Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
31-10-2023 08:53
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.517a120013fbe25e5c1650816be768d0.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.517a120013fbe25e5c1650816be768d0.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.517a120013fbe25e5c1650816be768d0.exe
-
Size
57KB
-
MD5
517a120013fbe25e5c1650816be768d0
-
SHA1
c8f88e56a371e8c0763c85f16172b034410c43ee
-
SHA256
342cf2a81b62df31f015b4e951b7f1e147f2817fff4df8faca22c4012cd0acb3
-
SHA512
4e7048612c708ac952012ed2ae7ae1711948ff1bab1e071a2d9323aef94ace17b487fba1ed61b1efde7c4c26245112ab11b6cbe0904ccd3a5b82ea3f7dd14f41
-
SSDEEP
768:l7Xezc/T6Zp14hyYtoVxYPLVNPsED3VK2+ZtyOjgO4r9vFAg2rqm:V6zqhyYtkY7YTjipvF2r
Malware Config
Extracted
sakula
http://www.we11point.com:443/view.asp?cookie=%s&type=%d&vid=%d
http://www.we11point.com:443/photo/%s.jpg?vid=%d
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2636 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 1440 MediaCenter.exe -
Loads dropped DLL 2 IoCs
Processes:
NEAS.517a120013fbe25e5c1650816be768d0.exepid process 3012 NEAS.517a120013fbe25e5c1650816be768d0.exe 3012 NEAS.517a120013fbe25e5c1650816be768d0.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
NEAS.517a120013fbe25e5c1650816be768d0.execmd.execmd.exedescription pid process target process PID 3012 wrote to memory of 2052 3012 NEAS.517a120013fbe25e5c1650816be768d0.exe cmd.exe PID 3012 wrote to memory of 2052 3012 NEAS.517a120013fbe25e5c1650816be768d0.exe cmd.exe PID 3012 wrote to memory of 2052 3012 NEAS.517a120013fbe25e5c1650816be768d0.exe cmd.exe PID 3012 wrote to memory of 2052 3012 NEAS.517a120013fbe25e5c1650816be768d0.exe cmd.exe PID 3012 wrote to memory of 1440 3012 NEAS.517a120013fbe25e5c1650816be768d0.exe MediaCenter.exe PID 3012 wrote to memory of 1440 3012 NEAS.517a120013fbe25e5c1650816be768d0.exe MediaCenter.exe PID 3012 wrote to memory of 1440 3012 NEAS.517a120013fbe25e5c1650816be768d0.exe MediaCenter.exe PID 3012 wrote to memory of 1440 3012 NEAS.517a120013fbe25e5c1650816be768d0.exe MediaCenter.exe PID 2052 wrote to memory of 1928 2052 cmd.exe reg.exe PID 2052 wrote to memory of 1928 2052 cmd.exe reg.exe PID 2052 wrote to memory of 1928 2052 cmd.exe reg.exe PID 2052 wrote to memory of 1928 2052 cmd.exe reg.exe PID 3012 wrote to memory of 2636 3012 NEAS.517a120013fbe25e5c1650816be768d0.exe cmd.exe PID 3012 wrote to memory of 2636 3012 NEAS.517a120013fbe25e5c1650816be768d0.exe cmd.exe PID 3012 wrote to memory of 2636 3012 NEAS.517a120013fbe25e5c1650816be768d0.exe cmd.exe PID 3012 wrote to memory of 2636 3012 NEAS.517a120013fbe25e5c1650816be768d0.exe cmd.exe PID 2636 wrote to memory of 2752 2636 cmd.exe PING.EXE PID 2636 wrote to memory of 2752 2636 cmd.exe PING.EXE PID 2636 wrote to memory of 2752 2636 cmd.exe PING.EXE PID 2636 wrote to memory of 2752 2636 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.517a120013fbe25e5c1650816be768d0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.517a120013fbe25e5c1650816be768d0.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:1440 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\NEAS.517a120013fbe25e5c1650816be768d0.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:2752
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
57KB
MD5b63396fd6d3b6d38fc845045de6bcc36
SHA159cf3e3dce56ac24364eae7ac25ca586ac6cf112
SHA2561dcfcb92cb146ede479f2a066eacb0ef5f0a56a89b4715712189089803aba694
SHA51249b17157e768320be1c86b005262de98ac98f36ba59eac524b7a5b6dab703fe354fe27b1c8ba90475d29609326f2311aef7b7b1d8ca975cb42857d4eea4eff8c
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
57KB
MD5b63396fd6d3b6d38fc845045de6bcc36
SHA159cf3e3dce56ac24364eae7ac25ca586ac6cf112
SHA2561dcfcb92cb146ede479f2a066eacb0ef5f0a56a89b4715712189089803aba694
SHA51249b17157e768320be1c86b005262de98ac98f36ba59eac524b7a5b6dab703fe354fe27b1c8ba90475d29609326f2311aef7b7b1d8ca975cb42857d4eea4eff8c
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
57KB
MD5b63396fd6d3b6d38fc845045de6bcc36
SHA159cf3e3dce56ac24364eae7ac25ca586ac6cf112
SHA2561dcfcb92cb146ede479f2a066eacb0ef5f0a56a89b4715712189089803aba694
SHA51249b17157e768320be1c86b005262de98ac98f36ba59eac524b7a5b6dab703fe354fe27b1c8ba90475d29609326f2311aef7b7b1d8ca975cb42857d4eea4eff8c
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
57KB
MD5b63396fd6d3b6d38fc845045de6bcc36
SHA159cf3e3dce56ac24364eae7ac25ca586ac6cf112
SHA2561dcfcb92cb146ede479f2a066eacb0ef5f0a56a89b4715712189089803aba694
SHA51249b17157e768320be1c86b005262de98ac98f36ba59eac524b7a5b6dab703fe354fe27b1c8ba90475d29609326f2311aef7b7b1d8ca975cb42857d4eea4eff8c
-
memory/3012-0-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/3012-9-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB