Analysis
-
max time kernel
144s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
03-11-2023 05:31
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.0e38859ac856073a7cc3b8b0836b6d80_JC.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.0e38859ac856073a7cc3b8b0836b6d80_JC.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.0e38859ac856073a7cc3b8b0836b6d80_JC.exe
-
Size
72KB
-
MD5
0e38859ac856073a7cc3b8b0836b6d80
-
SHA1
f6ca31c6f1dc8eb06e45a7caeaa79e1542014e48
-
SHA256
87f1a43195ed5c9737128c532c158ef7847dccb0f58852f6f99c4d6e48653402
-
SHA512
5c61fe55d776c9a39b2a031ddf2bb72c0b718cfebc8fb1869af6f734e475579c6cb0345ffab8441f3e656e9cd2e7be5eb4136ec970f5216fb8a094a943b8c836
-
SSDEEP
768:q7Xezc/T6Zp14hyYtoVxYF9mHfCBJTAIO3OtYVW6Qptwyp:G6zqhyYtkYW/CPnO3ajwyp
Malware Config
Extracted
sakula
http://www.we11point.com:443/view.asp?cookie=%s&type=%d&vid=%d
http://www.we11point.com:443/photo/%s.jpg?vid=%d
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 4416 MediaCenter.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
NEAS.0e38859ac856073a7cc3b8b0836b6d80_JC.execmd.execmd.exedescription pid process target process PID 4044 wrote to memory of 4236 4044 NEAS.0e38859ac856073a7cc3b8b0836b6d80_JC.exe cmd.exe PID 4044 wrote to memory of 4236 4044 NEAS.0e38859ac856073a7cc3b8b0836b6d80_JC.exe cmd.exe PID 4044 wrote to memory of 4236 4044 NEAS.0e38859ac856073a7cc3b8b0836b6d80_JC.exe cmd.exe PID 4044 wrote to memory of 4416 4044 NEAS.0e38859ac856073a7cc3b8b0836b6d80_JC.exe MediaCenter.exe PID 4044 wrote to memory of 4416 4044 NEAS.0e38859ac856073a7cc3b8b0836b6d80_JC.exe MediaCenter.exe PID 4044 wrote to memory of 4416 4044 NEAS.0e38859ac856073a7cc3b8b0836b6d80_JC.exe MediaCenter.exe PID 4236 wrote to memory of 4292 4236 cmd.exe reg.exe PID 4236 wrote to memory of 4292 4236 cmd.exe reg.exe PID 4236 wrote to memory of 4292 4236 cmd.exe reg.exe PID 4044 wrote to memory of 4296 4044 NEAS.0e38859ac856073a7cc3b8b0836b6d80_JC.exe cmd.exe PID 4044 wrote to memory of 4296 4044 NEAS.0e38859ac856073a7cc3b8b0836b6d80_JC.exe cmd.exe PID 4044 wrote to memory of 4296 4044 NEAS.0e38859ac856073a7cc3b8b0836b6d80_JC.exe cmd.exe PID 4296 wrote to memory of 4136 4296 cmd.exe PING.EXE PID 4296 wrote to memory of 4136 4296 cmd.exe PING.EXE PID 4296 wrote to memory of 4136 4296 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.0e38859ac856073a7cc3b8b0836b6d80_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.0e38859ac856073a7cc3b8b0836b6d80_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:4416 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\NEAS.0e38859ac856073a7cc3b8b0836b6d80_JC.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:4136
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
72KB
MD5b1d5ebd78002c447bc78bda5b69ed500
SHA1ca588affdffeb54cccd297477c698e144541cd5f
SHA2560c04be0b633e1486618d06b598fddcf7c66ff5a971f1d4f88758d306ad438487
SHA51255fa870dc5ff3e879190fa6451e7d6a21c6aac0b075c5c1afff304de28a692c1b0e2af27dffad234971f5c3b9587d98ffd22b81c98a953ff7f4545c4a6937a8b
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
72KB
MD5b1d5ebd78002c447bc78bda5b69ed500
SHA1ca588affdffeb54cccd297477c698e144541cd5f
SHA2560c04be0b633e1486618d06b598fddcf7c66ff5a971f1d4f88758d306ad438487
SHA51255fa870dc5ff3e879190fa6451e7d6a21c6aac0b075c5c1afff304de28a692c1b0e2af27dffad234971f5c3b9587d98ffd22b81c98a953ff7f4545c4a6937a8b
-
memory/4044-0-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/4044-1-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/4044-6-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB