Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
31-10-2023 20:48
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.f1cc2c63ab37a1169502c9d747490740_JC.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.f1cc2c63ab37a1169502c9d747490740_JC.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.f1cc2c63ab37a1169502c9d747490740_JC.exe
-
Size
57KB
-
MD5
f1cc2c63ab37a1169502c9d747490740
-
SHA1
89fb182bd220daf70e5b1c31a182f15367b20938
-
SHA256
bf1c6d2fd16c85461f4be1986409193b7ad89ddaab5fe10b1338c1957953b225
-
SHA512
be05ea2ea95fe1eda7ef487828c175bcf20a341d6628bb5c72750dcce66e4eebdd93433dd52bdc74d9458b31999b82237e6ac71e15439549ca29d8d911406ad6
-
SSDEEP
768:l7Xezc/T6Zp14hyYtoVxYPLVNPsED3VK2+ZtyOjgO4r9vFAg2rqm:V6zqhyYtkY7YTjipvF2X
Malware Config
Extracted
sakula
http://www.we11point.com:443/view.asp?cookie=%s&type=%d&vid=%d
http://www.we11point.com:443/photo/%s.jpg?vid=%d
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2604 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 2356 MediaCenter.exe -
Loads dropped DLL 2 IoCs
Processes:
NEAS.f1cc2c63ab37a1169502c9d747490740_JC.exepid process 2516 NEAS.f1cc2c63ab37a1169502c9d747490740_JC.exe 2516 NEAS.f1cc2c63ab37a1169502c9d747490740_JC.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
NEAS.f1cc2c63ab37a1169502c9d747490740_JC.execmd.execmd.exedescription pid process target process PID 2516 wrote to memory of 1096 2516 NEAS.f1cc2c63ab37a1169502c9d747490740_JC.exe cmd.exe PID 2516 wrote to memory of 1096 2516 NEAS.f1cc2c63ab37a1169502c9d747490740_JC.exe cmd.exe PID 2516 wrote to memory of 1096 2516 NEAS.f1cc2c63ab37a1169502c9d747490740_JC.exe cmd.exe PID 2516 wrote to memory of 1096 2516 NEAS.f1cc2c63ab37a1169502c9d747490740_JC.exe cmd.exe PID 2516 wrote to memory of 2356 2516 NEAS.f1cc2c63ab37a1169502c9d747490740_JC.exe MediaCenter.exe PID 2516 wrote to memory of 2356 2516 NEAS.f1cc2c63ab37a1169502c9d747490740_JC.exe MediaCenter.exe PID 2516 wrote to memory of 2356 2516 NEAS.f1cc2c63ab37a1169502c9d747490740_JC.exe MediaCenter.exe PID 2516 wrote to memory of 2356 2516 NEAS.f1cc2c63ab37a1169502c9d747490740_JC.exe MediaCenter.exe PID 1096 wrote to memory of 2696 1096 cmd.exe reg.exe PID 1096 wrote to memory of 2696 1096 cmd.exe reg.exe PID 1096 wrote to memory of 2696 1096 cmd.exe reg.exe PID 1096 wrote to memory of 2696 1096 cmd.exe reg.exe PID 2516 wrote to memory of 2604 2516 NEAS.f1cc2c63ab37a1169502c9d747490740_JC.exe cmd.exe PID 2516 wrote to memory of 2604 2516 NEAS.f1cc2c63ab37a1169502c9d747490740_JC.exe cmd.exe PID 2516 wrote to memory of 2604 2516 NEAS.f1cc2c63ab37a1169502c9d747490740_JC.exe cmd.exe PID 2516 wrote to memory of 2604 2516 NEAS.f1cc2c63ab37a1169502c9d747490740_JC.exe cmd.exe PID 2604 wrote to memory of 2984 2604 cmd.exe PING.EXE PID 2604 wrote to memory of 2984 2604 cmd.exe PING.EXE PID 2604 wrote to memory of 2984 2604 cmd.exe PING.EXE PID 2604 wrote to memory of 2984 2604 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.f1cc2c63ab37a1169502c9d747490740_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.f1cc2c63ab37a1169502c9d747490740_JC.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:2356 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\NEAS.f1cc2c63ab37a1169502c9d747490740_JC.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:2984
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
57KB
MD5fa80045d275a535ade229a7f02872a38
SHA15a4f477f5438d6b8203383607520a5d217b44923
SHA2569af68b47388689721f9f1e2b2467ef23c6f6f0c4394e2a07409c1d6386d0909e
SHA512d7ad83366f35619046f3c0572df0112300c9082034b52fffa96b7434ae325d0a500be46b5510688c38cbaef0232020551afa2cf6b27a5616c92fbf58a86bc87b
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
57KB
MD5fa80045d275a535ade229a7f02872a38
SHA15a4f477f5438d6b8203383607520a5d217b44923
SHA2569af68b47388689721f9f1e2b2467ef23c6f6f0c4394e2a07409c1d6386d0909e
SHA512d7ad83366f35619046f3c0572df0112300c9082034b52fffa96b7434ae325d0a500be46b5510688c38cbaef0232020551afa2cf6b27a5616c92fbf58a86bc87b
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
57KB
MD5fa80045d275a535ade229a7f02872a38
SHA15a4f477f5438d6b8203383607520a5d217b44923
SHA2569af68b47388689721f9f1e2b2467ef23c6f6f0c4394e2a07409c1d6386d0909e
SHA512d7ad83366f35619046f3c0572df0112300c9082034b52fffa96b7434ae325d0a500be46b5510688c38cbaef0232020551afa2cf6b27a5616c92fbf58a86bc87b
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
57KB
MD5fa80045d275a535ade229a7f02872a38
SHA15a4f477f5438d6b8203383607520a5d217b44923
SHA2569af68b47388689721f9f1e2b2467ef23c6f6f0c4394e2a07409c1d6386d0909e
SHA512d7ad83366f35619046f3c0572df0112300c9082034b52fffa96b7434ae325d0a500be46b5510688c38cbaef0232020551afa2cf6b27a5616c92fbf58a86bc87b
-
memory/2516-0-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/2516-9-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB