Analysis
-
max time kernel
137s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
28-10-2023 19:55
Behavioral task
behavioral1
Sample
NEAS.6aa3dde4b1e581297a432fa5ff138bc0.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.6aa3dde4b1e581297a432fa5ff138bc0.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.6aa3dde4b1e581297a432fa5ff138bc0.exe
-
Size
212KB
-
MD5
6aa3dde4b1e581297a432fa5ff138bc0
-
SHA1
3b4c7f4a44ac6768cdb91956caeffcd090be90a7
-
SHA256
a66d0fb7716e4c346c9f9692edc86b47ceb2ebd1f38e49ba75f7c2dfe2545631
-
SHA512
235ea34cca9d85403605b39bd148666efc5d868972082a095c5124311fb69c0e52f59a57093c6f64cf28ca34dcc2850b089746af2bc7aa9f4740199cd663fe2b
-
SSDEEP
1536:4tQFl29mEkE0L1rDEKrxZKF2zf9g2Pl7W/MwbxMX++pdz30rtr8gjXjp0danB3:r29DkEGRQixVSjLc130BYgjXjp3nB3
Malware Config
Extracted
sakula
www.polarroute.com
Signatures
-
Sakula payload 7 IoCs
Processes:
resource yara_rule behavioral2/memory/4456-0-0x0000000000400000-0x0000000000435000-memory.dmp family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula behavioral2/memory/1900-4-0x0000000000400000-0x0000000000435000-memory.dmp family_sakula behavioral2/memory/4456-6-0x0000000000400000-0x0000000000435000-memory.dmp family_sakula behavioral2/memory/1900-7-0x0000000000400000-0x0000000000435000-memory.dmp family_sakula behavioral2/memory/4456-8-0x0000000000400000-0x0000000000435000-memory.dmp family_sakula -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
NEAS.6aa3dde4b1e581297a432fa5ff138bc0.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation NEAS.6aa3dde4b1e581297a432fa5ff138bc0.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 1900 MediaCenter.exe -
Processes:
resource yara_rule behavioral2/memory/4456-0-0x0000000000400000-0x0000000000435000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe upx C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe upx behavioral2/memory/1900-4-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/4456-6-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/1900-7-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/4456-8-0x0000000000400000-0x0000000000435000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
NEAS.6aa3dde4b1e581297a432fa5ff138bc0.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" NEAS.6aa3dde4b1e581297a432fa5ff138bc0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
NEAS.6aa3dde4b1e581297a432fa5ff138bc0.exedescription pid process Token: SeIncBasePriorityPrivilege 4456 NEAS.6aa3dde4b1e581297a432fa5ff138bc0.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
NEAS.6aa3dde4b1e581297a432fa5ff138bc0.execmd.exedescription pid process target process PID 4456 wrote to memory of 1900 4456 NEAS.6aa3dde4b1e581297a432fa5ff138bc0.exe MediaCenter.exe PID 4456 wrote to memory of 1900 4456 NEAS.6aa3dde4b1e581297a432fa5ff138bc0.exe MediaCenter.exe PID 4456 wrote to memory of 1900 4456 NEAS.6aa3dde4b1e581297a432fa5ff138bc0.exe MediaCenter.exe PID 4456 wrote to memory of 1864 4456 NEAS.6aa3dde4b1e581297a432fa5ff138bc0.exe cmd.exe PID 4456 wrote to memory of 1864 4456 NEAS.6aa3dde4b1e581297a432fa5ff138bc0.exe cmd.exe PID 4456 wrote to memory of 1864 4456 NEAS.6aa3dde4b1e581297a432fa5ff138bc0.exe cmd.exe PID 1864 wrote to memory of 2440 1864 cmd.exe PING.EXE PID 1864 wrote to memory of 2440 1864 cmd.exe PING.EXE PID 1864 wrote to memory of 2440 1864 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.6aa3dde4b1e581297a432fa5ff138bc0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.6aa3dde4b1e581297a432fa5ff138bc0.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:1900 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\NEAS.6aa3dde4b1e581297a432fa5ff138bc0.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:2440
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
212KB
MD56a12620f0c9c822d68a56dba7258081e
SHA19f20dd764b41ce6df35b40cf154eecc70cd2bf41
SHA2565f9c418516bde9e6e617b9d15ef2217f76cfbb448b54286f1adf73a819141aa1
SHA512f2edb3c8c97e1d45ae75331e31e7d9973208bd7d49f1384740b6788a446798c7e376fa5312caadc13589d9d0ae4af542e8750e3cf3dbbf341adae46a23e648de
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
212KB
MD56a12620f0c9c822d68a56dba7258081e
SHA19f20dd764b41ce6df35b40cf154eecc70cd2bf41
SHA2565f9c418516bde9e6e617b9d15ef2217f76cfbb448b54286f1adf73a819141aa1
SHA512f2edb3c8c97e1d45ae75331e31e7d9973208bd7d49f1384740b6788a446798c7e376fa5312caadc13589d9d0ae4af542e8750e3cf3dbbf341adae46a23e648de
-
memory/1900-4-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/1900-7-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/4456-0-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/4456-6-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/4456-8-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB