Analysis
-
max time kernel
160s -
max time network
175s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
08-11-2023 13:35
Static task
static1
Behavioral task
behavioral1
Sample
45d89ec308ca69ab82df464b7166f53aed8be43f3702c65a711bcf72bb72974f.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
45d89ec308ca69ab82df464b7166f53aed8be43f3702c65a711bcf72bb72974f.exe
Resource
win10v2004-20231023-en
General
-
Target
45d89ec308ca69ab82df464b7166f53aed8be43f3702c65a711bcf72bb72974f.exe
-
Size
44KB
-
MD5
0cb69e72b4b060af02339b16f618dc71
-
SHA1
76777d0f7bea903e8ee4875d92bfc9fe4fcf665b
-
SHA256
45d89ec308ca69ab82df464b7166f53aed8be43f3702c65a711bcf72bb72974f
-
SHA512
c55fa00e56232347bd0efe9bfee59e933942b4947d52a77c1fdda1aecb50bb2a77ec7576c7d6fa356b7a4f5c5fa492a790af5a831dc943add866c8c98b87f930
-
SSDEEP
768:GhSksandb4GgyMsw4hyYtoVxYMcm1oUt1vnhBa:GTsGpjhyYtkYMRyUFM
Malware Config
Extracted
sakula
http://vpn.premrera.com:443/viewpre.asp?cstring=%s&tom=%d&id=%d
http://vpn.premrera.com:443/photo/%s.jpg?id=%d
http://173.254.226.212:443/viewpre.asp?cstring=%s&tom=%d&id=%d
http://173.254.226.212:443/photo/%s.jpg?id=%d
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 4164 MediaCenter.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
45d89ec308ca69ab82df464b7166f53aed8be43f3702c65a711bcf72bb72974f.execmd.execmd.execmd.exedescription pid process target process PID 4024 wrote to memory of 392 4024 45d89ec308ca69ab82df464b7166f53aed8be43f3702c65a711bcf72bb72974f.exe cmd.exe PID 4024 wrote to memory of 392 4024 45d89ec308ca69ab82df464b7166f53aed8be43f3702c65a711bcf72bb72974f.exe cmd.exe PID 4024 wrote to memory of 392 4024 45d89ec308ca69ab82df464b7166f53aed8be43f3702c65a711bcf72bb72974f.exe cmd.exe PID 4024 wrote to memory of 1384 4024 45d89ec308ca69ab82df464b7166f53aed8be43f3702c65a711bcf72bb72974f.exe cmd.exe PID 4024 wrote to memory of 1384 4024 45d89ec308ca69ab82df464b7166f53aed8be43f3702c65a711bcf72bb72974f.exe cmd.exe PID 4024 wrote to memory of 1384 4024 45d89ec308ca69ab82df464b7166f53aed8be43f3702c65a711bcf72bb72974f.exe cmd.exe PID 4024 wrote to memory of 2540 4024 45d89ec308ca69ab82df464b7166f53aed8be43f3702c65a711bcf72bb72974f.exe cmd.exe PID 4024 wrote to memory of 2540 4024 45d89ec308ca69ab82df464b7166f53aed8be43f3702c65a711bcf72bb72974f.exe cmd.exe PID 4024 wrote to memory of 2540 4024 45d89ec308ca69ab82df464b7166f53aed8be43f3702c65a711bcf72bb72974f.exe cmd.exe PID 1384 wrote to memory of 4164 1384 cmd.exe MediaCenter.exe PID 1384 wrote to memory of 4164 1384 cmd.exe MediaCenter.exe PID 1384 wrote to memory of 4164 1384 cmd.exe MediaCenter.exe PID 2540 wrote to memory of 3584 2540 cmd.exe PING.EXE PID 2540 wrote to memory of 3584 2540 cmd.exe PING.EXE PID 2540 wrote to memory of 3584 2540 cmd.exe PING.EXE PID 392 wrote to memory of 1088 392 cmd.exe reg.exe PID 392 wrote to memory of 1088 392 cmd.exe reg.exe PID 392 wrote to memory of 1088 392 cmd.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\45d89ec308ca69ab82df464b7166f53aed8be43f3702c65a711bcf72bb72974f.exe"C:\Users\Admin\AppData\Local\Temp\45d89ec308ca69ab82df464b7166f53aed8be43f3702c65a711bcf72bb72974f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
PID:1088 -
C:\Windows\SysWOW64\cmd.execmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe3⤵
- Executes dropped EXE
PID:4164 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\45d89ec308ca69ab82df464b7166f53aed8be43f3702c65a711bcf72bb72974f.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:3584
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
44KB
MD545e63cd575e2669eb6829fb1ac66723f
SHA1b86f2cc26df3790fa24db4c73f8441d0e06e6a6b
SHA256c74b0343b84c1621bb6aba67943597a711d2fe5fa3a29183c0df333cd03f86a5
SHA512273c773e42f15c8aa2301ee85101456c781dea37d4e5d187405362fc92d1c08023035eb96498342af9b0a37cc97e51a56296e09466116af34085554b7fba35e9
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
44KB
MD545e63cd575e2669eb6829fb1ac66723f
SHA1b86f2cc26df3790fa24db4c73f8441d0e06e6a6b
SHA256c74b0343b84c1621bb6aba67943597a711d2fe5fa3a29183c0df333cd03f86a5
SHA512273c773e42f15c8aa2301ee85101456c781dea37d4e5d187405362fc92d1c08023035eb96498342af9b0a37cc97e51a56296e09466116af34085554b7fba35e9
-
memory/4024-0-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/4024-2-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/4164-6-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/4164-7-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB