Analysis
-
max time kernel
118s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
10-11-2023 01:21
Static task
static1
Behavioral task
behavioral1
Sample
87d289e296b3779a744d2ceac8ef592c510b7c6a34157a7f88ba19fa36113fbc.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
87d289e296b3779a744d2ceac8ef592c510b7c6a34157a7f88ba19fa36113fbc.exe
Resource
win10v2004-20231023-en
General
-
Target
87d289e296b3779a744d2ceac8ef592c510b7c6a34157a7f88ba19fa36113fbc.exe
-
Size
44KB
-
MD5
1e25cb169893f2ce73e137ae18c6df82
-
SHA1
2112f760a5c3095fadeef5bd45fdc6979b07953b
-
SHA256
87d289e296b3779a744d2ceac8ef592c510b7c6a34157a7f88ba19fa36113fbc
-
SHA512
dd28f177631343a2c1ea5be0fd23329f40865681bf443c7e472a82cd85a7763ad3a84a7bd5569691b43160d826655e2884494f681074fdeabc70b979141057a5
-
SSDEEP
768:GhSksandb4GgyMsw4hyYtoVxYMcm1oUt1vnhBL:GTsGpjhyYtkYMRyUFp
Malware Config
Extracted
sakula
http://vpn.premrera.com:443/viewpre.asp?cstring=%s&tom=%d&id=%d
http://vpn.premrera.com:443/photo/%s.jpg?id=%d
http://173.254.226.212:443/viewpre.asp?cstring=%s&tom=%d&id=%d
http://173.254.226.212:443/photo/%s.jpg?id=%d
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 3016 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 2312 MediaCenter.exe -
Loads dropped DLL 2 IoCs
Processes:
cmd.exepid process 2968 cmd.exe 2968 cmd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
87d289e296b3779a744d2ceac8ef592c510b7c6a34157a7f88ba19fa36113fbc.execmd.execmd.execmd.exedescription pid process target process PID 2576 wrote to memory of 2956 2576 87d289e296b3779a744d2ceac8ef592c510b7c6a34157a7f88ba19fa36113fbc.exe cmd.exe PID 2576 wrote to memory of 2956 2576 87d289e296b3779a744d2ceac8ef592c510b7c6a34157a7f88ba19fa36113fbc.exe cmd.exe PID 2576 wrote to memory of 2956 2576 87d289e296b3779a744d2ceac8ef592c510b7c6a34157a7f88ba19fa36113fbc.exe cmd.exe PID 2576 wrote to memory of 2956 2576 87d289e296b3779a744d2ceac8ef592c510b7c6a34157a7f88ba19fa36113fbc.exe cmd.exe PID 2576 wrote to memory of 2968 2576 87d289e296b3779a744d2ceac8ef592c510b7c6a34157a7f88ba19fa36113fbc.exe cmd.exe PID 2576 wrote to memory of 2968 2576 87d289e296b3779a744d2ceac8ef592c510b7c6a34157a7f88ba19fa36113fbc.exe cmd.exe PID 2576 wrote to memory of 2968 2576 87d289e296b3779a744d2ceac8ef592c510b7c6a34157a7f88ba19fa36113fbc.exe cmd.exe PID 2576 wrote to memory of 2968 2576 87d289e296b3779a744d2ceac8ef592c510b7c6a34157a7f88ba19fa36113fbc.exe cmd.exe PID 2576 wrote to memory of 3016 2576 87d289e296b3779a744d2ceac8ef592c510b7c6a34157a7f88ba19fa36113fbc.exe cmd.exe PID 2576 wrote to memory of 3016 2576 87d289e296b3779a744d2ceac8ef592c510b7c6a34157a7f88ba19fa36113fbc.exe cmd.exe PID 2576 wrote to memory of 3016 2576 87d289e296b3779a744d2ceac8ef592c510b7c6a34157a7f88ba19fa36113fbc.exe cmd.exe PID 2576 wrote to memory of 3016 2576 87d289e296b3779a744d2ceac8ef592c510b7c6a34157a7f88ba19fa36113fbc.exe cmd.exe PID 2968 wrote to memory of 2312 2968 cmd.exe MediaCenter.exe PID 2968 wrote to memory of 2312 2968 cmd.exe MediaCenter.exe PID 2968 wrote to memory of 2312 2968 cmd.exe MediaCenter.exe PID 2968 wrote to memory of 2312 2968 cmd.exe MediaCenter.exe PID 2956 wrote to memory of 1400 2956 cmd.exe reg.exe PID 2956 wrote to memory of 1400 2956 cmd.exe reg.exe PID 2956 wrote to memory of 1400 2956 cmd.exe reg.exe PID 2956 wrote to memory of 1400 2956 cmd.exe reg.exe PID 3016 wrote to memory of 2636 3016 cmd.exe PING.EXE PID 3016 wrote to memory of 2636 3016 cmd.exe PING.EXE PID 3016 wrote to memory of 2636 3016 cmd.exe PING.EXE PID 3016 wrote to memory of 2636 3016 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\87d289e296b3779a744d2ceac8ef592c510b7c6a34157a7f88ba19fa36113fbc.exe"C:\Users\Admin\AppData\Local\Temp\87d289e296b3779a744d2ceac8ef592c510b7c6a34157a7f88ba19fa36113fbc.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
PID:1400 -
C:\Windows\SysWOW64\cmd.execmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe3⤵
- Executes dropped EXE
PID:2312 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\87d289e296b3779a744d2ceac8ef592c510b7c6a34157a7f88ba19fa36113fbc.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:2636
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
44KB
MD5ff49539af8fb11cc7699373f8bf46da9
SHA1cb1d5b99759f2b3c841e8671b370b2305d50f382
SHA25631787de335827108d6f6ccd3f43e85786fa134ced960bfcedd2781521ec7c3cb
SHA512af42aed38f4713ea312e0516cc971c5077b343eae02cb05a752b7e3da0d261207b27f949f0f8de592825e695d9ef10df30ff5d3ecc4708d158dd77f666aabd10
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
44KB
MD5ff49539af8fb11cc7699373f8bf46da9
SHA1cb1d5b99759f2b3c841e8671b370b2305d50f382
SHA25631787de335827108d6f6ccd3f43e85786fa134ced960bfcedd2781521ec7c3cb
SHA512af42aed38f4713ea312e0516cc971c5077b343eae02cb05a752b7e3da0d261207b27f949f0f8de592825e695d9ef10df30ff5d3ecc4708d158dd77f666aabd10
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
44KB
MD5ff49539af8fb11cc7699373f8bf46da9
SHA1cb1d5b99759f2b3c841e8671b370b2305d50f382
SHA25631787de335827108d6f6ccd3f43e85786fa134ced960bfcedd2781521ec7c3cb
SHA512af42aed38f4713ea312e0516cc971c5077b343eae02cb05a752b7e3da0d261207b27f949f0f8de592825e695d9ef10df30ff5d3ecc4708d158dd77f666aabd10
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
44KB
MD5ff49539af8fb11cc7699373f8bf46da9
SHA1cb1d5b99759f2b3c841e8671b370b2305d50f382
SHA25631787de335827108d6f6ccd3f43e85786fa134ced960bfcedd2781521ec7c3cb
SHA512af42aed38f4713ea312e0516cc971c5077b343eae02cb05a752b7e3da0d261207b27f949f0f8de592825e695d9ef10df30ff5d3ecc4708d158dd77f666aabd10
-
memory/2312-7-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2312-8-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2576-0-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2576-2-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB