Analysis
-
max time kernel
118s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
07-11-2023 01:42
Behavioral task
behavioral1
Sample
NEAS.8f42e1693846cc01e1f85c0174114f30.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.8f42e1693846cc01e1f85c0174114f30.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.8f42e1693846cc01e1f85c0174114f30.exe
-
Size
100KB
-
MD5
8f42e1693846cc01e1f85c0174114f30
-
SHA1
e0863599d991c7b16b77eb1c604018ca5dc875fb
-
SHA256
07fe46f6d97a8ea77ad9c0c64391dd73a67536e27e48d619ba9d987c79487e29
-
SHA512
c307a36d4833739d1032a3e94341cdebba9ffed623837d6e5d0401ee093a7fd89d02994d425d11ca504b19f1e828b3d3db0233f4f8bb863d93a504ef8898d2f1
-
SSDEEP
1536:Loaj1hJL1S9t0MIeboal8bCKxo7h0RPaaml0Nz30rtrsxL:c0hpgz6xGhZamyF30BoxL
Malware Config
Signatures
-
Sakula payload 8 IoCs
Processes:
resource yara_rule behavioral1/memory/816-0-0x0000000000400000-0x000000000041B000-memory.dmp family_sakula \Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula \Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula behavioral1/memory/2260-11-0x0000000000400000-0x000000000041B000-memory.dmp family_sakula behavioral1/memory/816-12-0x0000000000400000-0x000000000041B000-memory.dmp family_sakula behavioral1/memory/816-14-0x0000000000400000-0x000000000041B000-memory.dmp family_sakula -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2700 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 2260 MediaCenter.exe -
Loads dropped DLL 2 IoCs
Processes:
NEAS.8f42e1693846cc01e1f85c0174114f30.exepid process 816 NEAS.8f42e1693846cc01e1f85c0174114f30.exe 816 NEAS.8f42e1693846cc01e1f85c0174114f30.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
NEAS.8f42e1693846cc01e1f85c0174114f30.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" NEAS.8f42e1693846cc01e1f85c0174114f30.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
NEAS.8f42e1693846cc01e1f85c0174114f30.exedescription pid process Token: SeIncBasePriorityPrivilege 816 NEAS.8f42e1693846cc01e1f85c0174114f30.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
NEAS.8f42e1693846cc01e1f85c0174114f30.execmd.exedescription pid process target process PID 816 wrote to memory of 2260 816 NEAS.8f42e1693846cc01e1f85c0174114f30.exe MediaCenter.exe PID 816 wrote to memory of 2260 816 NEAS.8f42e1693846cc01e1f85c0174114f30.exe MediaCenter.exe PID 816 wrote to memory of 2260 816 NEAS.8f42e1693846cc01e1f85c0174114f30.exe MediaCenter.exe PID 816 wrote to memory of 2260 816 NEAS.8f42e1693846cc01e1f85c0174114f30.exe MediaCenter.exe PID 816 wrote to memory of 2700 816 NEAS.8f42e1693846cc01e1f85c0174114f30.exe cmd.exe PID 816 wrote to memory of 2700 816 NEAS.8f42e1693846cc01e1f85c0174114f30.exe cmd.exe PID 816 wrote to memory of 2700 816 NEAS.8f42e1693846cc01e1f85c0174114f30.exe cmd.exe PID 816 wrote to memory of 2700 816 NEAS.8f42e1693846cc01e1f85c0174114f30.exe cmd.exe PID 2700 wrote to memory of 2252 2700 cmd.exe PING.EXE PID 2700 wrote to memory of 2252 2700 cmd.exe PING.EXE PID 2700 wrote to memory of 2252 2700 cmd.exe PING.EXE PID 2700 wrote to memory of 2252 2700 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.8f42e1693846cc01e1f85c0174114f30.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.8f42e1693846cc01e1f85c0174114f30.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:2260 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\NEAS.8f42e1693846cc01e1f85c0174114f30.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:2252
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
100KB
MD5c032ca73293210206103afab47c879ec
SHA16b6d53afc36bd3e36329de0ca97a99cffd36c98e
SHA2563479e5b0432f15b2fc1470e3f35e9ec4a4800095b618ddfd70b71effa65e0133
SHA51206d9a820110047376989e74149c43d622666ee18940c4dad5f64350930c7873c31f84cacd2db386fdfea4efbe6d54f57754ddb92c0384c51907d99134b717c24
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
100KB
MD5c032ca73293210206103afab47c879ec
SHA16b6d53afc36bd3e36329de0ca97a99cffd36c98e
SHA2563479e5b0432f15b2fc1470e3f35e9ec4a4800095b618ddfd70b71effa65e0133
SHA51206d9a820110047376989e74149c43d622666ee18940c4dad5f64350930c7873c31f84cacd2db386fdfea4efbe6d54f57754ddb92c0384c51907d99134b717c24
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
100KB
MD5c032ca73293210206103afab47c879ec
SHA16b6d53afc36bd3e36329de0ca97a99cffd36c98e
SHA2563479e5b0432f15b2fc1470e3f35e9ec4a4800095b618ddfd70b71effa65e0133
SHA51206d9a820110047376989e74149c43d622666ee18940c4dad5f64350930c7873c31f84cacd2db386fdfea4efbe6d54f57754ddb92c0384c51907d99134b717c24
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
100KB
MD5c032ca73293210206103afab47c879ec
SHA16b6d53afc36bd3e36329de0ca97a99cffd36c98e
SHA2563479e5b0432f15b2fc1470e3f35e9ec4a4800095b618ddfd70b71effa65e0133
SHA51206d9a820110047376989e74149c43d622666ee18940c4dad5f64350930c7873c31f84cacd2db386fdfea4efbe6d54f57754ddb92c0384c51907d99134b717c24
-
memory/816-0-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/816-9-0x0000000000220000-0x000000000023B000-memory.dmpFilesize
108KB
-
memory/816-10-0x0000000000220000-0x000000000023B000-memory.dmpFilesize
108KB
-
memory/816-12-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/816-13-0x0000000000220000-0x000000000023B000-memory.dmpFilesize
108KB
-
memory/816-14-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2260-11-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB