Analysis
-
max time kernel
141s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
08-11-2023 13:43
Static task
static1
Behavioral task
behavioral1
Sample
6de45d12ecbb43adb995681c0fa32fef9aeeebc3b645105ce9d0d94a9781fdc8.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
6de45d12ecbb43adb995681c0fa32fef9aeeebc3b645105ce9d0d94a9781fdc8.exe
Resource
win10v2004-20231020-en
General
-
Target
6de45d12ecbb43adb995681c0fa32fef9aeeebc3b645105ce9d0d94a9781fdc8.exe
-
Size
44KB
-
MD5
d24231c7fd3434c343289eefe8d9e561
-
SHA1
9b554dedf014e6518796d657fae6c9786a6c9a27
-
SHA256
6de45d12ecbb43adb995681c0fa32fef9aeeebc3b645105ce9d0d94a9781fdc8
-
SHA512
071668c29357e18d441d6136b4461bb52337ea65f67381728271445604b9d0bd870b86807157f5f1e1e0d63c7ff33fe61608957828459290d8e6836bc7d8529c
-
SSDEEP
768:GhSksandb4GgyMsw4hyYtoVxYMcm1oUt1vnhBl:GTsGpjhyYtkYMRyUFb
Malware Config
Extracted
sakula
http://vpn.premrera.com:443/viewpre.asp?cstring=%s&tom=%d&id=%d
http://vpn.premrera.com:443/photo/%s.jpg?id=%d
http://173.254.226.212:443/viewpre.asp?cstring=%s&tom=%d&id=%d
http://173.254.226.212:443/photo/%s.jpg?id=%d
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2428 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 2372 MediaCenter.exe -
Loads dropped DLL 2 IoCs
Processes:
cmd.exepid process 2496 cmd.exe 2496 cmd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
6de45d12ecbb43adb995681c0fa32fef9aeeebc3b645105ce9d0d94a9781fdc8.execmd.execmd.execmd.exedescription pid process target process PID 1696 wrote to memory of 2112 1696 6de45d12ecbb43adb995681c0fa32fef9aeeebc3b645105ce9d0d94a9781fdc8.exe cmd.exe PID 1696 wrote to memory of 2112 1696 6de45d12ecbb43adb995681c0fa32fef9aeeebc3b645105ce9d0d94a9781fdc8.exe cmd.exe PID 1696 wrote to memory of 2112 1696 6de45d12ecbb43adb995681c0fa32fef9aeeebc3b645105ce9d0d94a9781fdc8.exe cmd.exe PID 1696 wrote to memory of 2112 1696 6de45d12ecbb43adb995681c0fa32fef9aeeebc3b645105ce9d0d94a9781fdc8.exe cmd.exe PID 1696 wrote to memory of 2496 1696 6de45d12ecbb43adb995681c0fa32fef9aeeebc3b645105ce9d0d94a9781fdc8.exe cmd.exe PID 1696 wrote to memory of 2496 1696 6de45d12ecbb43adb995681c0fa32fef9aeeebc3b645105ce9d0d94a9781fdc8.exe cmd.exe PID 1696 wrote to memory of 2496 1696 6de45d12ecbb43adb995681c0fa32fef9aeeebc3b645105ce9d0d94a9781fdc8.exe cmd.exe PID 1696 wrote to memory of 2496 1696 6de45d12ecbb43adb995681c0fa32fef9aeeebc3b645105ce9d0d94a9781fdc8.exe cmd.exe PID 1696 wrote to memory of 2428 1696 6de45d12ecbb43adb995681c0fa32fef9aeeebc3b645105ce9d0d94a9781fdc8.exe cmd.exe PID 1696 wrote to memory of 2428 1696 6de45d12ecbb43adb995681c0fa32fef9aeeebc3b645105ce9d0d94a9781fdc8.exe cmd.exe PID 1696 wrote to memory of 2428 1696 6de45d12ecbb43adb995681c0fa32fef9aeeebc3b645105ce9d0d94a9781fdc8.exe cmd.exe PID 1696 wrote to memory of 2428 1696 6de45d12ecbb43adb995681c0fa32fef9aeeebc3b645105ce9d0d94a9781fdc8.exe cmd.exe PID 2112 wrote to memory of 2308 2112 cmd.exe reg.exe PID 2112 wrote to memory of 2308 2112 cmd.exe reg.exe PID 2112 wrote to memory of 2308 2112 cmd.exe reg.exe PID 2112 wrote to memory of 2308 2112 cmd.exe reg.exe PID 2496 wrote to memory of 2372 2496 cmd.exe MediaCenter.exe PID 2496 wrote to memory of 2372 2496 cmd.exe MediaCenter.exe PID 2496 wrote to memory of 2372 2496 cmd.exe MediaCenter.exe PID 2496 wrote to memory of 2372 2496 cmd.exe MediaCenter.exe PID 2428 wrote to memory of 2648 2428 cmd.exe PING.EXE PID 2428 wrote to memory of 2648 2428 cmd.exe PING.EXE PID 2428 wrote to memory of 2648 2428 cmd.exe PING.EXE PID 2428 wrote to memory of 2648 2428 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\6de45d12ecbb43adb995681c0fa32fef9aeeebc3b645105ce9d0d94a9781fdc8.exe"C:\Users\Admin\AppData\Local\Temp\6de45d12ecbb43adb995681c0fa32fef9aeeebc3b645105ce9d0d94a9781fdc8.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
PID:2308 -
C:\Windows\SysWOW64\cmd.execmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe3⤵
- Executes dropped EXE
PID:2372 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\6de45d12ecbb43adb995681c0fa32fef9aeeebc3b645105ce9d0d94a9781fdc8.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:2648
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
44KB
MD5137a0df50a72f7beaf6b160d1be54cc0
SHA1c35e4373593a9421ca615a7532696ce82698ccd5
SHA2567bc57d4c92b96aca1f96842e78f6060f13e49f69145773c50c36500b4c50fec5
SHA51294ccdedca4f009ddf68e95d7b3e7fa13350db095d3ea764578f9379f0cef65515b46c8da8db32c2644bf6d754080ea76f3c9dd442c83e3f2431cfe84a5f982a8
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
44KB
MD5137a0df50a72f7beaf6b160d1be54cc0
SHA1c35e4373593a9421ca615a7532696ce82698ccd5
SHA2567bc57d4c92b96aca1f96842e78f6060f13e49f69145773c50c36500b4c50fec5
SHA51294ccdedca4f009ddf68e95d7b3e7fa13350db095d3ea764578f9379f0cef65515b46c8da8db32c2644bf6d754080ea76f3c9dd442c83e3f2431cfe84a5f982a8
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
44KB
MD5137a0df50a72f7beaf6b160d1be54cc0
SHA1c35e4373593a9421ca615a7532696ce82698ccd5
SHA2567bc57d4c92b96aca1f96842e78f6060f13e49f69145773c50c36500b4c50fec5
SHA51294ccdedca4f009ddf68e95d7b3e7fa13350db095d3ea764578f9379f0cef65515b46c8da8db32c2644bf6d754080ea76f3c9dd442c83e3f2431cfe84a5f982a8
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
44KB
MD5137a0df50a72f7beaf6b160d1be54cc0
SHA1c35e4373593a9421ca615a7532696ce82698ccd5
SHA2567bc57d4c92b96aca1f96842e78f6060f13e49f69145773c50c36500b4c50fec5
SHA51294ccdedca4f009ddf68e95d7b3e7fa13350db095d3ea764578f9379f0cef65515b46c8da8db32c2644bf6d754080ea76f3c9dd442c83e3f2431cfe84a5f982a8
-
memory/1696-0-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1696-2-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2372-7-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2372-8-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB