Analysis
-
max time kernel
143s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
06-11-2023 20:49
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.67f9bece4984c5fcb651b54510eb1eb0.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
NEAS.67f9bece4984c5fcb651b54510eb1eb0.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.67f9bece4984c5fcb651b54510eb1eb0.exe
-
Size
67KB
-
MD5
67f9bece4984c5fcb651b54510eb1eb0
-
SHA1
9bf1fcb44ad2254b84feb6473da86fbe1860bea9
-
SHA256
0f2bdc74474a6d7d904b3d77c5a7803d3fddd85a96d3a45fe6adfa3af6784bde
-
SHA512
b9bb967807ead49038aaf47dbfd5a0beaf0fffe0ab9cf179ddb2f59a707eb58c792df15c8f686bca54016c1cdf23a63d69be6dc890c929c585ea8ae0c701455a
-
SSDEEP
768:u7Xezc/T6Zp14hyYtoVxYF9mHF1yD3BmNV8PsED3VK2+ZtyOjgO4r9vFAg2rq6:a6zqhyYtkYWI3BDYTjipvF23
Malware Config
Extracted
sakula
http://www.we11point.com:443/view.asp?cookie=%s&type=%d&vid=%d
http://www.we11point.com:443/photo/%s.jpg?vid=%d
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 2316 MediaCenter.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
NEAS.67f9bece4984c5fcb651b54510eb1eb0.execmd.execmd.exedescription pid process target process PID 4068 wrote to memory of 4460 4068 NEAS.67f9bece4984c5fcb651b54510eb1eb0.exe cmd.exe PID 4068 wrote to memory of 4460 4068 NEAS.67f9bece4984c5fcb651b54510eb1eb0.exe cmd.exe PID 4068 wrote to memory of 4460 4068 NEAS.67f9bece4984c5fcb651b54510eb1eb0.exe cmd.exe PID 4068 wrote to memory of 2316 4068 NEAS.67f9bece4984c5fcb651b54510eb1eb0.exe MediaCenter.exe PID 4068 wrote to memory of 2316 4068 NEAS.67f9bece4984c5fcb651b54510eb1eb0.exe MediaCenter.exe PID 4068 wrote to memory of 2316 4068 NEAS.67f9bece4984c5fcb651b54510eb1eb0.exe MediaCenter.exe PID 4460 wrote to memory of 1196 4460 cmd.exe reg.exe PID 4460 wrote to memory of 1196 4460 cmd.exe reg.exe PID 4460 wrote to memory of 1196 4460 cmd.exe reg.exe PID 4068 wrote to memory of 1172 4068 NEAS.67f9bece4984c5fcb651b54510eb1eb0.exe cmd.exe PID 4068 wrote to memory of 1172 4068 NEAS.67f9bece4984c5fcb651b54510eb1eb0.exe cmd.exe PID 4068 wrote to memory of 1172 4068 NEAS.67f9bece4984c5fcb651b54510eb1eb0.exe cmd.exe PID 1172 wrote to memory of 3168 1172 cmd.exe PING.EXE PID 1172 wrote to memory of 3168 1172 cmd.exe PING.EXE PID 1172 wrote to memory of 3168 1172 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.67f9bece4984c5fcb651b54510eb1eb0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.67f9bece4984c5fcb651b54510eb1eb0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:2316 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\NEAS.67f9bece4984c5fcb651b54510eb1eb0.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:3168
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
67KB
MD535b38fabe2b390155cb1ec43e8a27ba3
SHA14f3f1dfcac65d3a7924266b8495d5313c7c2140e
SHA2565c04000f9d83b59428115203af041057fd8d705fc312218512b0a4f8c6e7e314
SHA512e576c239ba854106c1ca6413cb8ab39d86defcb8f7aad3354664a23b3d649ca4f52353d219c5d067706f23e09511abafee0fd0f28e58d68b23e0e9bb94cfa43f
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
67KB
MD535b38fabe2b390155cb1ec43e8a27ba3
SHA14f3f1dfcac65d3a7924266b8495d5313c7c2140e
SHA2565c04000f9d83b59428115203af041057fd8d705fc312218512b0a4f8c6e7e314
SHA512e576c239ba854106c1ca6413cb8ab39d86defcb8f7aad3354664a23b3d649ca4f52353d219c5d067706f23e09511abafee0fd0f28e58d68b23e0e9bb94cfa43f
-
memory/4068-0-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/4068-1-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/4068-6-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB