d60373bfa2bf95088876d9fc4a28642d8a8322bc67baefbe35c57ce741c7e60882b3fa0e875d1dfbe0d8434181bc2ee131e8ba13b8aaea1b9ae6d
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
67KB
MD5308049bb907962ecdc4a46abaf0f2b80
SHA10ccf68e370ad862929d2943dad5aa02f0446fbb0
SHA256554e686e7588f652eaf159a5b1fb47037f22a4da98cd8664b4458c3371c4d05c
SHA512bc044e709c5d60373bfa2bf95088876d9fc4a28642d8a8322bc67baefbe35c57ce741c7e60882b3fa0e875d1dfbe0d8434181bc2ee131e8ba13b8aaea1b9ae6d
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
67KB
MD5308049bb907962ecdc4a46abaf0f2b80
SHA10ccf68e370ad862929d2943dad5aa02f0446fbb0
SHA256554e686e7588f652eaf159a5b1fb47037f22a4da98cd8664b4458c3371c4d05c
SHA512bc044e709c5d60373bfa2bf95088876d9fc4a28642d8a8322bc67baefbe35c57ce741c7e60882b3fa0e875d1dfbe0d8434181bc2ee131e8ba13b8aaea1b9ae6d
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
67KB
MD5308049bb907962ecdc4a46abaf0f2b80
SHA10ccf68e370ad862929d2943dad5aa02f0446fbb0
SHA256554e686e7588f652eaf159a5b1fb47037f22a4da98cd8664b4458c3371c4d05c
SHA512bc044e709c5d60373bfa2bf95088876d9fc4a28642d8a8322bc67baefbe35c57ce741c7e60882b3fa0e875d1dfbe0d8434181bc2ee131e8ba13b8aaea1b9ae6d
-
memory/1268-11-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2936-0-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2936-1-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2936-9-0x0000000000220000-0x000000000022A000-memory.dmpFilesize
40KB
-
memory/2936-12-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2936-13-0x0000000000220000-0x000000000022A000-memory.dmpFilesize
40KB