Analysis
-
max time kernel
138s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
07-11-2023 01:06
Behavioral task
behavioral1
Sample
NEAS.7a96fba9dd3d86763a0cbb34e5971120.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.7a96fba9dd3d86763a0cbb34e5971120.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.7a96fba9dd3d86763a0cbb34e5971120.exe
-
Size
39KB
-
MD5
7a96fba9dd3d86763a0cbb34e5971120
-
SHA1
c2197d11f3a83e923eb7fe6f81a3e3663f414a14
-
SHA256
c97c0b8f5f75d8848f9d30c0e6f95fde19919d20828102b3f53b7b78cbda6175
-
SHA512
9629ab35530df1e67a88d26028b79a774da81f59612a1a82e7e672798f53ce357f3fcb8e6a798c5de781da1a4d77a89e4f0bae749528904d707970e54bd3880e
-
SSDEEP
384:km7SCFozc/T94Umdjpxq4TqvhyY3Q6oVxYlOws0me86g7trW54Uu6Ot2xLdAeMvC:H7Xezc/T6Zp14hyYtoVxYBY37054V4
Malware Config
Extracted
sakula
http://www.we11point.com:443/view.asp?cookie=%s&type=%d&vid=%d
http://www.we11point.com:443/photo/%s.jpg?vid=%d
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 2684 MediaCenter.exe -
Processes:
resource yara_rule behavioral2/memory/1616-0-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral2/memory/1616-1-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral2/memory/1616-2-0x0000000000400000-0x000000000040C000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe upx C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe upx behavioral2/memory/1616-7-0x0000000000400000-0x000000000040C000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
NEAS.7a96fba9dd3d86763a0cbb34e5971120.execmd.execmd.exedescription pid process target process PID 1616 wrote to memory of 3044 1616 NEAS.7a96fba9dd3d86763a0cbb34e5971120.exe cmd.exe PID 1616 wrote to memory of 3044 1616 NEAS.7a96fba9dd3d86763a0cbb34e5971120.exe cmd.exe PID 1616 wrote to memory of 3044 1616 NEAS.7a96fba9dd3d86763a0cbb34e5971120.exe cmd.exe PID 1616 wrote to memory of 2684 1616 NEAS.7a96fba9dd3d86763a0cbb34e5971120.exe MediaCenter.exe PID 1616 wrote to memory of 2684 1616 NEAS.7a96fba9dd3d86763a0cbb34e5971120.exe MediaCenter.exe PID 1616 wrote to memory of 2684 1616 NEAS.7a96fba9dd3d86763a0cbb34e5971120.exe MediaCenter.exe PID 3044 wrote to memory of 3728 3044 cmd.exe reg.exe PID 3044 wrote to memory of 3728 3044 cmd.exe reg.exe PID 3044 wrote to memory of 3728 3044 cmd.exe reg.exe PID 1616 wrote to memory of 4888 1616 NEAS.7a96fba9dd3d86763a0cbb34e5971120.exe cmd.exe PID 1616 wrote to memory of 4888 1616 NEAS.7a96fba9dd3d86763a0cbb34e5971120.exe cmd.exe PID 1616 wrote to memory of 4888 1616 NEAS.7a96fba9dd3d86763a0cbb34e5971120.exe cmd.exe PID 4888 wrote to memory of 2704 4888 cmd.exe PING.EXE PID 4888 wrote to memory of 2704 4888 cmd.exe PING.EXE PID 4888 wrote to memory of 2704 4888 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.7a96fba9dd3d86763a0cbb34e5971120.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.7a96fba9dd3d86763a0cbb34e5971120.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:2684 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\NEAS.7a96fba9dd3d86763a0cbb34e5971120.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:2704
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
39KB
MD5f2ec6d20e30fa10e8434d6084cab78da
SHA1797a0615fa118d83fee9b8d851cf2164d788871b
SHA256165453fc8c0e32f7f6e5b65c74ba3efb55eaefb888649d984a4b77c6f47eea56
SHA512c7ee262536952a3161fa90b7c0bb88ee8047e444c5b979ea11ca0d0087eeb237046b5176909881bb46839a456d8eeec90748acb760dfff884f8311943ab975aa
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
39KB
MD5f2ec6d20e30fa10e8434d6084cab78da
SHA1797a0615fa118d83fee9b8d851cf2164d788871b
SHA256165453fc8c0e32f7f6e5b65c74ba3efb55eaefb888649d984a4b77c6f47eea56
SHA512c7ee262536952a3161fa90b7c0bb88ee8047e444c5b979ea11ca0d0087eeb237046b5176909881bb46839a456d8eeec90748acb760dfff884f8311943ab975aa
-
memory/1616-0-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1616-1-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1616-2-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1616-7-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB