Analysis
-
max time kernel
143s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
28-10-2023 03:55
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.e56fb73cfe202939d059074992d5d9f0_JC.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
NEAS.e56fb73cfe202939d059074992d5d9f0_JC.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.e56fb73cfe202939d059074992d5d9f0_JC.exe
-
Size
67KB
-
MD5
e56fb73cfe202939d059074992d5d9f0
-
SHA1
4780d88b03b29f128ae9ffbe6e3edb0e6e6ca7e1
-
SHA256
539e1f1ea8ceffde1a68570570da0e83c46aebaa82496d907eb21445f1cf9a49
-
SHA512
d598b2a46d78361472a49c81a81a3615531c8af7ff85e36b4bf99f94a61f71e01dcfcdd179dd3bf9c317dba65a89a7167e2a8eaab812562d749efd22a4d90d4c
-
SSDEEP
768:u7Xezc/T6Zp14hyYtoVxYF9mHF1yD3BmNV8PsED3VK2+ZtyOjgO4r9vFAg2rqf:a6zqhyYtkYWI3BDYTjipvF2i
Malware Config
Extracted
sakula
http://www.we11point.com:443/view.asp?cookie=%s&type=%d&vid=%d
http://www.we11point.com:443/photo/%s.jpg?vid=%d
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 4780 MediaCenter.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
NEAS.e56fb73cfe202939d059074992d5d9f0_JC.execmd.execmd.exedescription pid process target process PID 636 wrote to memory of 4712 636 NEAS.e56fb73cfe202939d059074992d5d9f0_JC.exe cmd.exe PID 636 wrote to memory of 4712 636 NEAS.e56fb73cfe202939d059074992d5d9f0_JC.exe cmd.exe PID 636 wrote to memory of 4712 636 NEAS.e56fb73cfe202939d059074992d5d9f0_JC.exe cmd.exe PID 636 wrote to memory of 4780 636 NEAS.e56fb73cfe202939d059074992d5d9f0_JC.exe MediaCenter.exe PID 636 wrote to memory of 4780 636 NEAS.e56fb73cfe202939d059074992d5d9f0_JC.exe MediaCenter.exe PID 636 wrote to memory of 4780 636 NEAS.e56fb73cfe202939d059074992d5d9f0_JC.exe MediaCenter.exe PID 4712 wrote to memory of 2116 4712 cmd.exe reg.exe PID 4712 wrote to memory of 2116 4712 cmd.exe reg.exe PID 4712 wrote to memory of 2116 4712 cmd.exe reg.exe PID 636 wrote to memory of 4956 636 NEAS.e56fb73cfe202939d059074992d5d9f0_JC.exe cmd.exe PID 636 wrote to memory of 4956 636 NEAS.e56fb73cfe202939d059074992d5d9f0_JC.exe cmd.exe PID 636 wrote to memory of 4956 636 NEAS.e56fb73cfe202939d059074992d5d9f0_JC.exe cmd.exe PID 4956 wrote to memory of 3152 4956 cmd.exe PING.EXE PID 4956 wrote to memory of 3152 4956 cmd.exe PING.EXE PID 4956 wrote to memory of 3152 4956 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.e56fb73cfe202939d059074992d5d9f0_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.e56fb73cfe202939d059074992d5d9f0_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:4780 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\NEAS.e56fb73cfe202939d059074992d5d9f0_JC.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:3152
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
67KB
MD57f5a5ddbadcdc9c6d0ff0019c09d6b1f
SHA1199554ad6e68106ee55697a2becf7a1f07c9c205
SHA256bc7c8fa30932a4ab6fa1f2e74e19bd331e51ad9e9fbc75f9da25817b436c7898
SHA512cd78fe2719070d9364c21b063a4f9dc821939bf6792362915489216948683ab56ad118754f8f5dba080b8834384d3471daea19064faddc3bea00f5476c5026db
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
67KB
MD57f5a5ddbadcdc9c6d0ff0019c09d6b1f
SHA1199554ad6e68106ee55697a2becf7a1f07c9c205
SHA256bc7c8fa30932a4ab6fa1f2e74e19bd331e51ad9e9fbc75f9da25817b436c7898
SHA512cd78fe2719070d9364c21b063a4f9dc821939bf6792362915489216948683ab56ad118754f8f5dba080b8834384d3471daea19064faddc3bea00f5476c5026db
-
memory/636-0-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/636-1-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/636-6-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/4780-7-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB