Analysis
-
max time kernel
139s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
07-11-2023 01:42
Behavioral task
behavioral1
Sample
NEAS.8f42e1693846cc01e1f85c0174114f30.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.8f42e1693846cc01e1f85c0174114f30.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.8f42e1693846cc01e1f85c0174114f30.exe
-
Size
100KB
-
MD5
8f42e1693846cc01e1f85c0174114f30
-
SHA1
e0863599d991c7b16b77eb1c604018ca5dc875fb
-
SHA256
07fe46f6d97a8ea77ad9c0c64391dd73a67536e27e48d619ba9d987c79487e29
-
SHA512
c307a36d4833739d1032a3e94341cdebba9ffed623837d6e5d0401ee093a7fd89d02994d425d11ca504b19f1e828b3d3db0233f4f8bb863d93a504ef8898d2f1
-
SSDEEP
1536:Loaj1hJL1S9t0MIeboal8bCKxo7h0RPaaml0Nz30rtrsxL:c0hpgz6xGhZamyF30BoxL
Malware Config
Signatures
-
Sakula payload 6 IoCs
Processes:
resource yara_rule behavioral2/memory/4488-0-0x0000000000400000-0x000000000041B000-memory.dmp family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula behavioral2/memory/4488-5-0x0000000000400000-0x000000000041B000-memory.dmp family_sakula behavioral2/memory/5064-6-0x0000000000400000-0x000000000041B000-memory.dmp family_sakula behavioral2/memory/4488-7-0x0000000000400000-0x000000000041B000-memory.dmp family_sakula -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
NEAS.8f42e1693846cc01e1f85c0174114f30.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\Control Panel\International\Geo\Nation NEAS.8f42e1693846cc01e1f85c0174114f30.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 5064 MediaCenter.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
NEAS.8f42e1693846cc01e1f85c0174114f30.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" NEAS.8f42e1693846cc01e1f85c0174114f30.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
NEAS.8f42e1693846cc01e1f85c0174114f30.exedescription pid process Token: SeIncBasePriorityPrivilege 4488 NEAS.8f42e1693846cc01e1f85c0174114f30.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
NEAS.8f42e1693846cc01e1f85c0174114f30.execmd.exedescription pid process target process PID 4488 wrote to memory of 5064 4488 NEAS.8f42e1693846cc01e1f85c0174114f30.exe MediaCenter.exe PID 4488 wrote to memory of 5064 4488 NEAS.8f42e1693846cc01e1f85c0174114f30.exe MediaCenter.exe PID 4488 wrote to memory of 5064 4488 NEAS.8f42e1693846cc01e1f85c0174114f30.exe MediaCenter.exe PID 4488 wrote to memory of 5036 4488 NEAS.8f42e1693846cc01e1f85c0174114f30.exe cmd.exe PID 4488 wrote to memory of 5036 4488 NEAS.8f42e1693846cc01e1f85c0174114f30.exe cmd.exe PID 4488 wrote to memory of 5036 4488 NEAS.8f42e1693846cc01e1f85c0174114f30.exe cmd.exe PID 5036 wrote to memory of 944 5036 cmd.exe PING.EXE PID 5036 wrote to memory of 944 5036 cmd.exe PING.EXE PID 5036 wrote to memory of 944 5036 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.8f42e1693846cc01e1f85c0174114f30.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.8f42e1693846cc01e1f85c0174114f30.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:5064 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\NEAS.8f42e1693846cc01e1f85c0174114f30.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:944
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
100KB
MD5227ca40c3e5203b0c4faf564543c2b6a
SHA1ccc54f55107b2bfd752f412e88bdb9a0bc46167e
SHA2567bef1747d4916e73c718d7171d9634b4f67ad6e1f7d7d4ef4a7f77834dc638f7
SHA512326631776aca15733a8d7188b2214b03b97112749552604f4edc52f3ffcc6fbf74a808400b67df3df67bc719effde5174edda8b2fa77894a2a2c74d7ab36965d
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
100KB
MD5227ca40c3e5203b0c4faf564543c2b6a
SHA1ccc54f55107b2bfd752f412e88bdb9a0bc46167e
SHA2567bef1747d4916e73c718d7171d9634b4f67ad6e1f7d7d4ef4a7f77834dc638f7
SHA512326631776aca15733a8d7188b2214b03b97112749552604f4edc52f3ffcc6fbf74a808400b67df3df67bc719effde5174edda8b2fa77894a2a2c74d7ab36965d
-
memory/4488-0-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/4488-5-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/4488-7-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/5064-6-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB