Analysis
-
max time kernel
131s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
02-11-2023 16:45
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.7dfa5969ae27a365a060e56dc2c754d0.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.7dfa5969ae27a365a060e56dc2c754d0.exe
Resource
win10v2004-20231025-en
General
-
Target
NEAS.7dfa5969ae27a365a060e56dc2c754d0.exe
-
Size
37KB
-
MD5
7dfa5969ae27a365a060e56dc2c754d0
-
SHA1
945514605413723102044eb1a5ad5fb279e4f075
-
SHA256
a868366cdfed0187dac2c742006dde066183baea49f4401289d24a3589d3b64e
-
SHA512
0863c4ef05b5fbcd7c4caf3a691a01211397f2bfd9cd22fda54d88e31c97284c34f4ff197921e75ff31f8fc311d341e6c2e1b3164e25f17a76a70e2aad10b09c
-
SSDEEP
768:D7Xezc/T6Zp14hyYtoVxYF9mH8VQ1PcPW/M9zU:n6zqhyYtkYWRPTEzU
Malware Config
Extracted
sakula
http://www.we11point.com:443/view.asp?cookie=%s&type=%d&vid=%d
http://www.we11point.com:443/photo/%s.jpg?vid=%d
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2216 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 2712 MediaCenter.exe -
Loads dropped DLL 2 IoCs
Processes:
NEAS.7dfa5969ae27a365a060e56dc2c754d0.exepid process 1464 NEAS.7dfa5969ae27a365a060e56dc2c754d0.exe 1464 NEAS.7dfa5969ae27a365a060e56dc2c754d0.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
NEAS.7dfa5969ae27a365a060e56dc2c754d0.execmd.execmd.exedescription pid process target process PID 1464 wrote to memory of 2848 1464 NEAS.7dfa5969ae27a365a060e56dc2c754d0.exe cmd.exe PID 1464 wrote to memory of 2848 1464 NEAS.7dfa5969ae27a365a060e56dc2c754d0.exe cmd.exe PID 1464 wrote to memory of 2848 1464 NEAS.7dfa5969ae27a365a060e56dc2c754d0.exe cmd.exe PID 1464 wrote to memory of 2848 1464 NEAS.7dfa5969ae27a365a060e56dc2c754d0.exe cmd.exe PID 1464 wrote to memory of 2712 1464 NEAS.7dfa5969ae27a365a060e56dc2c754d0.exe MediaCenter.exe PID 1464 wrote to memory of 2712 1464 NEAS.7dfa5969ae27a365a060e56dc2c754d0.exe MediaCenter.exe PID 1464 wrote to memory of 2712 1464 NEAS.7dfa5969ae27a365a060e56dc2c754d0.exe MediaCenter.exe PID 1464 wrote to memory of 2712 1464 NEAS.7dfa5969ae27a365a060e56dc2c754d0.exe MediaCenter.exe PID 2848 wrote to memory of 2624 2848 cmd.exe reg.exe PID 2848 wrote to memory of 2624 2848 cmd.exe reg.exe PID 2848 wrote to memory of 2624 2848 cmd.exe reg.exe PID 2848 wrote to memory of 2624 2848 cmd.exe reg.exe PID 1464 wrote to memory of 2216 1464 NEAS.7dfa5969ae27a365a060e56dc2c754d0.exe cmd.exe PID 1464 wrote to memory of 2216 1464 NEAS.7dfa5969ae27a365a060e56dc2c754d0.exe cmd.exe PID 1464 wrote to memory of 2216 1464 NEAS.7dfa5969ae27a365a060e56dc2c754d0.exe cmd.exe PID 1464 wrote to memory of 2216 1464 NEAS.7dfa5969ae27a365a060e56dc2c754d0.exe cmd.exe PID 2216 wrote to memory of 2240 2216 cmd.exe PING.EXE PID 2216 wrote to memory of 2240 2216 cmd.exe PING.EXE PID 2216 wrote to memory of 2240 2216 cmd.exe PING.EXE PID 2216 wrote to memory of 2240 2216 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.7dfa5969ae27a365a060e56dc2c754d0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.7dfa5969ae27a365a060e56dc2c754d0.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:2712 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\NEAS.7dfa5969ae27a365a060e56dc2c754d0.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:2240
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
37KB
MD5bdbc030a48eafd3a7d0bb0e30b57acf0
SHA18137b4c58160956bdf3e9a78f36e54b1201cd363
SHA2565bd679f39c0f4ea266736669b3703b009420fb1fb824b98406476ce886ecc972
SHA512a9164216087ad89571b869c76f3c38ef1df8d82da18bc84e475c6d68e7e2a26ad29275da35813c94e5012c905f6e36470152f40de562d8b9d7af000e5468bd10
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
37KB
MD5bdbc030a48eafd3a7d0bb0e30b57acf0
SHA18137b4c58160956bdf3e9a78f36e54b1201cd363
SHA2565bd679f39c0f4ea266736669b3703b009420fb1fb824b98406476ce886ecc972
SHA512a9164216087ad89571b869c76f3c38ef1df8d82da18bc84e475c6d68e7e2a26ad29275da35813c94e5012c905f6e36470152f40de562d8b9d7af000e5468bd10
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
37KB
MD5bdbc030a48eafd3a7d0bb0e30b57acf0
SHA18137b4c58160956bdf3e9a78f36e54b1201cd363
SHA2565bd679f39c0f4ea266736669b3703b009420fb1fb824b98406476ce886ecc972
SHA512a9164216087ad89571b869c76f3c38ef1df8d82da18bc84e475c6d68e7e2a26ad29275da35813c94e5012c905f6e36470152f40de562d8b9d7af000e5468bd10
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
37KB
MD5bdbc030a48eafd3a7d0bb0e30b57acf0
SHA18137b4c58160956bdf3e9a78f36e54b1201cd363
SHA2565bd679f39c0f4ea266736669b3703b009420fb1fb824b98406476ce886ecc972
SHA512a9164216087ad89571b869c76f3c38ef1df8d82da18bc84e475c6d68e7e2a26ad29275da35813c94e5012c905f6e36470152f40de562d8b9d7af000e5468bd10
-
memory/1464-0-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/1464-2-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB