Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
31-10-2023 08:53
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.4c7d862b3e1c06a2e22df4f0e6c64ba0.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.4c7d862b3e1c06a2e22df4f0e6c64ba0.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.4c7d862b3e1c06a2e22df4f0e6c64ba0.exe
-
Size
57KB
-
MD5
4c7d862b3e1c06a2e22df4f0e6c64ba0
-
SHA1
9bb273743834839a1fe88f0bea682714c7ff1ae0
-
SHA256
338a62714de8e32ad234247818ec4524063d7f580c503dd02e99585f7d141bde
-
SHA512
7d43b60e1e0126063eefc55f0d2b8e99a2d0e3199a3153b24184f3bc4f56b0b1c3806de1315462f8413f008b567a98e3fa4727ae2b98c92034b2999c06a1b5f3
-
SSDEEP
768:l7Xezc/T6Zp14hyYtoVxYPLVNPsED3VK2+ZtyOjgO4r9vFAg2rqS:V6zqhyYtkY7YTjipvF2b
Malware Config
Extracted
sakula
http://www.we11point.com:443/view.asp?cookie=%s&type=%d&vid=%d
http://www.we11point.com:443/photo/%s.jpg?vid=%d
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 3000 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 2604 MediaCenter.exe -
Loads dropped DLL 2 IoCs
Processes:
NEAS.4c7d862b3e1c06a2e22df4f0e6c64ba0.exepid process 1692 NEAS.4c7d862b3e1c06a2e22df4f0e6c64ba0.exe 1692 NEAS.4c7d862b3e1c06a2e22df4f0e6c64ba0.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
NEAS.4c7d862b3e1c06a2e22df4f0e6c64ba0.execmd.execmd.exedescription pid process target process PID 1692 wrote to memory of 2588 1692 NEAS.4c7d862b3e1c06a2e22df4f0e6c64ba0.exe cmd.exe PID 1692 wrote to memory of 2588 1692 NEAS.4c7d862b3e1c06a2e22df4f0e6c64ba0.exe cmd.exe PID 1692 wrote to memory of 2588 1692 NEAS.4c7d862b3e1c06a2e22df4f0e6c64ba0.exe cmd.exe PID 1692 wrote to memory of 2588 1692 NEAS.4c7d862b3e1c06a2e22df4f0e6c64ba0.exe cmd.exe PID 1692 wrote to memory of 2604 1692 NEAS.4c7d862b3e1c06a2e22df4f0e6c64ba0.exe MediaCenter.exe PID 1692 wrote to memory of 2604 1692 NEAS.4c7d862b3e1c06a2e22df4f0e6c64ba0.exe MediaCenter.exe PID 1692 wrote to memory of 2604 1692 NEAS.4c7d862b3e1c06a2e22df4f0e6c64ba0.exe MediaCenter.exe PID 1692 wrote to memory of 2604 1692 NEAS.4c7d862b3e1c06a2e22df4f0e6c64ba0.exe MediaCenter.exe PID 2588 wrote to memory of 2720 2588 cmd.exe reg.exe PID 2588 wrote to memory of 2720 2588 cmd.exe reg.exe PID 2588 wrote to memory of 2720 2588 cmd.exe reg.exe PID 2588 wrote to memory of 2720 2588 cmd.exe reg.exe PID 1692 wrote to memory of 3000 1692 NEAS.4c7d862b3e1c06a2e22df4f0e6c64ba0.exe cmd.exe PID 1692 wrote to memory of 3000 1692 NEAS.4c7d862b3e1c06a2e22df4f0e6c64ba0.exe cmd.exe PID 1692 wrote to memory of 3000 1692 NEAS.4c7d862b3e1c06a2e22df4f0e6c64ba0.exe cmd.exe PID 1692 wrote to memory of 3000 1692 NEAS.4c7d862b3e1c06a2e22df4f0e6c64ba0.exe cmd.exe PID 3000 wrote to memory of 1740 3000 cmd.exe PING.EXE PID 3000 wrote to memory of 1740 3000 cmd.exe PING.EXE PID 3000 wrote to memory of 1740 3000 cmd.exe PING.EXE PID 3000 wrote to memory of 1740 3000 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.4c7d862b3e1c06a2e22df4f0e6c64ba0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.4c7d862b3e1c06a2e22df4f0e6c64ba0.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:2604 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\NEAS.4c7d862b3e1c06a2e22df4f0e6c64ba0.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:1740
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
57KB
MD5fa80045d275a535ade229a7f02872a38
SHA15a4f477f5438d6b8203383607520a5d217b44923
SHA2569af68b47388689721f9f1e2b2467ef23c6f6f0c4394e2a07409c1d6386d0909e
SHA512d7ad83366f35619046f3c0572df0112300c9082034b52fffa96b7434ae325d0a500be46b5510688c38cbaef0232020551afa2cf6b27a5616c92fbf58a86bc87b
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
57KB
MD5fa80045d275a535ade229a7f02872a38
SHA15a4f477f5438d6b8203383607520a5d217b44923
SHA2569af68b47388689721f9f1e2b2467ef23c6f6f0c4394e2a07409c1d6386d0909e
SHA512d7ad83366f35619046f3c0572df0112300c9082034b52fffa96b7434ae325d0a500be46b5510688c38cbaef0232020551afa2cf6b27a5616c92fbf58a86bc87b
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
57KB
MD5fa80045d275a535ade229a7f02872a38
SHA15a4f477f5438d6b8203383607520a5d217b44923
SHA2569af68b47388689721f9f1e2b2467ef23c6f6f0c4394e2a07409c1d6386d0909e
SHA512d7ad83366f35619046f3c0572df0112300c9082034b52fffa96b7434ae325d0a500be46b5510688c38cbaef0232020551afa2cf6b27a5616c92fbf58a86bc87b
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
57KB
MD5fa80045d275a535ade229a7f02872a38
SHA15a4f477f5438d6b8203383607520a5d217b44923
SHA2569af68b47388689721f9f1e2b2467ef23c6f6f0c4394e2a07409c1d6386d0909e
SHA512d7ad83366f35619046f3c0572df0112300c9082034b52fffa96b7434ae325d0a500be46b5510688c38cbaef0232020551afa2cf6b27a5616c92fbf58a86bc87b
-
memory/1692-0-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/1692-9-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB