Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
03-11-2023 12:06
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.ea9771cc9b21b2390d684fed3eb5ae90.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.ea9771cc9b21b2390d684fed3eb5ae90.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.ea9771cc9b21b2390d684fed3eb5ae90.exe
-
Size
40KB
-
MD5
ea9771cc9b21b2390d684fed3eb5ae90
-
SHA1
b3572c8a9ee0440a37092091ee8c3868a2b9a331
-
SHA256
6b6c1d533920561ebfc89ce7657be981ec08b8b7aaab907866c900f44db7b7fb
-
SHA512
33bc6ee6dd182b1ba001ba48081a1825299e9c9f355690ebbd55bd58b5647e52c13ec2ba638d244a64885febb512d7b07017a9fe3a7d1061cf59ba17a5ca173d
-
SSDEEP
768:q7Xezc/T6Zp14hyYtoVxYF9mHfCBJTAIO3OtYVW:G6zqhyYtkYW/CPnO3O
Malware Config
Extracted
sakula
http://www.we11point.com:443/view.asp?cookie=%s&type=%d&vid=%d
http://www.we11point.com:443/photo/%s.jpg?vid=%d
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 3776 MediaCenter.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
NEAS.ea9771cc9b21b2390d684fed3eb5ae90.execmd.execmd.exedescription pid process target process PID 3148 wrote to memory of 1884 3148 NEAS.ea9771cc9b21b2390d684fed3eb5ae90.exe cmd.exe PID 3148 wrote to memory of 1884 3148 NEAS.ea9771cc9b21b2390d684fed3eb5ae90.exe cmd.exe PID 3148 wrote to memory of 1884 3148 NEAS.ea9771cc9b21b2390d684fed3eb5ae90.exe cmd.exe PID 3148 wrote to memory of 3776 3148 NEAS.ea9771cc9b21b2390d684fed3eb5ae90.exe MediaCenter.exe PID 3148 wrote to memory of 3776 3148 NEAS.ea9771cc9b21b2390d684fed3eb5ae90.exe MediaCenter.exe PID 3148 wrote to memory of 3776 3148 NEAS.ea9771cc9b21b2390d684fed3eb5ae90.exe MediaCenter.exe PID 1884 wrote to memory of 4836 1884 cmd.exe reg.exe PID 1884 wrote to memory of 4836 1884 cmd.exe reg.exe PID 1884 wrote to memory of 4836 1884 cmd.exe reg.exe PID 3148 wrote to memory of 2792 3148 NEAS.ea9771cc9b21b2390d684fed3eb5ae90.exe cmd.exe PID 3148 wrote to memory of 2792 3148 NEAS.ea9771cc9b21b2390d684fed3eb5ae90.exe cmd.exe PID 3148 wrote to memory of 2792 3148 NEAS.ea9771cc9b21b2390d684fed3eb5ae90.exe cmd.exe PID 2792 wrote to memory of 1800 2792 cmd.exe PING.EXE PID 2792 wrote to memory of 1800 2792 cmd.exe PING.EXE PID 2792 wrote to memory of 1800 2792 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.ea9771cc9b21b2390d684fed3eb5ae90.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.ea9771cc9b21b2390d684fed3eb5ae90.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:3776 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\NEAS.ea9771cc9b21b2390d684fed3eb5ae90.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:1800
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
40KB
MD50b0b5bb3ba950792b85b39250172a31e
SHA1bce14a9b0f19e7a38c2abd73c053596437b3160a
SHA25654b9bc88072f6417b614a97083bac99493eb1b2cd681441a7a185af45d220b92
SHA512ee53055443eb37061f1e7a7dcf258daf0661c3b64de37bab44b3f70e028796f84c6c22534803cdd4c396d6307655238e4a00e24b27fb288380e64a0262d7a6db
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
40KB
MD50b0b5bb3ba950792b85b39250172a31e
SHA1bce14a9b0f19e7a38c2abd73c053596437b3160a
SHA25654b9bc88072f6417b614a97083bac99493eb1b2cd681441a7a185af45d220b92
SHA512ee53055443eb37061f1e7a7dcf258daf0661c3b64de37bab44b3f70e028796f84c6c22534803cdd4c396d6307655238e4a00e24b27fb288380e64a0262d7a6db
-
memory/3148-0-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/3148-1-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/3148-2-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/3148-7-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB