Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
01-11-2023 14:23
Behavioral task
behavioral1
Sample
NEAS.eba4cdc0e44a700cc86432eeefd82f40.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.eba4cdc0e44a700cc86432eeefd82f40.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.eba4cdc0e44a700cc86432eeefd82f40.exe
-
Size
99KB
-
MD5
eba4cdc0e44a700cc86432eeefd82f40
-
SHA1
cbb38653fced9ffd4b78daf20ae7be82222322be
-
SHA256
5d9b5be7fb44448822ccf9e020c8f0ad2790f3df5d2f84e8b680b78168350bfe
-
SHA512
371ced12fcae4754e4e0f809b93cc3c2bbdb8168cf7cb936b229d9d39b0185e14cf5270e6893f2d89e1346b00e701e1884419df40f4a82398f3c5513005a6662
-
SSDEEP
1536:Loaj1hJL1S9t0MIeboal8bCKxo7h0RPaaml0Nz30rtrtx7:c0hpgz6xGhZamyF30B5x7
Malware Config
Signatures
-
Sakula payload 10 IoCs
Processes:
resource yara_rule behavioral1/memory/2952-0-0x0000000000400000-0x000000000041B000-memory.dmp family_sakula \Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula \Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula behavioral1/memory/2952-4-0x00000000003D0000-0x00000000003EB000-memory.dmp family_sakula behavioral1/memory/2824-11-0x0000000000400000-0x000000000041B000-memory.dmp family_sakula behavioral1/memory/2952-12-0x0000000000400000-0x000000000041B000-memory.dmp family_sakula behavioral1/memory/2824-15-0x0000000000400000-0x000000000041B000-memory.dmp family_sakula behavioral1/memory/2952-16-0x0000000000400000-0x000000000041B000-memory.dmp family_sakula -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2596 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 2824 MediaCenter.exe -
Loads dropped DLL 2 IoCs
Processes:
NEAS.eba4cdc0e44a700cc86432eeefd82f40.exepid process 2952 NEAS.eba4cdc0e44a700cc86432eeefd82f40.exe 2952 NEAS.eba4cdc0e44a700cc86432eeefd82f40.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
NEAS.eba4cdc0e44a700cc86432eeefd82f40.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" NEAS.eba4cdc0e44a700cc86432eeefd82f40.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
NEAS.eba4cdc0e44a700cc86432eeefd82f40.exedescription pid process Token: SeIncBasePriorityPrivilege 2952 NEAS.eba4cdc0e44a700cc86432eeefd82f40.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
NEAS.eba4cdc0e44a700cc86432eeefd82f40.execmd.exedescription pid process target process PID 2952 wrote to memory of 2824 2952 NEAS.eba4cdc0e44a700cc86432eeefd82f40.exe MediaCenter.exe PID 2952 wrote to memory of 2824 2952 NEAS.eba4cdc0e44a700cc86432eeefd82f40.exe MediaCenter.exe PID 2952 wrote to memory of 2824 2952 NEAS.eba4cdc0e44a700cc86432eeefd82f40.exe MediaCenter.exe PID 2952 wrote to memory of 2824 2952 NEAS.eba4cdc0e44a700cc86432eeefd82f40.exe MediaCenter.exe PID 2952 wrote to memory of 2596 2952 NEAS.eba4cdc0e44a700cc86432eeefd82f40.exe cmd.exe PID 2952 wrote to memory of 2596 2952 NEAS.eba4cdc0e44a700cc86432eeefd82f40.exe cmd.exe PID 2952 wrote to memory of 2596 2952 NEAS.eba4cdc0e44a700cc86432eeefd82f40.exe cmd.exe PID 2952 wrote to memory of 2596 2952 NEAS.eba4cdc0e44a700cc86432eeefd82f40.exe cmd.exe PID 2596 wrote to memory of 2728 2596 cmd.exe PING.EXE PID 2596 wrote to memory of 2728 2596 cmd.exe PING.EXE PID 2596 wrote to memory of 2728 2596 cmd.exe PING.EXE PID 2596 wrote to memory of 2728 2596 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.eba4cdc0e44a700cc86432eeefd82f40.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.eba4cdc0e44a700cc86432eeefd82f40.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:2824 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\NEAS.eba4cdc0e44a700cc86432eeefd82f40.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:2728
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
99KB
MD5f7b5571b8a3b42f5cce77b69e4ee480d
SHA15c4b3bbe608d9d987d47d6c059803dc67fb42958
SHA25678a46495a92c132ea91ba9e56b461edffd0110c74868c287ca10eef3fe770fb9
SHA512711a1e8e6b4b459c1c3d679a263a380ff4d5efb60f5e5d1d02277a39fd672ec4e8b84d93780cf4b32064df54a8cf543f505369024455306708d9c85e426204e2
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
99KB
MD5f7b5571b8a3b42f5cce77b69e4ee480d
SHA15c4b3bbe608d9d987d47d6c059803dc67fb42958
SHA25678a46495a92c132ea91ba9e56b461edffd0110c74868c287ca10eef3fe770fb9
SHA512711a1e8e6b4b459c1c3d679a263a380ff4d5efb60f5e5d1d02277a39fd672ec4e8b84d93780cf4b32064df54a8cf543f505369024455306708d9c85e426204e2
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
99KB
MD5f7b5571b8a3b42f5cce77b69e4ee480d
SHA15c4b3bbe608d9d987d47d6c059803dc67fb42958
SHA25678a46495a92c132ea91ba9e56b461edffd0110c74868c287ca10eef3fe770fb9
SHA512711a1e8e6b4b459c1c3d679a263a380ff4d5efb60f5e5d1d02277a39fd672ec4e8b84d93780cf4b32064df54a8cf543f505369024455306708d9c85e426204e2
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
99KB
MD5f7b5571b8a3b42f5cce77b69e4ee480d
SHA15c4b3bbe608d9d987d47d6c059803dc67fb42958
SHA25678a46495a92c132ea91ba9e56b461edffd0110c74868c287ca10eef3fe770fb9
SHA512711a1e8e6b4b459c1c3d679a263a380ff4d5efb60f5e5d1d02277a39fd672ec4e8b84d93780cf4b32064df54a8cf543f505369024455306708d9c85e426204e2
-
memory/2824-11-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2824-15-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2952-4-0x00000000003D0000-0x00000000003EB000-memory.dmpFilesize
108KB
-
memory/2952-0-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2952-12-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2952-13-0x00000000003D0000-0x00000000003EB000-memory.dmpFilesize
108KB
-
memory/2952-14-0x00000000003D0000-0x00000000003EB000-memory.dmpFilesize
108KB
-
memory/2952-9-0x00000000003D0000-0x00000000003EB000-memory.dmpFilesize
108KB
-
memory/2952-16-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB