Analysis
-
max time kernel
127s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
31-10-2023 08:53
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.517a120013fbe25e5c1650816be768d0.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.517a120013fbe25e5c1650816be768d0.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.517a120013fbe25e5c1650816be768d0.exe
-
Size
57KB
-
MD5
517a120013fbe25e5c1650816be768d0
-
SHA1
c8f88e56a371e8c0763c85f16172b034410c43ee
-
SHA256
342cf2a81b62df31f015b4e951b7f1e147f2817fff4df8faca22c4012cd0acb3
-
SHA512
4e7048612c708ac952012ed2ae7ae1711948ff1bab1e071a2d9323aef94ace17b487fba1ed61b1efde7c4c26245112ab11b6cbe0904ccd3a5b82ea3f7dd14f41
-
SSDEEP
768:l7Xezc/T6Zp14hyYtoVxYPLVNPsED3VK2+ZtyOjgO4r9vFAg2rqm:V6zqhyYtkY7YTjipvF2r
Malware Config
Extracted
sakula
http://www.we11point.com:443/view.asp?cookie=%s&type=%d&vid=%d
http://www.we11point.com:443/photo/%s.jpg?vid=%d
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 1616 MediaCenter.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
NEAS.517a120013fbe25e5c1650816be768d0.execmd.execmd.exedescription pid process target process PID 212 wrote to memory of 4916 212 NEAS.517a120013fbe25e5c1650816be768d0.exe cmd.exe PID 212 wrote to memory of 4916 212 NEAS.517a120013fbe25e5c1650816be768d0.exe cmd.exe PID 212 wrote to memory of 4916 212 NEAS.517a120013fbe25e5c1650816be768d0.exe cmd.exe PID 212 wrote to memory of 1616 212 NEAS.517a120013fbe25e5c1650816be768d0.exe MediaCenter.exe PID 212 wrote to memory of 1616 212 NEAS.517a120013fbe25e5c1650816be768d0.exe MediaCenter.exe PID 212 wrote to memory of 1616 212 NEAS.517a120013fbe25e5c1650816be768d0.exe MediaCenter.exe PID 4916 wrote to memory of 2928 4916 cmd.exe reg.exe PID 4916 wrote to memory of 2928 4916 cmd.exe reg.exe PID 4916 wrote to memory of 2928 4916 cmd.exe reg.exe PID 212 wrote to memory of 2284 212 NEAS.517a120013fbe25e5c1650816be768d0.exe cmd.exe PID 212 wrote to memory of 2284 212 NEAS.517a120013fbe25e5c1650816be768d0.exe cmd.exe PID 212 wrote to memory of 2284 212 NEAS.517a120013fbe25e5c1650816be768d0.exe cmd.exe PID 2284 wrote to memory of 1168 2284 cmd.exe PING.EXE PID 2284 wrote to memory of 1168 2284 cmd.exe PING.EXE PID 2284 wrote to memory of 1168 2284 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.517a120013fbe25e5c1650816be768d0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.517a120013fbe25e5c1650816be768d0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:1616 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\NEAS.517a120013fbe25e5c1650816be768d0.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:1168
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
57KB
MD523a0a993e61a34211f7c5f6ac0ba8715
SHA189ce99f120d16009ad80bf340472f8b4b67a9813
SHA256e2581fb0c19dead1958f24df48e80638d0f31689ab727484bb07bc5aed377f5b
SHA5122a9e764b513709f608dfeae7feab4f210ff9f4220288cca52e06efc3c373f87651ef277004f00867ec0a5ffbeeb723bb3da7eb550480b5fa5ab28574266dafc7
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
57KB
MD523a0a993e61a34211f7c5f6ac0ba8715
SHA189ce99f120d16009ad80bf340472f8b4b67a9813
SHA256e2581fb0c19dead1958f24df48e80638d0f31689ab727484bb07bc5aed377f5b
SHA5122a9e764b513709f608dfeae7feab4f210ff9f4220288cca52e06efc3c373f87651ef277004f00867ec0a5ffbeeb723bb3da7eb550480b5fa5ab28574266dafc7
-
memory/212-0-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/212-5-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB