Analysis
-
max time kernel
138s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
28-10-2023 17:53
Behavioral task
behavioral1
Sample
NEAS.d48e4414944271b84832328e97f68929.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.d48e4414944271b84832328e97f68929.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.d48e4414944271b84832328e97f68929.exe
-
Size
92KB
-
MD5
d48e4414944271b84832328e97f68929
-
SHA1
e16e458d8119b5976ce6a5db1633bb6414f718a1
-
SHA256
22efc0cd8cb03e570b474c550bf02e942be83beea9b8ae7cb7cce50e7c1ce00e
-
SHA512
b195b290ea332b74f0208ca235a10b266af180ac595e64a5364a7fa2bfe955e25e51181eff68670591f7d988da133c5f318d6ff08a8ed8898d538a251888d1a1
-
SSDEEP
1536:TJbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtrd:9bfVk29te2jqxCEtg30Bx
Malware Config
Extracted
sakula
www.savmpet.com
Signatures
-
Sakula payload 6 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula \Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula \Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula \Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 800 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
AdobeUpdate.exepid process 2220 AdobeUpdate.exe -
Loads dropped DLL 4 IoCs
Processes:
NEAS.d48e4414944271b84832328e97f68929.exeAdobeUpdate.exepid process 2248 NEAS.d48e4414944271b84832328e97f68929.exe 2220 AdobeUpdate.exe 2220 AdobeUpdate.exe 2220 AdobeUpdate.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
NEAS.d48e4414944271b84832328e97f68929.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AdobeUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\AdobeUpdate.exe" NEAS.d48e4414944271b84832328e97f68929.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
NEAS.d48e4414944271b84832328e97f68929.exedescription pid process Token: SeIncBasePriorityPrivilege 2248 NEAS.d48e4414944271b84832328e97f68929.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
NEAS.d48e4414944271b84832328e97f68929.execmd.exedescription pid process target process PID 2248 wrote to memory of 2220 2248 NEAS.d48e4414944271b84832328e97f68929.exe AdobeUpdate.exe PID 2248 wrote to memory of 2220 2248 NEAS.d48e4414944271b84832328e97f68929.exe AdobeUpdate.exe PID 2248 wrote to memory of 2220 2248 NEAS.d48e4414944271b84832328e97f68929.exe AdobeUpdate.exe PID 2248 wrote to memory of 2220 2248 NEAS.d48e4414944271b84832328e97f68929.exe AdobeUpdate.exe PID 2248 wrote to memory of 2220 2248 NEAS.d48e4414944271b84832328e97f68929.exe AdobeUpdate.exe PID 2248 wrote to memory of 2220 2248 NEAS.d48e4414944271b84832328e97f68929.exe AdobeUpdate.exe PID 2248 wrote to memory of 2220 2248 NEAS.d48e4414944271b84832328e97f68929.exe AdobeUpdate.exe PID 2248 wrote to memory of 800 2248 NEAS.d48e4414944271b84832328e97f68929.exe cmd.exe PID 2248 wrote to memory of 800 2248 NEAS.d48e4414944271b84832328e97f68929.exe cmd.exe PID 2248 wrote to memory of 800 2248 NEAS.d48e4414944271b84832328e97f68929.exe cmd.exe PID 2248 wrote to memory of 800 2248 NEAS.d48e4414944271b84832328e97f68929.exe cmd.exe PID 800 wrote to memory of 2164 800 cmd.exe PING.EXE PID 800 wrote to memory of 2164 800 cmd.exe PING.EXE PID 800 wrote to memory of 2164 800 cmd.exe PING.EXE PID 800 wrote to memory of 2164 800 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.d48e4414944271b84832328e97f68929.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.d48e4414944271b84832328e97f68929.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2220 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\NEAS.d48e4414944271b84832328e97f68929.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:2164
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeFilesize
92KB
MD505f109ed07ba43283cf1d31c40c3859b
SHA1e1e2564fe27be7f0cfc470bbc5523059593582d4
SHA25689d0151e6a4ab6c4cf0cee2d80a91c7875decdb80dc2161f056d02a8c0b039c2
SHA512ee43dd6fba49194b1f7154bedde3a3a2aac3c2b574ddcd0eba34c935959eeb1976fef8a75e59bfe3ad9e29d9198b5fa8d16e235808b97c06b9a6178e4b99d3f4
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeFilesize
92KB
MD505f109ed07ba43283cf1d31c40c3859b
SHA1e1e2564fe27be7f0cfc470bbc5523059593582d4
SHA25689d0151e6a4ab6c4cf0cee2d80a91c7875decdb80dc2161f056d02a8c0b039c2
SHA512ee43dd6fba49194b1f7154bedde3a3a2aac3c2b574ddcd0eba34c935959eeb1976fef8a75e59bfe3ad9e29d9198b5fa8d16e235808b97c06b9a6178e4b99d3f4
-
\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeFilesize
92KB
MD505f109ed07ba43283cf1d31c40c3859b
SHA1e1e2564fe27be7f0cfc470bbc5523059593582d4
SHA25689d0151e6a4ab6c4cf0cee2d80a91c7875decdb80dc2161f056d02a8c0b039c2
SHA512ee43dd6fba49194b1f7154bedde3a3a2aac3c2b574ddcd0eba34c935959eeb1976fef8a75e59bfe3ad9e29d9198b5fa8d16e235808b97c06b9a6178e4b99d3f4
-
\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeFilesize
92KB
MD505f109ed07ba43283cf1d31c40c3859b
SHA1e1e2564fe27be7f0cfc470bbc5523059593582d4
SHA25689d0151e6a4ab6c4cf0cee2d80a91c7875decdb80dc2161f056d02a8c0b039c2
SHA512ee43dd6fba49194b1f7154bedde3a3a2aac3c2b574ddcd0eba34c935959eeb1976fef8a75e59bfe3ad9e29d9198b5fa8d16e235808b97c06b9a6178e4b99d3f4
-
\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeFilesize
92KB
MD505f109ed07ba43283cf1d31c40c3859b
SHA1e1e2564fe27be7f0cfc470bbc5523059593582d4
SHA25689d0151e6a4ab6c4cf0cee2d80a91c7875decdb80dc2161f056d02a8c0b039c2
SHA512ee43dd6fba49194b1f7154bedde3a3a2aac3c2b574ddcd0eba34c935959eeb1976fef8a75e59bfe3ad9e29d9198b5fa8d16e235808b97c06b9a6178e4b99d3f4
-
\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeFilesize
92KB
MD505f109ed07ba43283cf1d31c40c3859b
SHA1e1e2564fe27be7f0cfc470bbc5523059593582d4
SHA25689d0151e6a4ab6c4cf0cee2d80a91c7875decdb80dc2161f056d02a8c0b039c2
SHA512ee43dd6fba49194b1f7154bedde3a3a2aac3c2b574ddcd0eba34c935959eeb1976fef8a75e59bfe3ad9e29d9198b5fa8d16e235808b97c06b9a6178e4b99d3f4