Analysis
-
max time kernel
146s -
max time network
158s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
03-11-2023 12:06
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.ea9771cc9b21b2390d684fed3eb5ae90.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.ea9771cc9b21b2390d684fed3eb5ae90.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.ea9771cc9b21b2390d684fed3eb5ae90.exe
-
Size
40KB
-
MD5
ea9771cc9b21b2390d684fed3eb5ae90
-
SHA1
b3572c8a9ee0440a37092091ee8c3868a2b9a331
-
SHA256
6b6c1d533920561ebfc89ce7657be981ec08b8b7aaab907866c900f44db7b7fb
-
SHA512
33bc6ee6dd182b1ba001ba48081a1825299e9c9f355690ebbd55bd58b5647e52c13ec2ba638d244a64885febb512d7b07017a9fe3a7d1061cf59ba17a5ca173d
-
SSDEEP
768:q7Xezc/T6Zp14hyYtoVxYF9mHfCBJTAIO3OtYVW:G6zqhyYtkYW/CPnO3O
Malware Config
Extracted
sakula
http://www.we11point.com:443/view.asp?cookie=%s&type=%d&vid=%d
http://www.we11point.com:443/photo/%s.jpg?vid=%d
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2588 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 2432 MediaCenter.exe -
Loads dropped DLL 2 IoCs
Processes:
NEAS.ea9771cc9b21b2390d684fed3eb5ae90.exepid process 2356 NEAS.ea9771cc9b21b2390d684fed3eb5ae90.exe 2356 NEAS.ea9771cc9b21b2390d684fed3eb5ae90.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
NEAS.ea9771cc9b21b2390d684fed3eb5ae90.execmd.execmd.exedescription pid process target process PID 2356 wrote to memory of 2256 2356 NEAS.ea9771cc9b21b2390d684fed3eb5ae90.exe cmd.exe PID 2356 wrote to memory of 2256 2356 NEAS.ea9771cc9b21b2390d684fed3eb5ae90.exe cmd.exe PID 2356 wrote to memory of 2256 2356 NEAS.ea9771cc9b21b2390d684fed3eb5ae90.exe cmd.exe PID 2356 wrote to memory of 2256 2356 NEAS.ea9771cc9b21b2390d684fed3eb5ae90.exe cmd.exe PID 2356 wrote to memory of 2432 2356 NEAS.ea9771cc9b21b2390d684fed3eb5ae90.exe MediaCenter.exe PID 2356 wrote to memory of 2432 2356 NEAS.ea9771cc9b21b2390d684fed3eb5ae90.exe MediaCenter.exe PID 2356 wrote to memory of 2432 2356 NEAS.ea9771cc9b21b2390d684fed3eb5ae90.exe MediaCenter.exe PID 2356 wrote to memory of 2432 2356 NEAS.ea9771cc9b21b2390d684fed3eb5ae90.exe MediaCenter.exe PID 2256 wrote to memory of 2116 2256 cmd.exe reg.exe PID 2256 wrote to memory of 2116 2256 cmd.exe reg.exe PID 2256 wrote to memory of 2116 2256 cmd.exe reg.exe PID 2256 wrote to memory of 2116 2256 cmd.exe reg.exe PID 2356 wrote to memory of 2588 2356 NEAS.ea9771cc9b21b2390d684fed3eb5ae90.exe cmd.exe PID 2356 wrote to memory of 2588 2356 NEAS.ea9771cc9b21b2390d684fed3eb5ae90.exe cmd.exe PID 2356 wrote to memory of 2588 2356 NEAS.ea9771cc9b21b2390d684fed3eb5ae90.exe cmd.exe PID 2356 wrote to memory of 2588 2356 NEAS.ea9771cc9b21b2390d684fed3eb5ae90.exe cmd.exe PID 2588 wrote to memory of 2644 2588 cmd.exe PING.EXE PID 2588 wrote to memory of 2644 2588 cmd.exe PING.EXE PID 2588 wrote to memory of 2644 2588 cmd.exe PING.EXE PID 2588 wrote to memory of 2644 2588 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.ea9771cc9b21b2390d684fed3eb5ae90.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.ea9771cc9b21b2390d684fed3eb5ae90.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:2432 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\NEAS.ea9771cc9b21b2390d684fed3eb5ae90.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:2644
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
40KB
MD5b3eba78f01ca3b78a4e88f82c3c8af06
SHA15b42cebf0c9bbfe49e6e7d3f5a1405bc25f02f48
SHA256cf1e2da5479099c4681cf7151975ad176fb451d168e3a636c71c65a898936130
SHA512ae8b9673324d073fe448ac94d611970a7cdca3299f568063ed604a14f8e22d9a9cd465abe302a05fb42892fc6f6a843f2236c4930f1103e9ab4a49d0749dcdbf
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
40KB
MD5b3eba78f01ca3b78a4e88f82c3c8af06
SHA15b42cebf0c9bbfe49e6e7d3f5a1405bc25f02f48
SHA256cf1e2da5479099c4681cf7151975ad176fb451d168e3a636c71c65a898936130
SHA512ae8b9673324d073fe448ac94d611970a7cdca3299f568063ed604a14f8e22d9a9cd465abe302a05fb42892fc6f6a843f2236c4930f1103e9ab4a49d0749dcdbf
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
40KB
MD5b3eba78f01ca3b78a4e88f82c3c8af06
SHA15b42cebf0c9bbfe49e6e7d3f5a1405bc25f02f48
SHA256cf1e2da5479099c4681cf7151975ad176fb451d168e3a636c71c65a898936130
SHA512ae8b9673324d073fe448ac94d611970a7cdca3299f568063ed604a14f8e22d9a9cd465abe302a05fb42892fc6f6a843f2236c4930f1103e9ab4a49d0749dcdbf
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
40KB
MD5b3eba78f01ca3b78a4e88f82c3c8af06
SHA15b42cebf0c9bbfe49e6e7d3f5a1405bc25f02f48
SHA256cf1e2da5479099c4681cf7151975ad176fb451d168e3a636c71c65a898936130
SHA512ae8b9673324d073fe448ac94d611970a7cdca3299f568063ed604a14f8e22d9a9cd465abe302a05fb42892fc6f6a843f2236c4930f1103e9ab4a49d0749dcdbf
-
memory/2356-0-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2356-1-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2356-9-0x00000000001B0000-0x00000000001BA000-memory.dmpFilesize
40KB
-
memory/2356-12-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2356-13-0x00000000001B0000-0x00000000001BA000-memory.dmpFilesize
40KB
-
memory/2432-11-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB