Analysis
-
max time kernel
146s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
28-10-2023 07:51
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.bf2d65783ee54ad44ccbd7de284a1390_JC.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.bf2d65783ee54ad44ccbd7de284a1390_JC.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.bf2d65783ee54ad44ccbd7de284a1390_JC.exe
-
Size
37KB
-
MD5
bf2d65783ee54ad44ccbd7de284a1390
-
SHA1
cfca380487e20f6d26ee515a38d61a28b273b0f5
-
SHA256
1472b8e7a429d56cdd15143628c14567c8b21cf2eefdb532bdafe58a31b7f62c
-
SHA512
1fe67ef09861536b1db508bf26d5ac14d605e506a3a75f86f934869f8ccfd1bd9c7d77a3360fd0f8a16c77994d68b6dd5fa9dead74400926cf7fd463f27b0583
-
SSDEEP
768:D7Xezc/T6Zp14hyYtoVxYF9mH8VQ1PcPW/M9zn:n6zqhyYtkYWRPTEzn
Malware Config
Extracted
sakula
http://www.we11point.com:443/view.asp?cookie=%s&type=%d&vid=%d
http://www.we11point.com:443/photo/%s.jpg?vid=%d
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2752 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 1088 MediaCenter.exe -
Loads dropped DLL 2 IoCs
Processes:
NEAS.bf2d65783ee54ad44ccbd7de284a1390_JC.exepid process 2144 NEAS.bf2d65783ee54ad44ccbd7de284a1390_JC.exe 2144 NEAS.bf2d65783ee54ad44ccbd7de284a1390_JC.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
NEAS.bf2d65783ee54ad44ccbd7de284a1390_JC.execmd.execmd.exedescription pid process target process PID 2144 wrote to memory of 1532 2144 NEAS.bf2d65783ee54ad44ccbd7de284a1390_JC.exe cmd.exe PID 2144 wrote to memory of 1532 2144 NEAS.bf2d65783ee54ad44ccbd7de284a1390_JC.exe cmd.exe PID 2144 wrote to memory of 1532 2144 NEAS.bf2d65783ee54ad44ccbd7de284a1390_JC.exe cmd.exe PID 2144 wrote to memory of 1532 2144 NEAS.bf2d65783ee54ad44ccbd7de284a1390_JC.exe cmd.exe PID 2144 wrote to memory of 1088 2144 NEAS.bf2d65783ee54ad44ccbd7de284a1390_JC.exe MediaCenter.exe PID 2144 wrote to memory of 1088 2144 NEAS.bf2d65783ee54ad44ccbd7de284a1390_JC.exe MediaCenter.exe PID 2144 wrote to memory of 1088 2144 NEAS.bf2d65783ee54ad44ccbd7de284a1390_JC.exe MediaCenter.exe PID 2144 wrote to memory of 1088 2144 NEAS.bf2d65783ee54ad44ccbd7de284a1390_JC.exe MediaCenter.exe PID 1532 wrote to memory of 1996 1532 cmd.exe reg.exe PID 1532 wrote to memory of 1996 1532 cmd.exe reg.exe PID 1532 wrote to memory of 1996 1532 cmd.exe reg.exe PID 1532 wrote to memory of 1996 1532 cmd.exe reg.exe PID 2144 wrote to memory of 2752 2144 NEAS.bf2d65783ee54ad44ccbd7de284a1390_JC.exe cmd.exe PID 2144 wrote to memory of 2752 2144 NEAS.bf2d65783ee54ad44ccbd7de284a1390_JC.exe cmd.exe PID 2144 wrote to memory of 2752 2144 NEAS.bf2d65783ee54ad44ccbd7de284a1390_JC.exe cmd.exe PID 2144 wrote to memory of 2752 2144 NEAS.bf2d65783ee54ad44ccbd7de284a1390_JC.exe cmd.exe PID 2752 wrote to memory of 2576 2752 cmd.exe PING.EXE PID 2752 wrote to memory of 2576 2752 cmd.exe PING.EXE PID 2752 wrote to memory of 2576 2752 cmd.exe PING.EXE PID 2752 wrote to memory of 2576 2752 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.bf2d65783ee54ad44ccbd7de284a1390_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.bf2d65783ee54ad44ccbd7de284a1390_JC.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:1088 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\NEAS.bf2d65783ee54ad44ccbd7de284a1390_JC.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:2576
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
37KB
MD5283cc4ea03722ebb1b062922062e3c05
SHA1b02a9db1504fe4675bff64e21d52235ebcfc2e1f
SHA256802c118b79b3f14c01d827f43884a71049dada3a65b255e0705a3f33cc06931c
SHA512310c0eb8184957741a4b201fd2a273cd3583feac6ed99cd583a03feaefd1942af8a0d7f4f69b952caf52f52befd919c282f9f7d67e4762411a30de99a166bb03
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
37KB
MD5283cc4ea03722ebb1b062922062e3c05
SHA1b02a9db1504fe4675bff64e21d52235ebcfc2e1f
SHA256802c118b79b3f14c01d827f43884a71049dada3a65b255e0705a3f33cc06931c
SHA512310c0eb8184957741a4b201fd2a273cd3583feac6ed99cd583a03feaefd1942af8a0d7f4f69b952caf52f52befd919c282f9f7d67e4762411a30de99a166bb03
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
37KB
MD5283cc4ea03722ebb1b062922062e3c05
SHA1b02a9db1504fe4675bff64e21d52235ebcfc2e1f
SHA256802c118b79b3f14c01d827f43884a71049dada3a65b255e0705a3f33cc06931c
SHA512310c0eb8184957741a4b201fd2a273cd3583feac6ed99cd583a03feaefd1942af8a0d7f4f69b952caf52f52befd919c282f9f7d67e4762411a30de99a166bb03
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
37KB
MD5283cc4ea03722ebb1b062922062e3c05
SHA1b02a9db1504fe4675bff64e21d52235ebcfc2e1f
SHA256802c118b79b3f14c01d827f43884a71049dada3a65b255e0705a3f33cc06931c
SHA512310c0eb8184957741a4b201fd2a273cd3583feac6ed99cd583a03feaefd1942af8a0d7f4f69b952caf52f52befd919c282f9f7d67e4762411a30de99a166bb03
-
memory/2144-0-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/2144-9-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB