Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
08-11-2023 13:35
Static task
static1
Behavioral task
behavioral1
Sample
45d89ec308ca69ab82df464b7166f53aed8be43f3702c65a711bcf72bb72974f.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
45d89ec308ca69ab82df464b7166f53aed8be43f3702c65a711bcf72bb72974f.exe
Resource
win10v2004-20231023-en
General
-
Target
45d89ec308ca69ab82df464b7166f53aed8be43f3702c65a711bcf72bb72974f.exe
-
Size
44KB
-
MD5
0cb69e72b4b060af02339b16f618dc71
-
SHA1
76777d0f7bea903e8ee4875d92bfc9fe4fcf665b
-
SHA256
45d89ec308ca69ab82df464b7166f53aed8be43f3702c65a711bcf72bb72974f
-
SHA512
c55fa00e56232347bd0efe9bfee59e933942b4947d52a77c1fdda1aecb50bb2a77ec7576c7d6fa356b7a4f5c5fa492a790af5a831dc943add866c8c98b87f930
-
SSDEEP
768:GhSksandb4GgyMsw4hyYtoVxYMcm1oUt1vnhBa:GTsGpjhyYtkYMRyUFM
Malware Config
Extracted
sakula
http://vpn.premrera.com:443/viewpre.asp?cstring=%s&tom=%d&id=%d
http://vpn.premrera.com:443/photo/%s.jpg?id=%d
http://173.254.226.212:443/viewpre.asp?cstring=%s&tom=%d&id=%d
http://173.254.226.212:443/photo/%s.jpg?id=%d
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2628 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 2592 MediaCenter.exe -
Loads dropped DLL 2 IoCs
Processes:
cmd.exepid process 2596 cmd.exe 2596 cmd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
45d89ec308ca69ab82df464b7166f53aed8be43f3702c65a711bcf72bb72974f.execmd.execmd.execmd.exedescription pid process target process PID 1320 wrote to memory of 2260 1320 45d89ec308ca69ab82df464b7166f53aed8be43f3702c65a711bcf72bb72974f.exe cmd.exe PID 1320 wrote to memory of 2260 1320 45d89ec308ca69ab82df464b7166f53aed8be43f3702c65a711bcf72bb72974f.exe cmd.exe PID 1320 wrote to memory of 2260 1320 45d89ec308ca69ab82df464b7166f53aed8be43f3702c65a711bcf72bb72974f.exe cmd.exe PID 1320 wrote to memory of 2260 1320 45d89ec308ca69ab82df464b7166f53aed8be43f3702c65a711bcf72bb72974f.exe cmd.exe PID 1320 wrote to memory of 2596 1320 45d89ec308ca69ab82df464b7166f53aed8be43f3702c65a711bcf72bb72974f.exe cmd.exe PID 1320 wrote to memory of 2596 1320 45d89ec308ca69ab82df464b7166f53aed8be43f3702c65a711bcf72bb72974f.exe cmd.exe PID 1320 wrote to memory of 2596 1320 45d89ec308ca69ab82df464b7166f53aed8be43f3702c65a711bcf72bb72974f.exe cmd.exe PID 1320 wrote to memory of 2596 1320 45d89ec308ca69ab82df464b7166f53aed8be43f3702c65a711bcf72bb72974f.exe cmd.exe PID 1320 wrote to memory of 2628 1320 45d89ec308ca69ab82df464b7166f53aed8be43f3702c65a711bcf72bb72974f.exe cmd.exe PID 1320 wrote to memory of 2628 1320 45d89ec308ca69ab82df464b7166f53aed8be43f3702c65a711bcf72bb72974f.exe cmd.exe PID 1320 wrote to memory of 2628 1320 45d89ec308ca69ab82df464b7166f53aed8be43f3702c65a711bcf72bb72974f.exe cmd.exe PID 1320 wrote to memory of 2628 1320 45d89ec308ca69ab82df464b7166f53aed8be43f3702c65a711bcf72bb72974f.exe cmd.exe PID 2596 wrote to memory of 2592 2596 cmd.exe MediaCenter.exe PID 2596 wrote to memory of 2592 2596 cmd.exe MediaCenter.exe PID 2596 wrote to memory of 2592 2596 cmd.exe MediaCenter.exe PID 2596 wrote to memory of 2592 2596 cmd.exe MediaCenter.exe PID 2628 wrote to memory of 2640 2628 cmd.exe PING.EXE PID 2628 wrote to memory of 2640 2628 cmd.exe PING.EXE PID 2628 wrote to memory of 2640 2628 cmd.exe PING.EXE PID 2628 wrote to memory of 2640 2628 cmd.exe PING.EXE PID 2260 wrote to memory of 2632 2260 cmd.exe reg.exe PID 2260 wrote to memory of 2632 2260 cmd.exe reg.exe PID 2260 wrote to memory of 2632 2260 cmd.exe reg.exe PID 2260 wrote to memory of 2632 2260 cmd.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\45d89ec308ca69ab82df464b7166f53aed8be43f3702c65a711bcf72bb72974f.exe"C:\Users\Admin\AppData\Local\Temp\45d89ec308ca69ab82df464b7166f53aed8be43f3702c65a711bcf72bb72974f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
PID:2632 -
C:\Windows\SysWOW64\cmd.execmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe3⤵
- Executes dropped EXE
PID:2592 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\45d89ec308ca69ab82df464b7166f53aed8be43f3702c65a711bcf72bb72974f.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:2640
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
44KB
MD5b1dfe4919f9459634de101d39a554927
SHA1cd98b8fadb19d8c117401928c221d773b14e7c60
SHA256797f4d70e780a9e5cbda5e1449f05bfc37eeaa1b0f4d31ccb8109648b5f43855
SHA5121d221d1d1335c488f20a27ac646741bf6c621e860a3a1f62454f1790af5d1fbe62306882858da5248c843bb119f83242ee8ad0a29374203d5380960b6b277d17
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
44KB
MD5b1dfe4919f9459634de101d39a554927
SHA1cd98b8fadb19d8c117401928c221d773b14e7c60
SHA256797f4d70e780a9e5cbda5e1449f05bfc37eeaa1b0f4d31ccb8109648b5f43855
SHA5121d221d1d1335c488f20a27ac646741bf6c621e860a3a1f62454f1790af5d1fbe62306882858da5248c843bb119f83242ee8ad0a29374203d5380960b6b277d17
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
44KB
MD5b1dfe4919f9459634de101d39a554927
SHA1cd98b8fadb19d8c117401928c221d773b14e7c60
SHA256797f4d70e780a9e5cbda5e1449f05bfc37eeaa1b0f4d31ccb8109648b5f43855
SHA5121d221d1d1335c488f20a27ac646741bf6c621e860a3a1f62454f1790af5d1fbe62306882858da5248c843bb119f83242ee8ad0a29374203d5380960b6b277d17
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
44KB
MD5b1dfe4919f9459634de101d39a554927
SHA1cd98b8fadb19d8c117401928c221d773b14e7c60
SHA256797f4d70e780a9e5cbda5e1449f05bfc37eeaa1b0f4d31ccb8109648b5f43855
SHA5121d221d1d1335c488f20a27ac646741bf6c621e860a3a1f62454f1790af5d1fbe62306882858da5248c843bb119f83242ee8ad0a29374203d5380960b6b277d17
-
memory/1320-1-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2592-6-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2592-7-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB