Analysis
-
max time kernel
133s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
01-11-2023 12:08
Behavioral task
behavioral1
Sample
NEAS.64c843ed4bb28832a349736208ed4560_JC.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.64c843ed4bb28832a349736208ed4560_JC.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.64c843ed4bb28832a349736208ed4560_JC.exe
-
Size
92KB
-
MD5
64c843ed4bb28832a349736208ed4560
-
SHA1
03b2aad465f86d5d243dce52221685256f1d07bf
-
SHA256
99694a73d47065a83988606733b3b647fd1a3dc59a0edf6bd7b5eedf9e1fe756
-
SHA512
d0d484de67afe9b9593a1c3d17bef3a357b62fbc8a46836373f6c9f8b58d02bc9d38714bc23bc2e0e18d58445b63b814af0468dc90210c085c5cd7e6612b9cb9
-
SSDEEP
1536:TJbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtrG:9bfVk29te2jqxCEtg30Bq
Malware Config
Extracted
sakula
www.savmpet.com
Signatures
-
Sakula payload 6 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula \Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula \Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula \Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2744 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
AdobeUpdate.exepid process 2272 AdobeUpdate.exe -
Loads dropped DLL 4 IoCs
Processes:
NEAS.64c843ed4bb28832a349736208ed4560_JC.exeAdobeUpdate.exepid process 1788 NEAS.64c843ed4bb28832a349736208ed4560_JC.exe 2272 AdobeUpdate.exe 2272 AdobeUpdate.exe 2272 AdobeUpdate.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
NEAS.64c843ed4bb28832a349736208ed4560_JC.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AdobeUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\AdobeUpdate.exe" NEAS.64c843ed4bb28832a349736208ed4560_JC.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
NEAS.64c843ed4bb28832a349736208ed4560_JC.exedescription pid process Token: SeIncBasePriorityPrivilege 1788 NEAS.64c843ed4bb28832a349736208ed4560_JC.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
NEAS.64c843ed4bb28832a349736208ed4560_JC.execmd.exedescription pid process target process PID 1788 wrote to memory of 2272 1788 NEAS.64c843ed4bb28832a349736208ed4560_JC.exe AdobeUpdate.exe PID 1788 wrote to memory of 2272 1788 NEAS.64c843ed4bb28832a349736208ed4560_JC.exe AdobeUpdate.exe PID 1788 wrote to memory of 2272 1788 NEAS.64c843ed4bb28832a349736208ed4560_JC.exe AdobeUpdate.exe PID 1788 wrote to memory of 2272 1788 NEAS.64c843ed4bb28832a349736208ed4560_JC.exe AdobeUpdate.exe PID 1788 wrote to memory of 2272 1788 NEAS.64c843ed4bb28832a349736208ed4560_JC.exe AdobeUpdate.exe PID 1788 wrote to memory of 2272 1788 NEAS.64c843ed4bb28832a349736208ed4560_JC.exe AdobeUpdate.exe PID 1788 wrote to memory of 2272 1788 NEAS.64c843ed4bb28832a349736208ed4560_JC.exe AdobeUpdate.exe PID 1788 wrote to memory of 2744 1788 NEAS.64c843ed4bb28832a349736208ed4560_JC.exe cmd.exe PID 1788 wrote to memory of 2744 1788 NEAS.64c843ed4bb28832a349736208ed4560_JC.exe cmd.exe PID 1788 wrote to memory of 2744 1788 NEAS.64c843ed4bb28832a349736208ed4560_JC.exe cmd.exe PID 1788 wrote to memory of 2744 1788 NEAS.64c843ed4bb28832a349736208ed4560_JC.exe cmd.exe PID 2744 wrote to memory of 2552 2744 cmd.exe PING.EXE PID 2744 wrote to memory of 2552 2744 cmd.exe PING.EXE PID 2744 wrote to memory of 2552 2744 cmd.exe PING.EXE PID 2744 wrote to memory of 2552 2744 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.64c843ed4bb28832a349736208ed4560_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.64c843ed4bb28832a349736208ed4560_JC.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2272 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\NEAS.64c843ed4bb28832a349736208ed4560_JC.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:2552
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeFilesize
92KB
MD57eb4233a4a3df7d2207c1ca29d0b8add
SHA12f3800b389b4cdb1e667f28a2cc121421c9a22fb
SHA256995eeec0f1613e80de44f5c857aefbb41e40e1d2beff9ab56f0eceac05cb6d68
SHA5123dd00da7e40e7864be978f772a9aa5499d9c723c505f9c0002ff5a5077b50974c7ab689bd835707f11dc9ba1de6243553c19a018b5ac5ce2b5bea29894821b28
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeFilesize
92KB
MD57eb4233a4a3df7d2207c1ca29d0b8add
SHA12f3800b389b4cdb1e667f28a2cc121421c9a22fb
SHA256995eeec0f1613e80de44f5c857aefbb41e40e1d2beff9ab56f0eceac05cb6d68
SHA5123dd00da7e40e7864be978f772a9aa5499d9c723c505f9c0002ff5a5077b50974c7ab689bd835707f11dc9ba1de6243553c19a018b5ac5ce2b5bea29894821b28
-
\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeFilesize
92KB
MD57eb4233a4a3df7d2207c1ca29d0b8add
SHA12f3800b389b4cdb1e667f28a2cc121421c9a22fb
SHA256995eeec0f1613e80de44f5c857aefbb41e40e1d2beff9ab56f0eceac05cb6d68
SHA5123dd00da7e40e7864be978f772a9aa5499d9c723c505f9c0002ff5a5077b50974c7ab689bd835707f11dc9ba1de6243553c19a018b5ac5ce2b5bea29894821b28
-
\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeFilesize
92KB
MD57eb4233a4a3df7d2207c1ca29d0b8add
SHA12f3800b389b4cdb1e667f28a2cc121421c9a22fb
SHA256995eeec0f1613e80de44f5c857aefbb41e40e1d2beff9ab56f0eceac05cb6d68
SHA5123dd00da7e40e7864be978f772a9aa5499d9c723c505f9c0002ff5a5077b50974c7ab689bd835707f11dc9ba1de6243553c19a018b5ac5ce2b5bea29894821b28
-
\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeFilesize
92KB
MD57eb4233a4a3df7d2207c1ca29d0b8add
SHA12f3800b389b4cdb1e667f28a2cc121421c9a22fb
SHA256995eeec0f1613e80de44f5c857aefbb41e40e1d2beff9ab56f0eceac05cb6d68
SHA5123dd00da7e40e7864be978f772a9aa5499d9c723c505f9c0002ff5a5077b50974c7ab689bd835707f11dc9ba1de6243553c19a018b5ac5ce2b5bea29894821b28
-
\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeFilesize
92KB
MD57eb4233a4a3df7d2207c1ca29d0b8add
SHA12f3800b389b4cdb1e667f28a2cc121421c9a22fb
SHA256995eeec0f1613e80de44f5c857aefbb41e40e1d2beff9ab56f0eceac05cb6d68
SHA5123dd00da7e40e7864be978f772a9aa5499d9c723c505f9c0002ff5a5077b50974c7ab689bd835707f11dc9ba1de6243553c19a018b5ac5ce2b5bea29894821b28