Analysis
-
max time kernel
163s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
31-10-2023 08:53
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.4c7d862b3e1c06a2e22df4f0e6c64ba0.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.4c7d862b3e1c06a2e22df4f0e6c64ba0.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.4c7d862b3e1c06a2e22df4f0e6c64ba0.exe
-
Size
57KB
-
MD5
4c7d862b3e1c06a2e22df4f0e6c64ba0
-
SHA1
9bb273743834839a1fe88f0bea682714c7ff1ae0
-
SHA256
338a62714de8e32ad234247818ec4524063d7f580c503dd02e99585f7d141bde
-
SHA512
7d43b60e1e0126063eefc55f0d2b8e99a2d0e3199a3153b24184f3bc4f56b0b1c3806de1315462f8413f008b567a98e3fa4727ae2b98c92034b2999c06a1b5f3
-
SSDEEP
768:l7Xezc/T6Zp14hyYtoVxYPLVNPsED3VK2+ZtyOjgO4r9vFAg2rqS:V6zqhyYtkY7YTjipvF2b
Malware Config
Extracted
sakula
http://www.we11point.com:443/view.asp?cookie=%s&type=%d&vid=%d
http://www.we11point.com:443/photo/%s.jpg?vid=%d
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 2244 MediaCenter.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
NEAS.4c7d862b3e1c06a2e22df4f0e6c64ba0.execmd.execmd.exedescription pid process target process PID 4816 wrote to memory of 1868 4816 NEAS.4c7d862b3e1c06a2e22df4f0e6c64ba0.exe cmd.exe PID 4816 wrote to memory of 1868 4816 NEAS.4c7d862b3e1c06a2e22df4f0e6c64ba0.exe cmd.exe PID 4816 wrote to memory of 1868 4816 NEAS.4c7d862b3e1c06a2e22df4f0e6c64ba0.exe cmd.exe PID 4816 wrote to memory of 2244 4816 NEAS.4c7d862b3e1c06a2e22df4f0e6c64ba0.exe MediaCenter.exe PID 4816 wrote to memory of 2244 4816 NEAS.4c7d862b3e1c06a2e22df4f0e6c64ba0.exe MediaCenter.exe PID 4816 wrote to memory of 2244 4816 NEAS.4c7d862b3e1c06a2e22df4f0e6c64ba0.exe MediaCenter.exe PID 1868 wrote to memory of 1980 1868 cmd.exe reg.exe PID 1868 wrote to memory of 1980 1868 cmd.exe reg.exe PID 1868 wrote to memory of 1980 1868 cmd.exe reg.exe PID 4816 wrote to memory of 2936 4816 NEAS.4c7d862b3e1c06a2e22df4f0e6c64ba0.exe cmd.exe PID 4816 wrote to memory of 2936 4816 NEAS.4c7d862b3e1c06a2e22df4f0e6c64ba0.exe cmd.exe PID 4816 wrote to memory of 2936 4816 NEAS.4c7d862b3e1c06a2e22df4f0e6c64ba0.exe cmd.exe PID 2936 wrote to memory of 4900 2936 cmd.exe PING.EXE PID 2936 wrote to memory of 4900 2936 cmd.exe PING.EXE PID 2936 wrote to memory of 4900 2936 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.4c7d862b3e1c06a2e22df4f0e6c64ba0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.4c7d862b3e1c06a2e22df4f0e6c64ba0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:2244 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\NEAS.4c7d862b3e1c06a2e22df4f0e6c64ba0.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:4900
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
57KB
MD5c952e03e040442d7b14e78e8e44209a4
SHA15abea83097b5d46647565c08fad36cfdada92f40
SHA2560768c84bf38fc3428d77476d29cf82e08ada234314c7335fe5ef20fe86813ee2
SHA5127679559c25b29b09edded8ee060363e5b9adb5aad01748fe66bdbe7de88f9e887b05fd0a189dccb6cd1d2fc883f7f877f2c58069335ae93ef4796df1fdd97ded
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
57KB
MD5c952e03e040442d7b14e78e8e44209a4
SHA15abea83097b5d46647565c08fad36cfdada92f40
SHA2560768c84bf38fc3428d77476d29cf82e08ada234314c7335fe5ef20fe86813ee2
SHA5127679559c25b29b09edded8ee060363e5b9adb5aad01748fe66bdbe7de88f9e887b05fd0a189dccb6cd1d2fc883f7f877f2c58069335ae93ef4796df1fdd97ded
-
memory/4816-0-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/4816-5-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB