Analysis
-
max time kernel
119s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20231025-en -
resource tags
arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system -
submitted
05-11-2023 16:24
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.e4633b1c8db6eed9acbd3090a7a5a240_JC.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
NEAS.e4633b1c8db6eed9acbd3090a7a5a240_JC.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.e4633b1c8db6eed9acbd3090a7a5a240_JC.exe
-
Size
72KB
-
MD5
e4633b1c8db6eed9acbd3090a7a5a240
-
SHA1
7cf390ba421ca913ffc12768e1e19e91ef01ca56
-
SHA256
5cf037e9a2b033a901d7e05c6e9f51326d487802edb9c5a650f8c0a2b9ed486a
-
SHA512
8d5249da719d983562000a9dacbd8826bf41ee7442eee583d433974aac3fa466441bbdecbf1e48c1f3b326a9b81b9f9c78ef6f1617e193adc075178b6943dc74
-
SSDEEP
768:ehSksandb4GgyMsp4hyYtoVxYGm1ZAfPsED3VK2+ZtyOjgO4r9vFAg2rqC:eTsGpehyYtkYvnEYTjipvF2H
Malware Config
Extracted
sakula
http://vpn.premrera.com:443/viewpre.asp?cstring=%s&tom=%d&id=%d
http://vpn.premrera.com:443/photo/%s.jpg?id=%d
http://173.254.226.212:443/viewpre.asp?cstring=%s&tom=%d&id=%d
http://173.254.226.212:443/photo/%s.jpg?id=%d
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2652 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 2800 MediaCenter.exe -
Loads dropped DLL 2 IoCs
Processes:
cmd.exepid process 2372 cmd.exe 2372 cmd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
NEAS.e4633b1c8db6eed9acbd3090a7a5a240_JC.execmd.execmd.execmd.exedescription pid process target process PID 1876 wrote to memory of 2280 1876 NEAS.e4633b1c8db6eed9acbd3090a7a5a240_JC.exe cmd.exe PID 1876 wrote to memory of 2280 1876 NEAS.e4633b1c8db6eed9acbd3090a7a5a240_JC.exe cmd.exe PID 1876 wrote to memory of 2280 1876 NEAS.e4633b1c8db6eed9acbd3090a7a5a240_JC.exe cmd.exe PID 1876 wrote to memory of 2280 1876 NEAS.e4633b1c8db6eed9acbd3090a7a5a240_JC.exe cmd.exe PID 1876 wrote to memory of 2372 1876 NEAS.e4633b1c8db6eed9acbd3090a7a5a240_JC.exe cmd.exe PID 1876 wrote to memory of 2372 1876 NEAS.e4633b1c8db6eed9acbd3090a7a5a240_JC.exe cmd.exe PID 1876 wrote to memory of 2372 1876 NEAS.e4633b1c8db6eed9acbd3090a7a5a240_JC.exe cmd.exe PID 1876 wrote to memory of 2372 1876 NEAS.e4633b1c8db6eed9acbd3090a7a5a240_JC.exe cmd.exe PID 1876 wrote to memory of 2652 1876 NEAS.e4633b1c8db6eed9acbd3090a7a5a240_JC.exe cmd.exe PID 1876 wrote to memory of 2652 1876 NEAS.e4633b1c8db6eed9acbd3090a7a5a240_JC.exe cmd.exe PID 1876 wrote to memory of 2652 1876 NEAS.e4633b1c8db6eed9acbd3090a7a5a240_JC.exe cmd.exe PID 1876 wrote to memory of 2652 1876 NEAS.e4633b1c8db6eed9acbd3090a7a5a240_JC.exe cmd.exe PID 2372 wrote to memory of 2800 2372 cmd.exe MediaCenter.exe PID 2372 wrote to memory of 2800 2372 cmd.exe MediaCenter.exe PID 2372 wrote to memory of 2800 2372 cmd.exe MediaCenter.exe PID 2372 wrote to memory of 2800 2372 cmd.exe MediaCenter.exe PID 2280 wrote to memory of 2680 2280 cmd.exe reg.exe PID 2280 wrote to memory of 2680 2280 cmd.exe reg.exe PID 2280 wrote to memory of 2680 2280 cmd.exe reg.exe PID 2280 wrote to memory of 2680 2280 cmd.exe reg.exe PID 2652 wrote to memory of 1060 2652 cmd.exe PING.EXE PID 2652 wrote to memory of 1060 2652 cmd.exe PING.EXE PID 2652 wrote to memory of 1060 2652 cmd.exe PING.EXE PID 2652 wrote to memory of 1060 2652 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.e4633b1c8db6eed9acbd3090a7a5a240_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.e4633b1c8db6eed9acbd3090a7a5a240_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
PID:2680 -
C:\Windows\SysWOW64\cmd.execmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe3⤵
- Executes dropped EXE
PID:2800 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\NEAS.e4633b1c8db6eed9acbd3090a7a5a240_JC.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:1060
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
72KB
MD5e0f01742024a25e942f1517bfd497175
SHA1915e94dc7a7722ca48f84ae59462bf931644465d
SHA25632a8f98be23200c1eaa74c8407eca0b19ff8f4b74ae63f23f6a5d672a5ba35ce
SHA51280c1e59978e6ae578ba7304680d630a1aec690b91468d16b24927eaec3ed87f609519169a7ab2abb920a6718f450225c32f492ecbf341dac01ceda721a0fe4e3
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
72KB
MD5e0f01742024a25e942f1517bfd497175
SHA1915e94dc7a7722ca48f84ae59462bf931644465d
SHA25632a8f98be23200c1eaa74c8407eca0b19ff8f4b74ae63f23f6a5d672a5ba35ce
SHA51280c1e59978e6ae578ba7304680d630a1aec690b91468d16b24927eaec3ed87f609519169a7ab2abb920a6718f450225c32f492ecbf341dac01ceda721a0fe4e3
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
72KB
MD5e0f01742024a25e942f1517bfd497175
SHA1915e94dc7a7722ca48f84ae59462bf931644465d
SHA25632a8f98be23200c1eaa74c8407eca0b19ff8f4b74ae63f23f6a5d672a5ba35ce
SHA51280c1e59978e6ae578ba7304680d630a1aec690b91468d16b24927eaec3ed87f609519169a7ab2abb920a6718f450225c32f492ecbf341dac01ceda721a0fe4e3
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
72KB
MD5e0f01742024a25e942f1517bfd497175
SHA1915e94dc7a7722ca48f84ae59462bf931644465d
SHA25632a8f98be23200c1eaa74c8407eca0b19ff8f4b74ae63f23f6a5d672a5ba35ce
SHA51280c1e59978e6ae578ba7304680d630a1aec690b91468d16b24927eaec3ed87f609519169a7ab2abb920a6718f450225c32f492ecbf341dac01ceda721a0fe4e3
-
memory/1876-0-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1876-1-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1876-3-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2372-7-0x00000000001B0000-0x00000000001BC000-memory.dmpFilesize
48KB
-
memory/2372-10-0x00000000001B0000-0x00000000001BC000-memory.dmpFilesize
48KB
-
memory/2800-9-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB