Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20231025-en -
resource tags
arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system -
submitted
06-11-2023 20:49
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.67f9bece4984c5fcb651b54510eb1eb0.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
NEAS.67f9bece4984c5fcb651b54510eb1eb0.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.67f9bece4984c5fcb651b54510eb1eb0.exe
-
Size
67KB
-
MD5
67f9bece4984c5fcb651b54510eb1eb0
-
SHA1
9bf1fcb44ad2254b84feb6473da86fbe1860bea9
-
SHA256
0f2bdc74474a6d7d904b3d77c5a7803d3fddd85a96d3a45fe6adfa3af6784bde
-
SHA512
b9bb967807ead49038aaf47dbfd5a0beaf0fffe0ab9cf179ddb2f59a707eb58c792df15c8f686bca54016c1cdf23a63d69be6dc890c929c585ea8ae0c701455a
-
SSDEEP
768:u7Xezc/T6Zp14hyYtoVxYF9mHF1yD3BmNV8PsED3VK2+ZtyOjgO4r9vFAg2rq6:a6zqhyYtkYWI3BDYTjipvF23
Malware Config
Extracted
sakula
http://www.we11point.com:443/view.asp?cookie=%s&type=%d&vid=%d
http://www.we11point.com:443/photo/%s.jpg?vid=%d
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2524 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 1432 MediaCenter.exe -
Loads dropped DLL 2 IoCs
Processes:
NEAS.67f9bece4984c5fcb651b54510eb1eb0.exepid process 796 NEAS.67f9bece4984c5fcb651b54510eb1eb0.exe 796 NEAS.67f9bece4984c5fcb651b54510eb1eb0.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
NEAS.67f9bece4984c5fcb651b54510eb1eb0.execmd.execmd.exedescription pid process target process PID 796 wrote to memory of 2968 796 NEAS.67f9bece4984c5fcb651b54510eb1eb0.exe cmd.exe PID 796 wrote to memory of 2968 796 NEAS.67f9bece4984c5fcb651b54510eb1eb0.exe cmd.exe PID 796 wrote to memory of 2968 796 NEAS.67f9bece4984c5fcb651b54510eb1eb0.exe cmd.exe PID 796 wrote to memory of 2968 796 NEAS.67f9bece4984c5fcb651b54510eb1eb0.exe cmd.exe PID 796 wrote to memory of 1432 796 NEAS.67f9bece4984c5fcb651b54510eb1eb0.exe MediaCenter.exe PID 796 wrote to memory of 1432 796 NEAS.67f9bece4984c5fcb651b54510eb1eb0.exe MediaCenter.exe PID 796 wrote to memory of 1432 796 NEAS.67f9bece4984c5fcb651b54510eb1eb0.exe MediaCenter.exe PID 796 wrote to memory of 1432 796 NEAS.67f9bece4984c5fcb651b54510eb1eb0.exe MediaCenter.exe PID 2968 wrote to memory of 1788 2968 cmd.exe reg.exe PID 2968 wrote to memory of 1788 2968 cmd.exe reg.exe PID 2968 wrote to memory of 1788 2968 cmd.exe reg.exe PID 2968 wrote to memory of 1788 2968 cmd.exe reg.exe PID 796 wrote to memory of 2524 796 NEAS.67f9bece4984c5fcb651b54510eb1eb0.exe cmd.exe PID 796 wrote to memory of 2524 796 NEAS.67f9bece4984c5fcb651b54510eb1eb0.exe cmd.exe PID 796 wrote to memory of 2524 796 NEAS.67f9bece4984c5fcb651b54510eb1eb0.exe cmd.exe PID 796 wrote to memory of 2524 796 NEAS.67f9bece4984c5fcb651b54510eb1eb0.exe cmd.exe PID 2524 wrote to memory of 2480 2524 cmd.exe PING.EXE PID 2524 wrote to memory of 2480 2524 cmd.exe PING.EXE PID 2524 wrote to memory of 2480 2524 cmd.exe PING.EXE PID 2524 wrote to memory of 2480 2524 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.67f9bece4984c5fcb651b54510eb1eb0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.67f9bece4984c5fcb651b54510eb1eb0.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:1432 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\NEAS.67f9bece4984c5fcb651b54510eb1eb0.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:2480
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
67KB
MD57306b67124b80f26bf6786f3365da23e
SHA1846eeab831532561c1932434ebaad7e8e96c0ddc
SHA256150f915549e4a8ec3fc58b26bdc3164292a45cf17cc6b0dbecb95e82f10b21fd
SHA512d4179f4c2bb2a594c89e81cd98fe2f914645bc01fcda3a1d83f16bf42ccd857f956305c23e974654907b06d837aa6f3d59b202f6acd4ccf26585c6cfbadc94b4
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
67KB
MD57306b67124b80f26bf6786f3365da23e
SHA1846eeab831532561c1932434ebaad7e8e96c0ddc
SHA256150f915549e4a8ec3fc58b26bdc3164292a45cf17cc6b0dbecb95e82f10b21fd
SHA512d4179f4c2bb2a594c89e81cd98fe2f914645bc01fcda3a1d83f16bf42ccd857f956305c23e974654907b06d837aa6f3d59b202f6acd4ccf26585c6cfbadc94b4
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
67KB
MD57306b67124b80f26bf6786f3365da23e
SHA1846eeab831532561c1932434ebaad7e8e96c0ddc
SHA256150f915549e4a8ec3fc58b26bdc3164292a45cf17cc6b0dbecb95e82f10b21fd
SHA512d4179f4c2bb2a594c89e81cd98fe2f914645bc01fcda3a1d83f16bf42ccd857f956305c23e974654907b06d837aa6f3d59b202f6acd4ccf26585c6cfbadc94b4
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
67KB
MD57306b67124b80f26bf6786f3365da23e
SHA1846eeab831532561c1932434ebaad7e8e96c0ddc
SHA256150f915549e4a8ec3fc58b26bdc3164292a45cf17cc6b0dbecb95e82f10b21fd
SHA512d4179f4c2bb2a594c89e81cd98fe2f914645bc01fcda3a1d83f16bf42ccd857f956305c23e974654907b06d837aa6f3d59b202f6acd4ccf26585c6cfbadc94b4
-
memory/796-0-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/796-1-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/796-2-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/796-11-0x0000000000320000-0x000000000032A000-memory.dmpFilesize
40KB
-
memory/796-12-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/796-13-0x0000000000320000-0x000000000032A000-memory.dmpFilesize
40KB