Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
31-10-2023 20:48
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.f1cc2c63ab37a1169502c9d747490740_JC.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.f1cc2c63ab37a1169502c9d747490740_JC.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.f1cc2c63ab37a1169502c9d747490740_JC.exe
-
Size
57KB
-
MD5
f1cc2c63ab37a1169502c9d747490740
-
SHA1
89fb182bd220daf70e5b1c31a182f15367b20938
-
SHA256
bf1c6d2fd16c85461f4be1986409193b7ad89ddaab5fe10b1338c1957953b225
-
SHA512
be05ea2ea95fe1eda7ef487828c175bcf20a341d6628bb5c72750dcce66e4eebdd93433dd52bdc74d9458b31999b82237e6ac71e15439549ca29d8d911406ad6
-
SSDEEP
768:l7Xezc/T6Zp14hyYtoVxYPLVNPsED3VK2+ZtyOjgO4r9vFAg2rqm:V6zqhyYtkY7YTjipvF2X
Malware Config
Extracted
sakula
http://www.we11point.com:443/view.asp?cookie=%s&type=%d&vid=%d
http://www.we11point.com:443/photo/%s.jpg?vid=%d
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 3836 MediaCenter.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
svchost.exedescription pid process Token: SeManageVolumePrivilege 1252 svchost.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
NEAS.f1cc2c63ab37a1169502c9d747490740_JC.execmd.execmd.exedescription pid process target process PID 3232 wrote to memory of 5036 3232 NEAS.f1cc2c63ab37a1169502c9d747490740_JC.exe cmd.exe PID 3232 wrote to memory of 5036 3232 NEAS.f1cc2c63ab37a1169502c9d747490740_JC.exe cmd.exe PID 3232 wrote to memory of 5036 3232 NEAS.f1cc2c63ab37a1169502c9d747490740_JC.exe cmd.exe PID 3232 wrote to memory of 3836 3232 NEAS.f1cc2c63ab37a1169502c9d747490740_JC.exe MediaCenter.exe PID 3232 wrote to memory of 3836 3232 NEAS.f1cc2c63ab37a1169502c9d747490740_JC.exe MediaCenter.exe PID 3232 wrote to memory of 3836 3232 NEAS.f1cc2c63ab37a1169502c9d747490740_JC.exe MediaCenter.exe PID 5036 wrote to memory of 4856 5036 cmd.exe reg.exe PID 5036 wrote to memory of 4856 5036 cmd.exe reg.exe PID 5036 wrote to memory of 4856 5036 cmd.exe reg.exe PID 3232 wrote to memory of 752 3232 NEAS.f1cc2c63ab37a1169502c9d747490740_JC.exe cmd.exe PID 3232 wrote to memory of 752 3232 NEAS.f1cc2c63ab37a1169502c9d747490740_JC.exe cmd.exe PID 3232 wrote to memory of 752 3232 NEAS.f1cc2c63ab37a1169502c9d747490740_JC.exe cmd.exe PID 752 wrote to memory of 4704 752 cmd.exe PING.EXE PID 752 wrote to memory of 4704 752 cmd.exe PING.EXE PID 752 wrote to memory of 4704 752 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.f1cc2c63ab37a1169502c9d747490740_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.f1cc2c63ab37a1169502c9d747490740_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:3836 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\NEAS.f1cc2c63ab37a1169502c9d747490740_JC.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:4704
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵PID:4216
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1252
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfmFilesize
16KB
MD559d7abcdee014c8012739d30469bcab2
SHA1e07162f050f849e14b4cfcb7ee5e535c4e593fef
SHA256dd7662dffcef28e90f827856883a338201394d4b7e915b7619bb8464ee1609d1
SHA512f90e6a533f9de0b443f22b67d9a3e157a5b16f4ff8a6ed446893c237abe44cb09db92410c02a293ba2bfa6c3dcde5bd6c0157464e177fdc5d3d13caf346ed298
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
57KB
MD524870b4e3f3cad95cb24b8a6f07c7c3d
SHA1d1a6eda4c365dde0bdf9f1eba3163d86cc2bb243
SHA2563edc7d404c821222553eb70ca3c1708159a42bcdd5e3db1b704a59e1bcc5c861
SHA512d15fcca2bc1df29cf480a5c2089cd6657fb6f42977c51bdf4c59519ab1019164177514af83776076ade6c1f8aa457b71bdd5b1c39c5e9279599bff494be0206d
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
57KB
MD524870b4e3f3cad95cb24b8a6f07c7c3d
SHA1d1a6eda4c365dde0bdf9f1eba3163d86cc2bb243
SHA2563edc7d404c821222553eb70ca3c1708159a42bcdd5e3db1b704a59e1bcc5c861
SHA512d15fcca2bc1df29cf480a5c2089cd6657fb6f42977c51bdf4c59519ab1019164177514af83776076ade6c1f8aa457b71bdd5b1c39c5e9279599bff494be0206d
-
memory/1252-44-0x0000016A12FC0000-0x0000016A12FC1000-memory.dmpFilesize
4KB
-
memory/1252-46-0x0000016A12FC0000-0x0000016A12FC1000-memory.dmpFilesize
4KB
-
memory/1252-22-0x0000016A0AB40000-0x0000016A0AB50000-memory.dmpFilesize
64KB
-
memory/1252-38-0x0000016A12FA0000-0x0000016A12FA1000-memory.dmpFilesize
4KB
-
memory/1252-39-0x0000016A12FC0000-0x0000016A12FC1000-memory.dmpFilesize
4KB
-
memory/1252-40-0x0000016A12FC0000-0x0000016A12FC1000-memory.dmpFilesize
4KB
-
memory/1252-41-0x0000016A12FC0000-0x0000016A12FC1000-memory.dmpFilesize
4KB
-
memory/1252-42-0x0000016A12FC0000-0x0000016A12FC1000-memory.dmpFilesize
4KB
-
memory/1252-43-0x0000016A12FC0000-0x0000016A12FC1000-memory.dmpFilesize
4KB
-
memory/1252-74-0x0000016A12F40000-0x0000016A12F41000-memory.dmpFilesize
4KB
-
memory/1252-45-0x0000016A12FC0000-0x0000016A12FC1000-memory.dmpFilesize
4KB
-
memory/1252-6-0x0000016A0AA40000-0x0000016A0AA50000-memory.dmpFilesize
64KB
-
memory/1252-47-0x0000016A12FC0000-0x0000016A12FC1000-memory.dmpFilesize
4KB
-
memory/1252-48-0x0000016A12FC0000-0x0000016A12FC1000-memory.dmpFilesize
4KB
-
memory/1252-49-0x0000016A12D00000-0x0000016A12D01000-memory.dmpFilesize
4KB
-
memory/1252-50-0x0000016A12CF0000-0x0000016A12CF1000-memory.dmpFilesize
4KB
-
memory/1252-52-0x0000016A12D00000-0x0000016A12D01000-memory.dmpFilesize
4KB
-
memory/1252-55-0x0000016A12CF0000-0x0000016A12CF1000-memory.dmpFilesize
4KB
-
memory/1252-58-0x0000016A0A3E0000-0x0000016A0A3E1000-memory.dmpFilesize
4KB
-
memory/1252-73-0x0000016A12E30000-0x0000016A12E31000-memory.dmpFilesize
4KB
-
memory/1252-70-0x0000016A12E20000-0x0000016A12E21000-memory.dmpFilesize
4KB
-
memory/1252-72-0x0000016A12E30000-0x0000016A12E31000-memory.dmpFilesize
4KB
-
memory/3232-5-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/3232-0-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB