Analysis
-
max time kernel
135s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
28-10-2023 11:42
Behavioral task
behavioral1
Sample
NEAS.3b1540ceaaa6d031ddec8b4137f2caf0.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.3b1540ceaaa6d031ddec8b4137f2caf0.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.3b1540ceaaa6d031ddec8b4137f2caf0.exe
-
Size
300KB
-
MD5
3b1540ceaaa6d031ddec8b4137f2caf0
-
SHA1
582c3bf2b95795ab9d7f9895b99391a965798382
-
SHA256
6be9d41efeac1beec127985643e3f6433345a7b01a0bfe4393f2a31359b6e5b9
-
SHA512
72efd6e8c25e8f5b138364874de31e7029e293d44025535dfefe681f691c3b56608ad383e4fb0b8c85f1cc63072095ce05b8c0886e5e4ddcfef1fb7f9bb4e4a7
-
SSDEEP
6144:M29qRfVSndj30B3wBxE1+ijiBKk3etdgI2MyzNORQtOfl1qNVo7R+S+N/h:0RfQn+w8EYiBld
Malware Config
Extracted
sakula
www.polarroute.com
Signatures
-
Sakula payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/4936-0-0x0000000000400000-0x0000000000420000-memory.dmp family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula behavioral2/memory/4936-5-0x0000000000400000-0x0000000000420000-memory.dmp family_sakula behavioral2/memory/1776-6-0x0000000000400000-0x0000000000420000-memory.dmp family_sakula -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
NEAS.3b1540ceaaa6d031ddec8b4137f2caf0.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation NEAS.3b1540ceaaa6d031ddec8b4137f2caf0.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 1776 MediaCenter.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
NEAS.3b1540ceaaa6d031ddec8b4137f2caf0.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" NEAS.3b1540ceaaa6d031ddec8b4137f2caf0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
NEAS.3b1540ceaaa6d031ddec8b4137f2caf0.exedescription pid process Token: SeIncBasePriorityPrivilege 4936 NEAS.3b1540ceaaa6d031ddec8b4137f2caf0.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
NEAS.3b1540ceaaa6d031ddec8b4137f2caf0.execmd.exedescription pid process target process PID 4936 wrote to memory of 1776 4936 NEAS.3b1540ceaaa6d031ddec8b4137f2caf0.exe MediaCenter.exe PID 4936 wrote to memory of 1776 4936 NEAS.3b1540ceaaa6d031ddec8b4137f2caf0.exe MediaCenter.exe PID 4936 wrote to memory of 1776 4936 NEAS.3b1540ceaaa6d031ddec8b4137f2caf0.exe MediaCenter.exe PID 4936 wrote to memory of 4408 4936 NEAS.3b1540ceaaa6d031ddec8b4137f2caf0.exe cmd.exe PID 4936 wrote to memory of 4408 4936 NEAS.3b1540ceaaa6d031ddec8b4137f2caf0.exe cmd.exe PID 4936 wrote to memory of 4408 4936 NEAS.3b1540ceaaa6d031ddec8b4137f2caf0.exe cmd.exe PID 4408 wrote to memory of 1740 4408 cmd.exe PING.EXE PID 4408 wrote to memory of 1740 4408 cmd.exe PING.EXE PID 4408 wrote to memory of 1740 4408 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.3b1540ceaaa6d031ddec8b4137f2caf0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.3b1540ceaaa6d031ddec8b4137f2caf0.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:1776 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\NEAS.3b1540ceaaa6d031ddec8b4137f2caf0.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:1740
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
300KB
MD5430153547698f2f4e014fafe491c0587
SHA12dec5256eecce4483587792edf7f992b00bfa540
SHA256b056c3510bb2730cfae79e23c9bf5296452a6164c003a8973e374e88ec0eea12
SHA512255e6e8334b86218514f9238953d09fc881f3e672d505308050d9502b5b4fab1a4a012c563c9a2aa506dbe74d28fa037bc8bfca99fa949cb61b9999e35626bcf
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
300KB
MD5430153547698f2f4e014fafe491c0587
SHA12dec5256eecce4483587792edf7f992b00bfa540
SHA256b056c3510bb2730cfae79e23c9bf5296452a6164c003a8973e374e88ec0eea12
SHA512255e6e8334b86218514f9238953d09fc881f3e672d505308050d9502b5b4fab1a4a012c563c9a2aa506dbe74d28fa037bc8bfca99fa949cb61b9999e35626bcf
-
memory/1776-6-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/4936-0-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/4936-5-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB