Analysis
-
max time kernel
146s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20231025-en -
resource tags
arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system -
submitted
02-11-2023 16:45
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.7dfa5969ae27a365a060e56dc2c754d0.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.7dfa5969ae27a365a060e56dc2c754d0.exe
Resource
win10v2004-20231025-en
General
-
Target
NEAS.7dfa5969ae27a365a060e56dc2c754d0.exe
-
Size
37KB
-
MD5
7dfa5969ae27a365a060e56dc2c754d0
-
SHA1
945514605413723102044eb1a5ad5fb279e4f075
-
SHA256
a868366cdfed0187dac2c742006dde066183baea49f4401289d24a3589d3b64e
-
SHA512
0863c4ef05b5fbcd7c4caf3a691a01211397f2bfd9cd22fda54d88e31c97284c34f4ff197921e75ff31f8fc311d341e6c2e1b3164e25f17a76a70e2aad10b09c
-
SSDEEP
768:D7Xezc/T6Zp14hyYtoVxYF9mH8VQ1PcPW/M9zU:n6zqhyYtkYWRPTEzU
Malware Config
Extracted
sakula
http://www.we11point.com:443/view.asp?cookie=%s&type=%d&vid=%d
http://www.we11point.com:443/photo/%s.jpg?vid=%d
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 3628 MediaCenter.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
NEAS.7dfa5969ae27a365a060e56dc2c754d0.execmd.execmd.exedescription pid process target process PID 4632 wrote to memory of 3144 4632 NEAS.7dfa5969ae27a365a060e56dc2c754d0.exe cmd.exe PID 4632 wrote to memory of 3144 4632 NEAS.7dfa5969ae27a365a060e56dc2c754d0.exe cmd.exe PID 4632 wrote to memory of 3144 4632 NEAS.7dfa5969ae27a365a060e56dc2c754d0.exe cmd.exe PID 4632 wrote to memory of 3628 4632 NEAS.7dfa5969ae27a365a060e56dc2c754d0.exe MediaCenter.exe PID 4632 wrote to memory of 3628 4632 NEAS.7dfa5969ae27a365a060e56dc2c754d0.exe MediaCenter.exe PID 4632 wrote to memory of 3628 4632 NEAS.7dfa5969ae27a365a060e56dc2c754d0.exe MediaCenter.exe PID 3144 wrote to memory of 4836 3144 cmd.exe reg.exe PID 3144 wrote to memory of 4836 3144 cmd.exe reg.exe PID 3144 wrote to memory of 4836 3144 cmd.exe reg.exe PID 4632 wrote to memory of 4496 4632 NEAS.7dfa5969ae27a365a060e56dc2c754d0.exe cmd.exe PID 4632 wrote to memory of 4496 4632 NEAS.7dfa5969ae27a365a060e56dc2c754d0.exe cmd.exe PID 4632 wrote to memory of 4496 4632 NEAS.7dfa5969ae27a365a060e56dc2c754d0.exe cmd.exe PID 4496 wrote to memory of 2808 4496 cmd.exe PING.EXE PID 4496 wrote to memory of 2808 4496 cmd.exe PING.EXE PID 4496 wrote to memory of 2808 4496 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.7dfa5969ae27a365a060e56dc2c754d0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.7dfa5969ae27a365a060e56dc2c754d0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:3628 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\NEAS.7dfa5969ae27a365a060e56dc2c754d0.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:2808
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
37KB
MD557027ee52076e2ea00cb60b80e63c7b0
SHA149016e29a2d384638e3a6cfb31431734bc656139
SHA256a0d28da3f5d3cb6a79d7df71cb53d820a1fbf1737da58956a15c9d026c7a39bf
SHA51295a65426f09be662d567d8a1c6d2a64aff4508e10c56795f3e937570f9fe8728df30ac372858b9afe7c730ffc0d0836750b33f7fdf5bca5f7effe32999f3a14f
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
37KB
MD557027ee52076e2ea00cb60b80e63c7b0
SHA149016e29a2d384638e3a6cfb31431734bc656139
SHA256a0d28da3f5d3cb6a79d7df71cb53d820a1fbf1737da58956a15c9d026c7a39bf
SHA51295a65426f09be662d567d8a1c6d2a64aff4508e10c56795f3e937570f9fe8728df30ac372858b9afe7c730ffc0d0836750b33f7fdf5bca5f7effe32999f3a14f
-
memory/4632-0-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/4632-5-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB