Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
06-11-2023 01:28
Behavioral task
behavioral1
Sample
326c307f43c37a2cdcfaadaf35a33080.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
326c307f43c37a2cdcfaadaf35a33080.exe
Resource
win10v2004-20231025-en
General
-
Target
326c307f43c37a2cdcfaadaf35a33080.exe
-
Size
69KB
-
MD5
326c307f43c37a2cdcfaadaf35a33080
-
SHA1
a478d7e6f296f96657abb0937c38e5ca5fe8bff7
-
SHA256
dbe292e666b3f9381b60f1711a7bd3d7362dc67b652fc0aee8720941618f1120
-
SHA512
82cee538949b502c781f358f835fd2451494bc9668de990569eb034c8e0773f0db093101d88780acdf54a00e53920eb482f3cdf45cfa4d19782f4aa6c6d1d887
-
SSDEEP
768:H7Xezc/T6Zp14hyYtoVxYBY37054VNPsED3VK2+ZtyOjgO4r9vFAg2rqn:b6zqhyYtkYSHYTjipvF22
Malware Config
Extracted
sakula
http://www.we11point.com:443/view.asp?cookie=%s&type=%d&vid=%d
http://www.we11point.com:443/photo/%s.jpg?vid=%d
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2528 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 1980 MediaCenter.exe -
Loads dropped DLL 2 IoCs
Processes:
326c307f43c37a2cdcfaadaf35a33080.exepid process 2864 326c307f43c37a2cdcfaadaf35a33080.exe 2864 326c307f43c37a2cdcfaadaf35a33080.exe -
Processes:
resource yara_rule behavioral1/memory/2864-0-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral1/memory/2864-1-0x0000000000400000-0x000000000040C000-memory.dmp upx \Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe upx C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe upx \Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe upx C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe upx behavioral1/memory/1980-12-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral1/memory/2864-13-0x0000000000400000-0x000000000040C000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
326c307f43c37a2cdcfaadaf35a33080.execmd.execmd.exedescription pid process target process PID 2864 wrote to memory of 2576 2864 326c307f43c37a2cdcfaadaf35a33080.exe cmd.exe PID 2864 wrote to memory of 2576 2864 326c307f43c37a2cdcfaadaf35a33080.exe cmd.exe PID 2864 wrote to memory of 2576 2864 326c307f43c37a2cdcfaadaf35a33080.exe cmd.exe PID 2864 wrote to memory of 2576 2864 326c307f43c37a2cdcfaadaf35a33080.exe cmd.exe PID 2864 wrote to memory of 1980 2864 326c307f43c37a2cdcfaadaf35a33080.exe MediaCenter.exe PID 2864 wrote to memory of 1980 2864 326c307f43c37a2cdcfaadaf35a33080.exe MediaCenter.exe PID 2864 wrote to memory of 1980 2864 326c307f43c37a2cdcfaadaf35a33080.exe MediaCenter.exe PID 2864 wrote to memory of 1980 2864 326c307f43c37a2cdcfaadaf35a33080.exe MediaCenter.exe PID 2576 wrote to memory of 2636 2576 cmd.exe reg.exe PID 2576 wrote to memory of 2636 2576 cmd.exe reg.exe PID 2576 wrote to memory of 2636 2576 cmd.exe reg.exe PID 2576 wrote to memory of 2636 2576 cmd.exe reg.exe PID 2864 wrote to memory of 2528 2864 326c307f43c37a2cdcfaadaf35a33080.exe cmd.exe PID 2864 wrote to memory of 2528 2864 326c307f43c37a2cdcfaadaf35a33080.exe cmd.exe PID 2864 wrote to memory of 2528 2864 326c307f43c37a2cdcfaadaf35a33080.exe cmd.exe PID 2864 wrote to memory of 2528 2864 326c307f43c37a2cdcfaadaf35a33080.exe cmd.exe PID 2528 wrote to memory of 1320 2528 cmd.exe PING.EXE PID 2528 wrote to memory of 1320 2528 cmd.exe PING.EXE PID 2528 wrote to memory of 1320 2528 cmd.exe PING.EXE PID 2528 wrote to memory of 1320 2528 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\326c307f43c37a2cdcfaadaf35a33080.exe"C:\Users\Admin\AppData\Local\Temp\326c307f43c37a2cdcfaadaf35a33080.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:1980 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\326c307f43c37a2cdcfaadaf35a33080.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:1320
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
69KB
MD5e85d961cb5f99527608009a3e6a80022
SHA16ffa44b9b6ac5c33a03532a6adc30cd1e3f2360c
SHA256bcd7bd2d58d687b88bf55cd9eff08409a30ce5397586f99ff498d6153b0a5d94
SHA51261606ac28814e424a97156147da1d426eaee62834a7847e95be9f64c065539a8889bcc45fa59fa918e2e9de01a072fd33a35abc3bb96a4bc4badcd2058f2f7cf
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
69KB
MD5e85d961cb5f99527608009a3e6a80022
SHA16ffa44b9b6ac5c33a03532a6adc30cd1e3f2360c
SHA256bcd7bd2d58d687b88bf55cd9eff08409a30ce5397586f99ff498d6153b0a5d94
SHA51261606ac28814e424a97156147da1d426eaee62834a7847e95be9f64c065539a8889bcc45fa59fa918e2e9de01a072fd33a35abc3bb96a4bc4badcd2058f2f7cf
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
69KB
MD5e85d961cb5f99527608009a3e6a80022
SHA16ffa44b9b6ac5c33a03532a6adc30cd1e3f2360c
SHA256bcd7bd2d58d687b88bf55cd9eff08409a30ce5397586f99ff498d6153b0a5d94
SHA51261606ac28814e424a97156147da1d426eaee62834a7847e95be9f64c065539a8889bcc45fa59fa918e2e9de01a072fd33a35abc3bb96a4bc4badcd2058f2f7cf
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
69KB
MD5e85d961cb5f99527608009a3e6a80022
SHA16ffa44b9b6ac5c33a03532a6adc30cd1e3f2360c
SHA256bcd7bd2d58d687b88bf55cd9eff08409a30ce5397586f99ff498d6153b0a5d94
SHA51261606ac28814e424a97156147da1d426eaee62834a7847e95be9f64c065539a8889bcc45fa59fa918e2e9de01a072fd33a35abc3bb96a4bc4badcd2058f2f7cf
-
memory/1980-12-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2864-0-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2864-1-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/2864-5-0x0000000000220000-0x000000000022C000-memory.dmpFilesize
48KB
-
memory/2864-10-0x0000000000220000-0x000000000022C000-memory.dmpFilesize
48KB
-
memory/2864-13-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB