Analysis
-
max time kernel
165s -
max time network
178s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
28-10-2023 20:14
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.d11dc55ce642ed9dfa207bcb69ec5a00.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.d11dc55ce642ed9dfa207bcb69ec5a00.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.d11dc55ce642ed9dfa207bcb69ec5a00.exe
-
Size
72KB
-
MD5
d11dc55ce642ed9dfa207bcb69ec5a00
-
SHA1
69fa8f78617d511fa5fed3fbb762b5c703f7425a
-
SHA256
5526f6872f6fe578b031535911d0d08c6580ccd1cfb412c2888f09b01a8adc04
-
SHA512
2d9fd7a905a9da5f5a09860e6516c293d0c572e7a71f078065decfd874c235295e9038c7b1cda92b239ef66c4fe5d6a5ec6ec0bee105e84af739ce1261e7d57d
-
SSDEEP
768:q7Xezc/T6Zp14hyYtoVxYF9mHfCBJTAIO3OtYVW6Qptwyv:G6zqhyYtkYW/CPnO3ajwyv
Malware Config
Extracted
sakula
http://www.we11point.com:443/view.asp?cookie=%s&type=%d&vid=%d
http://www.we11point.com:443/photo/%s.jpg?vid=%d
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 828 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 2700 MediaCenter.exe -
Loads dropped DLL 2 IoCs
Processes:
NEAS.d11dc55ce642ed9dfa207bcb69ec5a00.exepid process 2664 NEAS.d11dc55ce642ed9dfa207bcb69ec5a00.exe 2664 NEAS.d11dc55ce642ed9dfa207bcb69ec5a00.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
NEAS.d11dc55ce642ed9dfa207bcb69ec5a00.execmd.execmd.exedescription pid process target process PID 2664 wrote to memory of 2680 2664 NEAS.d11dc55ce642ed9dfa207bcb69ec5a00.exe cmd.exe PID 2664 wrote to memory of 2680 2664 NEAS.d11dc55ce642ed9dfa207bcb69ec5a00.exe cmd.exe PID 2664 wrote to memory of 2680 2664 NEAS.d11dc55ce642ed9dfa207bcb69ec5a00.exe cmd.exe PID 2664 wrote to memory of 2680 2664 NEAS.d11dc55ce642ed9dfa207bcb69ec5a00.exe cmd.exe PID 2664 wrote to memory of 2700 2664 NEAS.d11dc55ce642ed9dfa207bcb69ec5a00.exe MediaCenter.exe PID 2664 wrote to memory of 2700 2664 NEAS.d11dc55ce642ed9dfa207bcb69ec5a00.exe MediaCenter.exe PID 2664 wrote to memory of 2700 2664 NEAS.d11dc55ce642ed9dfa207bcb69ec5a00.exe MediaCenter.exe PID 2664 wrote to memory of 2700 2664 NEAS.d11dc55ce642ed9dfa207bcb69ec5a00.exe MediaCenter.exe PID 2680 wrote to memory of 2728 2680 cmd.exe reg.exe PID 2680 wrote to memory of 2728 2680 cmd.exe reg.exe PID 2680 wrote to memory of 2728 2680 cmd.exe reg.exe PID 2680 wrote to memory of 2728 2680 cmd.exe reg.exe PID 2664 wrote to memory of 828 2664 NEAS.d11dc55ce642ed9dfa207bcb69ec5a00.exe cmd.exe PID 2664 wrote to memory of 828 2664 NEAS.d11dc55ce642ed9dfa207bcb69ec5a00.exe cmd.exe PID 2664 wrote to memory of 828 2664 NEAS.d11dc55ce642ed9dfa207bcb69ec5a00.exe cmd.exe PID 2664 wrote to memory of 828 2664 NEAS.d11dc55ce642ed9dfa207bcb69ec5a00.exe cmd.exe PID 828 wrote to memory of 516 828 cmd.exe PING.EXE PID 828 wrote to memory of 516 828 cmd.exe PING.EXE PID 828 wrote to memory of 516 828 cmd.exe PING.EXE PID 828 wrote to memory of 516 828 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.d11dc55ce642ed9dfa207bcb69ec5a00.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.d11dc55ce642ed9dfa207bcb69ec5a00.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:2700 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\NEAS.d11dc55ce642ed9dfa207bcb69ec5a00.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:516
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
72KB
MD5fd596d6a44544574caa63f50cb31dae6
SHA1075baf8351d3e187d40d98d8b8a683cabcefd931
SHA25632c3983ea8191b3014b9d9b24b9d1454e74b81e3fc79a7b985bf91a2df3f6ebc
SHA51295c0fb9c138042b27e1fb984d22615afd60ee340faec5f0543143ced56c860854df60bdda0c8a1a74a64a9c42ef8301cc89a16c8b85b7ed29590246365d2c02a
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
72KB
MD5fd596d6a44544574caa63f50cb31dae6
SHA1075baf8351d3e187d40d98d8b8a683cabcefd931
SHA25632c3983ea8191b3014b9d9b24b9d1454e74b81e3fc79a7b985bf91a2df3f6ebc
SHA51295c0fb9c138042b27e1fb984d22615afd60ee340faec5f0543143ced56c860854df60bdda0c8a1a74a64a9c42ef8301cc89a16c8b85b7ed29590246365d2c02a
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
72KB
MD5fd596d6a44544574caa63f50cb31dae6
SHA1075baf8351d3e187d40d98d8b8a683cabcefd931
SHA25632c3983ea8191b3014b9d9b24b9d1454e74b81e3fc79a7b985bf91a2df3f6ebc
SHA51295c0fb9c138042b27e1fb984d22615afd60ee340faec5f0543143ced56c860854df60bdda0c8a1a74a64a9c42ef8301cc89a16c8b85b7ed29590246365d2c02a
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
72KB
MD5fd596d6a44544574caa63f50cb31dae6
SHA1075baf8351d3e187d40d98d8b8a683cabcefd931
SHA25632c3983ea8191b3014b9d9b24b9d1454e74b81e3fc79a7b985bf91a2df3f6ebc
SHA51295c0fb9c138042b27e1fb984d22615afd60ee340faec5f0543143ced56c860854df60bdda0c8a1a74a64a9c42ef8301cc89a16c8b85b7ed29590246365d2c02a
-
memory/2664-0-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2664-1-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2664-9-0x0000000000220000-0x000000000022A000-memory.dmpFilesize
40KB
-
memory/2664-12-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2700-11-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2700-13-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB