Analysis
-
max time kernel
139s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
01-11-2023 01:09
Behavioral task
behavioral1
Sample
NEAS.f924cfab54736ef8f590a966dc99dbc0.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.f924cfab54736ef8f590a966dc99dbc0.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.f924cfab54736ef8f590a966dc99dbc0.exe
-
Size
92KB
-
MD5
f924cfab54736ef8f590a966dc99dbc0
-
SHA1
b15e067c508ce804936bd75233f59c29320a62b4
-
SHA256
8c31ef5fc7051b47e6f00f3c307abc02c0725c9061a7f8b2e570931d6e60ed29
-
SHA512
4ba35fd8935a75c623c55dee6a449f314c94348880cd9b90e539cb7d1e1f6f1d784a9f2bcd6c1eb42e97577ce676e951be3ac963f6a316b011530aca4475b9c6
-
SSDEEP
1536:TJbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtrh:9bfVk29te2jqxCEtg30BV
Malware Config
Extracted
sakula
www.savmpet.com
Signatures
-
Sakula payload 6 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula \Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula \Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula \Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2688 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
AdobeUpdate.exepid process 3020 AdobeUpdate.exe -
Loads dropped DLL 4 IoCs
Processes:
NEAS.f924cfab54736ef8f590a966dc99dbc0.exeAdobeUpdate.exepid process 1652 NEAS.f924cfab54736ef8f590a966dc99dbc0.exe 3020 AdobeUpdate.exe 3020 AdobeUpdate.exe 3020 AdobeUpdate.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
NEAS.f924cfab54736ef8f590a966dc99dbc0.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AdobeUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\AdobeUpdate.exe" NEAS.f924cfab54736ef8f590a966dc99dbc0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
NEAS.f924cfab54736ef8f590a966dc99dbc0.exedescription pid process Token: SeIncBasePriorityPrivilege 1652 NEAS.f924cfab54736ef8f590a966dc99dbc0.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
NEAS.f924cfab54736ef8f590a966dc99dbc0.execmd.exedescription pid process target process PID 1652 wrote to memory of 3020 1652 NEAS.f924cfab54736ef8f590a966dc99dbc0.exe AdobeUpdate.exe PID 1652 wrote to memory of 3020 1652 NEAS.f924cfab54736ef8f590a966dc99dbc0.exe AdobeUpdate.exe PID 1652 wrote to memory of 3020 1652 NEAS.f924cfab54736ef8f590a966dc99dbc0.exe AdobeUpdate.exe PID 1652 wrote to memory of 3020 1652 NEAS.f924cfab54736ef8f590a966dc99dbc0.exe AdobeUpdate.exe PID 1652 wrote to memory of 3020 1652 NEAS.f924cfab54736ef8f590a966dc99dbc0.exe AdobeUpdate.exe PID 1652 wrote to memory of 3020 1652 NEAS.f924cfab54736ef8f590a966dc99dbc0.exe AdobeUpdate.exe PID 1652 wrote to memory of 3020 1652 NEAS.f924cfab54736ef8f590a966dc99dbc0.exe AdobeUpdate.exe PID 1652 wrote to memory of 2688 1652 NEAS.f924cfab54736ef8f590a966dc99dbc0.exe cmd.exe PID 1652 wrote to memory of 2688 1652 NEAS.f924cfab54736ef8f590a966dc99dbc0.exe cmd.exe PID 1652 wrote to memory of 2688 1652 NEAS.f924cfab54736ef8f590a966dc99dbc0.exe cmd.exe PID 1652 wrote to memory of 2688 1652 NEAS.f924cfab54736ef8f590a966dc99dbc0.exe cmd.exe PID 2688 wrote to memory of 2844 2688 cmd.exe PING.EXE PID 2688 wrote to memory of 2844 2688 cmd.exe PING.EXE PID 2688 wrote to memory of 2844 2688 cmd.exe PING.EXE PID 2688 wrote to memory of 2844 2688 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.f924cfab54736ef8f590a966dc99dbc0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.f924cfab54736ef8f590a966dc99dbc0.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3020 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\NEAS.f924cfab54736ef8f590a966dc99dbc0.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:2844
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeFilesize
92KB
MD5748a1234a131e84802081c517cb745fc
SHA180de27631c027240f5d6d8f7d2b0e3ad73b72c4e
SHA25652893e9f9feb8c7c20d7d830298c5d138d8ad4bf84ebc248ca685f906ccb088c
SHA51274369c3fbf778e0b67efe0e345bc1110c63abb537842e921c95116c0afcb7efe5634be94300c3c8c87e7443a49cb58b06990e53d7afeb306afdd48396a085d50
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeFilesize
92KB
MD5748a1234a131e84802081c517cb745fc
SHA180de27631c027240f5d6d8f7d2b0e3ad73b72c4e
SHA25652893e9f9feb8c7c20d7d830298c5d138d8ad4bf84ebc248ca685f906ccb088c
SHA51274369c3fbf778e0b67efe0e345bc1110c63abb537842e921c95116c0afcb7efe5634be94300c3c8c87e7443a49cb58b06990e53d7afeb306afdd48396a085d50
-
\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeFilesize
92KB
MD5748a1234a131e84802081c517cb745fc
SHA180de27631c027240f5d6d8f7d2b0e3ad73b72c4e
SHA25652893e9f9feb8c7c20d7d830298c5d138d8ad4bf84ebc248ca685f906ccb088c
SHA51274369c3fbf778e0b67efe0e345bc1110c63abb537842e921c95116c0afcb7efe5634be94300c3c8c87e7443a49cb58b06990e53d7afeb306afdd48396a085d50
-
\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeFilesize
92KB
MD5748a1234a131e84802081c517cb745fc
SHA180de27631c027240f5d6d8f7d2b0e3ad73b72c4e
SHA25652893e9f9feb8c7c20d7d830298c5d138d8ad4bf84ebc248ca685f906ccb088c
SHA51274369c3fbf778e0b67efe0e345bc1110c63abb537842e921c95116c0afcb7efe5634be94300c3c8c87e7443a49cb58b06990e53d7afeb306afdd48396a085d50
-
\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeFilesize
92KB
MD5748a1234a131e84802081c517cb745fc
SHA180de27631c027240f5d6d8f7d2b0e3ad73b72c4e
SHA25652893e9f9feb8c7c20d7d830298c5d138d8ad4bf84ebc248ca685f906ccb088c
SHA51274369c3fbf778e0b67efe0e345bc1110c63abb537842e921c95116c0afcb7efe5634be94300c3c8c87e7443a49cb58b06990e53d7afeb306afdd48396a085d50
-
\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeFilesize
92KB
MD5748a1234a131e84802081c517cb745fc
SHA180de27631c027240f5d6d8f7d2b0e3ad73b72c4e
SHA25652893e9f9feb8c7c20d7d830298c5d138d8ad4bf84ebc248ca685f906ccb088c
SHA51274369c3fbf778e0b67efe0e345bc1110c63abb537842e921c95116c0afcb7efe5634be94300c3c8c87e7443a49cb58b06990e53d7afeb306afdd48396a085d50