Analysis
-
max time kernel
143s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
06-11-2023 02:44
Behavioral task
behavioral1
Sample
d322350efa8c513a6ed3c02cbd435410.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
d322350efa8c513a6ed3c02cbd435410.exe
Resource
win10v2004-20231020-en
General
-
Target
d322350efa8c513a6ed3c02cbd435410.exe
-
Size
99KB
-
MD5
d322350efa8c513a6ed3c02cbd435410
-
SHA1
948b0bc40a2c72f7ee6bfcd868b464af37c66568
-
SHA256
0276dca5c4a120c292df8bbcd04d25a1cda47c8697e0f1177b919b73f429451a
-
SHA512
6816932440a47efb91be776adc71d72fee283fc32200e8db538c827db7a607f62697039cbafad0ca0947e54634eb355d52d238785d52f758712cdd3a60cdf5a8
-
SSDEEP
1536:Roaj1hJL1S9t0MIeboal8bCKxo7h0RPSaml0Nz30rtrC8:i0hpgz6xGhpamyF30B+8
Malware Config
Signatures
-
Sakula payload 7 IoCs
Processes:
resource yara_rule behavioral2/memory/4436-0-0x0000000000400000-0x000000000041B000-memory.dmp family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula behavioral2/memory/3416-4-0x0000000000400000-0x000000000041B000-memory.dmp family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula behavioral2/memory/4436-6-0x0000000000400000-0x000000000041B000-memory.dmp family_sakula behavioral2/memory/3416-7-0x0000000000400000-0x000000000041B000-memory.dmp family_sakula behavioral2/memory/4436-8-0x0000000000400000-0x000000000041B000-memory.dmp family_sakula -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
d322350efa8c513a6ed3c02cbd435410.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation d322350efa8c513a6ed3c02cbd435410.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 3416 MediaCenter.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
d322350efa8c513a6ed3c02cbd435410.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" d322350efa8c513a6ed3c02cbd435410.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
d322350efa8c513a6ed3c02cbd435410.exedescription pid process Token: SeIncBasePriorityPrivilege 4436 d322350efa8c513a6ed3c02cbd435410.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
d322350efa8c513a6ed3c02cbd435410.execmd.exedescription pid process target process PID 4436 wrote to memory of 3416 4436 d322350efa8c513a6ed3c02cbd435410.exe MediaCenter.exe PID 4436 wrote to memory of 3416 4436 d322350efa8c513a6ed3c02cbd435410.exe MediaCenter.exe PID 4436 wrote to memory of 3416 4436 d322350efa8c513a6ed3c02cbd435410.exe MediaCenter.exe PID 4436 wrote to memory of 4528 4436 d322350efa8c513a6ed3c02cbd435410.exe cmd.exe PID 4436 wrote to memory of 4528 4436 d322350efa8c513a6ed3c02cbd435410.exe cmd.exe PID 4436 wrote to memory of 4528 4436 d322350efa8c513a6ed3c02cbd435410.exe cmd.exe PID 4528 wrote to memory of 2524 4528 cmd.exe PING.EXE PID 4528 wrote to memory of 2524 4528 cmd.exe PING.EXE PID 4528 wrote to memory of 2524 4528 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\d322350efa8c513a6ed3c02cbd435410.exe"C:\Users\Admin\AppData\Local\Temp\d322350efa8c513a6ed3c02cbd435410.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:3416 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\d322350efa8c513a6ed3c02cbd435410.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:2524
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
99KB
MD596dd672a66973f06b727b93ee03a3a20
SHA1ef9ca60ac2ae8bfc8c0d4518cf39b00ec4a73e79
SHA2565ce82e5f624d11c15bb394834608ec8bf316c72fe22a3228500f8debc8540b5e
SHA512800bcd6b3893fae869c8f0c19ad6c64b993aec0c55f009c6a87e8e1a639ab35cfd0db0ac36c2d63561440cb03effd9b6d678672ae6ca744fde29ce5018c5f127
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
99KB
MD596dd672a66973f06b727b93ee03a3a20
SHA1ef9ca60ac2ae8bfc8c0d4518cf39b00ec4a73e79
SHA2565ce82e5f624d11c15bb394834608ec8bf316c72fe22a3228500f8debc8540b5e
SHA512800bcd6b3893fae869c8f0c19ad6c64b993aec0c55f009c6a87e8e1a639ab35cfd0db0ac36c2d63561440cb03effd9b6d678672ae6ca744fde29ce5018c5f127
-
memory/3416-4-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/3416-7-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/4436-0-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/4436-6-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/4436-8-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB