Analysis
-
max time kernel
155s -
max time network
197s -
platform
windows7_x64 -
resource
win7-20231025-en -
resource tags
arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system -
submitted
08-11-2023 13:34
Static task
static1
Behavioral task
behavioral1
Sample
6de45d12ecbb43adb995681c0fa32fef9aeeebc3b645105ce9d0d94a9781fdc8.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
6de45d12ecbb43adb995681c0fa32fef9aeeebc3b645105ce9d0d94a9781fdc8.exe
Resource
win10v2004-20231025-en
General
-
Target
6de45d12ecbb43adb995681c0fa32fef9aeeebc3b645105ce9d0d94a9781fdc8.exe
-
Size
44KB
-
MD5
d24231c7fd3434c343289eefe8d9e561
-
SHA1
9b554dedf014e6518796d657fae6c9786a6c9a27
-
SHA256
6de45d12ecbb43adb995681c0fa32fef9aeeebc3b645105ce9d0d94a9781fdc8
-
SHA512
071668c29357e18d441d6136b4461bb52337ea65f67381728271445604b9d0bd870b86807157f5f1e1e0d63c7ff33fe61608957828459290d8e6836bc7d8529c
-
SSDEEP
768:GhSksandb4GgyMsw4hyYtoVxYMcm1oUt1vnhBl:GTsGpjhyYtkYMRyUFb
Malware Config
Extracted
sakula
http://vpn.premrera.com:443/viewpre.asp?cstring=%s&tom=%d&id=%d
http://vpn.premrera.com:443/photo/%s.jpg?id=%d
http://173.254.226.212:443/viewpre.asp?cstring=%s&tom=%d&id=%d
http://173.254.226.212:443/photo/%s.jpg?id=%d
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 3000 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 2500 MediaCenter.exe -
Loads dropped DLL 2 IoCs
Processes:
cmd.exepid process 2580 cmd.exe 2580 cmd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
6de45d12ecbb43adb995681c0fa32fef9aeeebc3b645105ce9d0d94a9781fdc8.execmd.execmd.execmd.exedescription pid process target process PID 2752 wrote to memory of 2628 2752 6de45d12ecbb43adb995681c0fa32fef9aeeebc3b645105ce9d0d94a9781fdc8.exe cmd.exe PID 2752 wrote to memory of 2628 2752 6de45d12ecbb43adb995681c0fa32fef9aeeebc3b645105ce9d0d94a9781fdc8.exe cmd.exe PID 2752 wrote to memory of 2628 2752 6de45d12ecbb43adb995681c0fa32fef9aeeebc3b645105ce9d0d94a9781fdc8.exe cmd.exe PID 2752 wrote to memory of 2628 2752 6de45d12ecbb43adb995681c0fa32fef9aeeebc3b645105ce9d0d94a9781fdc8.exe cmd.exe PID 2752 wrote to memory of 2580 2752 6de45d12ecbb43adb995681c0fa32fef9aeeebc3b645105ce9d0d94a9781fdc8.exe cmd.exe PID 2752 wrote to memory of 2580 2752 6de45d12ecbb43adb995681c0fa32fef9aeeebc3b645105ce9d0d94a9781fdc8.exe cmd.exe PID 2752 wrote to memory of 2580 2752 6de45d12ecbb43adb995681c0fa32fef9aeeebc3b645105ce9d0d94a9781fdc8.exe cmd.exe PID 2752 wrote to memory of 2580 2752 6de45d12ecbb43adb995681c0fa32fef9aeeebc3b645105ce9d0d94a9781fdc8.exe cmd.exe PID 2752 wrote to memory of 3000 2752 6de45d12ecbb43adb995681c0fa32fef9aeeebc3b645105ce9d0d94a9781fdc8.exe cmd.exe PID 2752 wrote to memory of 3000 2752 6de45d12ecbb43adb995681c0fa32fef9aeeebc3b645105ce9d0d94a9781fdc8.exe cmd.exe PID 2752 wrote to memory of 3000 2752 6de45d12ecbb43adb995681c0fa32fef9aeeebc3b645105ce9d0d94a9781fdc8.exe cmd.exe PID 2752 wrote to memory of 3000 2752 6de45d12ecbb43adb995681c0fa32fef9aeeebc3b645105ce9d0d94a9781fdc8.exe cmd.exe PID 2628 wrote to memory of 2636 2628 cmd.exe reg.exe PID 2628 wrote to memory of 2636 2628 cmd.exe reg.exe PID 2628 wrote to memory of 2636 2628 cmd.exe reg.exe PID 2628 wrote to memory of 2636 2628 cmd.exe reg.exe PID 3000 wrote to memory of 1184 3000 cmd.exe PING.EXE PID 3000 wrote to memory of 1184 3000 cmd.exe PING.EXE PID 3000 wrote to memory of 1184 3000 cmd.exe PING.EXE PID 3000 wrote to memory of 1184 3000 cmd.exe PING.EXE PID 2580 wrote to memory of 2500 2580 cmd.exe MediaCenter.exe PID 2580 wrote to memory of 2500 2580 cmd.exe MediaCenter.exe PID 2580 wrote to memory of 2500 2580 cmd.exe MediaCenter.exe PID 2580 wrote to memory of 2500 2580 cmd.exe MediaCenter.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6de45d12ecbb43adb995681c0fa32fef9aeeebc3b645105ce9d0d94a9781fdc8.exe"C:\Users\Admin\AppData\Local\Temp\6de45d12ecbb43adb995681c0fa32fef9aeeebc3b645105ce9d0d94a9781fdc8.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
PID:2636 -
C:\Windows\SysWOW64\cmd.execmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe3⤵
- Executes dropped EXE
PID:2500 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\6de45d12ecbb43adb995681c0fa32fef9aeeebc3b645105ce9d0d94a9781fdc8.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:1184
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
44KB
MD56ac2e1ba6b660fb8aad48229d4f7a339
SHA18b537e09a55997861403f06b4b61f8c66e96f811
SHA25646d0ecce3e894b23310aa59ce5899f9d121db5b60fcca74336f022831e27f7f8
SHA51241ec63157cf324ea74aa37581532a7f62b779d55dcc6fc79de2e652dfe836656df1d222ec0a1ae7208451a04136642e77a06f8619ed285be3d547990c66286c3
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
44KB
MD56ac2e1ba6b660fb8aad48229d4f7a339
SHA18b537e09a55997861403f06b4b61f8c66e96f811
SHA25646d0ecce3e894b23310aa59ce5899f9d121db5b60fcca74336f022831e27f7f8
SHA51241ec63157cf324ea74aa37581532a7f62b779d55dcc6fc79de2e652dfe836656df1d222ec0a1ae7208451a04136642e77a06f8619ed285be3d547990c66286c3
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
44KB
MD56ac2e1ba6b660fb8aad48229d4f7a339
SHA18b537e09a55997861403f06b4b61f8c66e96f811
SHA25646d0ecce3e894b23310aa59ce5899f9d121db5b60fcca74336f022831e27f7f8
SHA51241ec63157cf324ea74aa37581532a7f62b779d55dcc6fc79de2e652dfe836656df1d222ec0a1ae7208451a04136642e77a06f8619ed285be3d547990c66286c3
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
44KB
MD56ac2e1ba6b660fb8aad48229d4f7a339
SHA18b537e09a55997861403f06b4b61f8c66e96f811
SHA25646d0ecce3e894b23310aa59ce5899f9d121db5b60fcca74336f022831e27f7f8
SHA51241ec63157cf324ea74aa37581532a7f62b779d55dcc6fc79de2e652dfe836656df1d222ec0a1ae7208451a04136642e77a06f8619ed285be3d547990c66286c3
-
memory/2500-7-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2500-8-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2752-0-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2752-2-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB