Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
06-11-2023 00:06
Behavioral task
behavioral1
Sample
NEAS.046f57ee81dbd6fe4b204c12a9a4cc20.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.046f57ee81dbd6fe4b204c12a9a4cc20.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.046f57ee81dbd6fe4b204c12a9a4cc20.exe
-
Size
92KB
-
MD5
046f57ee81dbd6fe4b204c12a9a4cc20
-
SHA1
803766b6ff668ba07274e1c513c74e004ce4ab0a
-
SHA256
41d34efe0f87230408f3f04f38c462d8370d60142bbe527900bef0d67dffc320
-
SHA512
a41448a619aa222a2c34367cb9ff276460ba14ee20721f74c5ba096141e2c25f36fff9bb9b36ec49f42eb3fa9f709795de56485df27a47164e6c839d93a0f0d0
-
SSDEEP
1536:TJbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtrP:9bfVk29te2jqxCEtg30B7
Malware Config
Extracted
sakula
www.savmpet.com
Signatures
-
Sakula payload 6 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula \Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula \Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula \Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2732 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
AdobeUpdate.exepid process 2332 AdobeUpdate.exe -
Loads dropped DLL 4 IoCs
Processes:
NEAS.046f57ee81dbd6fe4b204c12a9a4cc20.exeAdobeUpdate.exepid process 1888 NEAS.046f57ee81dbd6fe4b204c12a9a4cc20.exe 2332 AdobeUpdate.exe 2332 AdobeUpdate.exe 2332 AdobeUpdate.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
NEAS.046f57ee81dbd6fe4b204c12a9a4cc20.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AdobeUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\AdobeUpdate.exe" NEAS.046f57ee81dbd6fe4b204c12a9a4cc20.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
NEAS.046f57ee81dbd6fe4b204c12a9a4cc20.exedescription pid process Token: SeIncBasePriorityPrivilege 1888 NEAS.046f57ee81dbd6fe4b204c12a9a4cc20.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
NEAS.046f57ee81dbd6fe4b204c12a9a4cc20.execmd.exedescription pid process target process PID 1888 wrote to memory of 2332 1888 NEAS.046f57ee81dbd6fe4b204c12a9a4cc20.exe AdobeUpdate.exe PID 1888 wrote to memory of 2332 1888 NEAS.046f57ee81dbd6fe4b204c12a9a4cc20.exe AdobeUpdate.exe PID 1888 wrote to memory of 2332 1888 NEAS.046f57ee81dbd6fe4b204c12a9a4cc20.exe AdobeUpdate.exe PID 1888 wrote to memory of 2332 1888 NEAS.046f57ee81dbd6fe4b204c12a9a4cc20.exe AdobeUpdate.exe PID 1888 wrote to memory of 2332 1888 NEAS.046f57ee81dbd6fe4b204c12a9a4cc20.exe AdobeUpdate.exe PID 1888 wrote to memory of 2332 1888 NEAS.046f57ee81dbd6fe4b204c12a9a4cc20.exe AdobeUpdate.exe PID 1888 wrote to memory of 2332 1888 NEAS.046f57ee81dbd6fe4b204c12a9a4cc20.exe AdobeUpdate.exe PID 1888 wrote to memory of 2732 1888 NEAS.046f57ee81dbd6fe4b204c12a9a4cc20.exe cmd.exe PID 1888 wrote to memory of 2732 1888 NEAS.046f57ee81dbd6fe4b204c12a9a4cc20.exe cmd.exe PID 1888 wrote to memory of 2732 1888 NEAS.046f57ee81dbd6fe4b204c12a9a4cc20.exe cmd.exe PID 1888 wrote to memory of 2732 1888 NEAS.046f57ee81dbd6fe4b204c12a9a4cc20.exe cmd.exe PID 2732 wrote to memory of 2480 2732 cmd.exe PING.EXE PID 2732 wrote to memory of 2480 2732 cmd.exe PING.EXE PID 2732 wrote to memory of 2480 2732 cmd.exe PING.EXE PID 2732 wrote to memory of 2480 2732 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.046f57ee81dbd6fe4b204c12a9a4cc20.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.046f57ee81dbd6fe4b204c12a9a4cc20.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2332 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\NEAS.046f57ee81dbd6fe4b204c12a9a4cc20.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:2480
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeFilesize
92KB
MD52daa39dd5492ad5ca1d2d6d3a10f4cff
SHA13f26a1b2fc609d644145162c4ed07445c683cf26
SHA256340dade39806c742c400597c456b82926edec73e8548d0d11bde4a4564b94f0e
SHA5124e7c2ba4d7b7469b0b0d2fd1642bf7ba4877f2323e046755e5e873dc149fc3160536d5ee0d40c5c6541e6db5a015d562d59f2e62401578bc8c73f5c7b101c9f8
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeFilesize
92KB
MD52daa39dd5492ad5ca1d2d6d3a10f4cff
SHA13f26a1b2fc609d644145162c4ed07445c683cf26
SHA256340dade39806c742c400597c456b82926edec73e8548d0d11bde4a4564b94f0e
SHA5124e7c2ba4d7b7469b0b0d2fd1642bf7ba4877f2323e046755e5e873dc149fc3160536d5ee0d40c5c6541e6db5a015d562d59f2e62401578bc8c73f5c7b101c9f8
-
\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeFilesize
92KB
MD52daa39dd5492ad5ca1d2d6d3a10f4cff
SHA13f26a1b2fc609d644145162c4ed07445c683cf26
SHA256340dade39806c742c400597c456b82926edec73e8548d0d11bde4a4564b94f0e
SHA5124e7c2ba4d7b7469b0b0d2fd1642bf7ba4877f2323e046755e5e873dc149fc3160536d5ee0d40c5c6541e6db5a015d562d59f2e62401578bc8c73f5c7b101c9f8
-
\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeFilesize
92KB
MD52daa39dd5492ad5ca1d2d6d3a10f4cff
SHA13f26a1b2fc609d644145162c4ed07445c683cf26
SHA256340dade39806c742c400597c456b82926edec73e8548d0d11bde4a4564b94f0e
SHA5124e7c2ba4d7b7469b0b0d2fd1642bf7ba4877f2323e046755e5e873dc149fc3160536d5ee0d40c5c6541e6db5a015d562d59f2e62401578bc8c73f5c7b101c9f8
-
\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeFilesize
92KB
MD52daa39dd5492ad5ca1d2d6d3a10f4cff
SHA13f26a1b2fc609d644145162c4ed07445c683cf26
SHA256340dade39806c742c400597c456b82926edec73e8548d0d11bde4a4564b94f0e
SHA5124e7c2ba4d7b7469b0b0d2fd1642bf7ba4877f2323e046755e5e873dc149fc3160536d5ee0d40c5c6541e6db5a015d562d59f2e62401578bc8c73f5c7b101c9f8
-
\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeFilesize
92KB
MD52daa39dd5492ad5ca1d2d6d3a10f4cff
SHA13f26a1b2fc609d644145162c4ed07445c683cf26
SHA256340dade39806c742c400597c456b82926edec73e8548d0d11bde4a4564b94f0e
SHA5124e7c2ba4d7b7469b0b0d2fd1642bf7ba4877f2323e046755e5e873dc149fc3160536d5ee0d40c5c6541e6db5a015d562d59f2e62401578bc8c73f5c7b101c9f8