Analysis
-
max time kernel
163s -
max time network
175s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
05-11-2023 19:26
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.ad43c1acf427547b5ae5835be4b231d0.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.ad43c1acf427547b5ae5835be4b231d0.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.ad43c1acf427547b5ae5835be4b231d0.exe
-
Size
72KB
-
MD5
ad43c1acf427547b5ae5835be4b231d0
-
SHA1
c461e84230957c09c7caa390a483aa9e494fe570
-
SHA256
7d02989b9ff0c2f7cb5e11d85f04aa008387c8350cd4c02e81d06eaeb2d0277f
-
SHA512
85e06ee0d1d040e59377adba211216fd98477aaf088920e3c7e040d5ec52446e9a8e90ca24a63e45ebba2d92e212aca1d403bbbc809f26c32491f5c6f2c6a6b2
-
SSDEEP
768:q7Xezc/T6Zp14hyYtoVxYF9mHfCBJTAIO3OtYVW6QptwyV:G6zqhyYtkYW/CPnO3ajwyV
Malware Config
Extracted
sakula
http://www.we11point.com:443/view.asp?cookie=%s&type=%d&vid=%d
http://www.we11point.com:443/photo/%s.jpg?vid=%d
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 3012 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 1508 MediaCenter.exe -
Loads dropped DLL 2 IoCs
Processes:
NEAS.ad43c1acf427547b5ae5835be4b231d0.exepid process 2572 NEAS.ad43c1acf427547b5ae5835be4b231d0.exe 2572 NEAS.ad43c1acf427547b5ae5835be4b231d0.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
NEAS.ad43c1acf427547b5ae5835be4b231d0.execmd.execmd.exedescription pid process target process PID 2572 wrote to memory of 2976 2572 NEAS.ad43c1acf427547b5ae5835be4b231d0.exe cmd.exe PID 2572 wrote to memory of 2976 2572 NEAS.ad43c1acf427547b5ae5835be4b231d0.exe cmd.exe PID 2572 wrote to memory of 2976 2572 NEAS.ad43c1acf427547b5ae5835be4b231d0.exe cmd.exe PID 2572 wrote to memory of 2976 2572 NEAS.ad43c1acf427547b5ae5835be4b231d0.exe cmd.exe PID 2572 wrote to memory of 1508 2572 NEAS.ad43c1acf427547b5ae5835be4b231d0.exe MediaCenter.exe PID 2572 wrote to memory of 1508 2572 NEAS.ad43c1acf427547b5ae5835be4b231d0.exe MediaCenter.exe PID 2572 wrote to memory of 1508 2572 NEAS.ad43c1acf427547b5ae5835be4b231d0.exe MediaCenter.exe PID 2572 wrote to memory of 1508 2572 NEAS.ad43c1acf427547b5ae5835be4b231d0.exe MediaCenter.exe PID 2976 wrote to memory of 2596 2976 cmd.exe reg.exe PID 2976 wrote to memory of 2596 2976 cmd.exe reg.exe PID 2976 wrote to memory of 2596 2976 cmd.exe reg.exe PID 2976 wrote to memory of 2596 2976 cmd.exe reg.exe PID 2572 wrote to memory of 3012 2572 NEAS.ad43c1acf427547b5ae5835be4b231d0.exe cmd.exe PID 2572 wrote to memory of 3012 2572 NEAS.ad43c1acf427547b5ae5835be4b231d0.exe cmd.exe PID 2572 wrote to memory of 3012 2572 NEAS.ad43c1acf427547b5ae5835be4b231d0.exe cmd.exe PID 2572 wrote to memory of 3012 2572 NEAS.ad43c1acf427547b5ae5835be4b231d0.exe cmd.exe PID 3012 wrote to memory of 2264 3012 cmd.exe PING.EXE PID 3012 wrote to memory of 2264 3012 cmd.exe PING.EXE PID 3012 wrote to memory of 2264 3012 cmd.exe PING.EXE PID 3012 wrote to memory of 2264 3012 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.ad43c1acf427547b5ae5835be4b231d0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.ad43c1acf427547b5ae5835be4b231d0.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:1508 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\NEAS.ad43c1acf427547b5ae5835be4b231d0.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:2264
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
72KB
MD5f67da485781d397ece2429080601844f
SHA127fdb7ee444ad8d6a9095f8ab1324eec12b27d68
SHA25601ca843acb3e95c31527f04ea93a4a77860a76840a7912b6ee45f58acd44c349
SHA51226f140315b957292dd3f3add548effc960a20f66064d730c4e1e1afb2def5584007a6dbff3f79e0548f393916e9fb2b70d38449f1cc377412d63c9c005c8ebdd
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
72KB
MD5f67da485781d397ece2429080601844f
SHA127fdb7ee444ad8d6a9095f8ab1324eec12b27d68
SHA25601ca843acb3e95c31527f04ea93a4a77860a76840a7912b6ee45f58acd44c349
SHA51226f140315b957292dd3f3add548effc960a20f66064d730c4e1e1afb2def5584007a6dbff3f79e0548f393916e9fb2b70d38449f1cc377412d63c9c005c8ebdd
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
72KB
MD5f67da485781d397ece2429080601844f
SHA127fdb7ee444ad8d6a9095f8ab1324eec12b27d68
SHA25601ca843acb3e95c31527f04ea93a4a77860a76840a7912b6ee45f58acd44c349
SHA51226f140315b957292dd3f3add548effc960a20f66064d730c4e1e1afb2def5584007a6dbff3f79e0548f393916e9fb2b70d38449f1cc377412d63c9c005c8ebdd
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
72KB
MD5f67da485781d397ece2429080601844f
SHA127fdb7ee444ad8d6a9095f8ab1324eec12b27d68
SHA25601ca843acb3e95c31527f04ea93a4a77860a76840a7912b6ee45f58acd44c349
SHA51226f140315b957292dd3f3add548effc960a20f66064d730c4e1e1afb2def5584007a6dbff3f79e0548f393916e9fb2b70d38449f1cc377412d63c9c005c8ebdd
-
memory/1508-11-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1508-13-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2572-0-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2572-1-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2572-9-0x0000000000220000-0x000000000022A000-memory.dmpFilesize
40KB
-
memory/2572-12-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB