Analysis
-
max time kernel
180s -
max time network
193s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
01-11-2023 11:29
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.7cd690f6042104c4f9402d224b4b1070_JC.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.7cd690f6042104c4f9402d224b4b1070_JC.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.7cd690f6042104c4f9402d224b4b1070_JC.exe
-
Size
64KB
-
MD5
7cd690f6042104c4f9402d224b4b1070
-
SHA1
85eaae43eb56e191f25263e654469797690ca9c4
-
SHA256
f5946dfcbda6d479b3ae95c8637581fd0b6e224e53f814c416a45f4bb22291bf
-
SHA512
e6c650ee097d77252a2d1ad77ae1fd86cc30bec33fe0721339f46f88d0afdc9f70028f0252307880f8f72525ea30ef7f62d7a0a1f28bf45fa68a20ddd24b45ed
-
SSDEEP
768:Y0gD04rmpLAuJGlfAHI9lqnP8q0gXg0uvsVWZz/L4i/ym23ysRaKFt9kS3DCkeIB:YNpmpkzAHkq0gXgffZgiKKsDNDCkruQ
Malware Config
Extracted
sakula
www.polarroute.com
Signatures
-
Sakula payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4112-5-0x0000000000400000-0x0000000000423000-memory.dmp family_sakula behavioral2/memory/4200-7-0x0000000000400000-0x0000000000423000-memory.dmp family_sakula behavioral2/memory/4112-14-0x0000000000400000-0x0000000000423000-memory.dmp family_sakula behavioral2/memory/4200-19-0x0000000000400000-0x0000000000423000-memory.dmp family_sakula -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
NEAS.7cd690f6042104c4f9402d224b4b1070_JC.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Control Panel\International\Geo\Nation NEAS.7cd690f6042104c4f9402d224b4b1070_JC.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 4200 MediaCenter.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
NEAS.7cd690f6042104c4f9402d224b4b1070_JC.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" NEAS.7cd690f6042104c4f9402d224b4b1070_JC.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
NEAS.7cd690f6042104c4f9402d224b4b1070_JC.exedescription pid process Token: SeIncBasePriorityPrivilege 4112 NEAS.7cd690f6042104c4f9402d224b4b1070_JC.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
NEAS.7cd690f6042104c4f9402d224b4b1070_JC.execmd.exedescription pid process target process PID 4112 wrote to memory of 4200 4112 NEAS.7cd690f6042104c4f9402d224b4b1070_JC.exe MediaCenter.exe PID 4112 wrote to memory of 4200 4112 NEAS.7cd690f6042104c4f9402d224b4b1070_JC.exe MediaCenter.exe PID 4112 wrote to memory of 4200 4112 NEAS.7cd690f6042104c4f9402d224b4b1070_JC.exe MediaCenter.exe PID 4112 wrote to memory of 2344 4112 NEAS.7cd690f6042104c4f9402d224b4b1070_JC.exe cmd.exe PID 4112 wrote to memory of 2344 4112 NEAS.7cd690f6042104c4f9402d224b4b1070_JC.exe cmd.exe PID 4112 wrote to memory of 2344 4112 NEAS.7cd690f6042104c4f9402d224b4b1070_JC.exe cmd.exe PID 2344 wrote to memory of 4868 2344 cmd.exe PING.EXE PID 2344 wrote to memory of 4868 2344 cmd.exe PING.EXE PID 2344 wrote to memory of 4868 2344 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.7cd690f6042104c4f9402d224b4b1070_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.7cd690f6042104c4f9402d224b4b1070_JC.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:4200 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\NEAS.7cd690f6042104c4f9402d224b4b1070_JC.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:4868
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
64KB
MD513328d273e5a6254a7a20b4cf5e19af5
SHA1223a7ebc20e84379a48355555badd207677223af
SHA25627827ff92875053ff850a7637e3bdd200ca1cf1aa5153cba9bb50053e07dfedd
SHA512dbf455a45f5378445b53e98770c544a5317c5a2662c9d4d1fe2a93996b213f78c8e3e0f89aa756c282760c2be6e8e017615b04eda8686649a7e95564359ee294
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
64KB
MD513328d273e5a6254a7a20b4cf5e19af5
SHA1223a7ebc20e84379a48355555badd207677223af
SHA25627827ff92875053ff850a7637e3bdd200ca1cf1aa5153cba9bb50053e07dfedd
SHA512dbf455a45f5378445b53e98770c544a5317c5a2662c9d4d1fe2a93996b213f78c8e3e0f89aa756c282760c2be6e8e017615b04eda8686649a7e95564359ee294
-
memory/4112-0-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/4112-5-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/4112-14-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/4200-7-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB
-
memory/4200-19-0x0000000000400000-0x0000000000423000-memory.dmpFilesize
140KB