Analysis
-
max time kernel
137s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
10-11-2023 01:21
Static task
static1
Behavioral task
behavioral1
Sample
87d289e296b3779a744d2ceac8ef592c510b7c6a34157a7f88ba19fa36113fbc.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
87d289e296b3779a744d2ceac8ef592c510b7c6a34157a7f88ba19fa36113fbc.exe
Resource
win10v2004-20231023-en
General
-
Target
87d289e296b3779a744d2ceac8ef592c510b7c6a34157a7f88ba19fa36113fbc.exe
-
Size
44KB
-
MD5
1e25cb169893f2ce73e137ae18c6df82
-
SHA1
2112f760a5c3095fadeef5bd45fdc6979b07953b
-
SHA256
87d289e296b3779a744d2ceac8ef592c510b7c6a34157a7f88ba19fa36113fbc
-
SHA512
dd28f177631343a2c1ea5be0fd23329f40865681bf443c7e472a82cd85a7763ad3a84a7bd5569691b43160d826655e2884494f681074fdeabc70b979141057a5
-
SSDEEP
768:GhSksandb4GgyMsw4hyYtoVxYMcm1oUt1vnhBL:GTsGpjhyYtkYMRyUFp
Malware Config
Extracted
sakula
http://vpn.premrera.com:443/viewpre.asp?cstring=%s&tom=%d&id=%d
http://vpn.premrera.com:443/photo/%s.jpg?id=%d
http://173.254.226.212:443/viewpre.asp?cstring=%s&tom=%d&id=%d
http://173.254.226.212:443/photo/%s.jpg?id=%d
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 2452 MediaCenter.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
87d289e296b3779a744d2ceac8ef592c510b7c6a34157a7f88ba19fa36113fbc.execmd.execmd.execmd.exedescription pid process target process PID 2252 wrote to memory of 1688 2252 87d289e296b3779a744d2ceac8ef592c510b7c6a34157a7f88ba19fa36113fbc.exe cmd.exe PID 2252 wrote to memory of 1688 2252 87d289e296b3779a744d2ceac8ef592c510b7c6a34157a7f88ba19fa36113fbc.exe cmd.exe PID 2252 wrote to memory of 1688 2252 87d289e296b3779a744d2ceac8ef592c510b7c6a34157a7f88ba19fa36113fbc.exe cmd.exe PID 2252 wrote to memory of 4248 2252 87d289e296b3779a744d2ceac8ef592c510b7c6a34157a7f88ba19fa36113fbc.exe cmd.exe PID 2252 wrote to memory of 4248 2252 87d289e296b3779a744d2ceac8ef592c510b7c6a34157a7f88ba19fa36113fbc.exe cmd.exe PID 2252 wrote to memory of 4248 2252 87d289e296b3779a744d2ceac8ef592c510b7c6a34157a7f88ba19fa36113fbc.exe cmd.exe PID 2252 wrote to memory of 4216 2252 87d289e296b3779a744d2ceac8ef592c510b7c6a34157a7f88ba19fa36113fbc.exe cmd.exe PID 2252 wrote to memory of 4216 2252 87d289e296b3779a744d2ceac8ef592c510b7c6a34157a7f88ba19fa36113fbc.exe cmd.exe PID 2252 wrote to memory of 4216 2252 87d289e296b3779a744d2ceac8ef592c510b7c6a34157a7f88ba19fa36113fbc.exe cmd.exe PID 4248 wrote to memory of 2452 4248 cmd.exe MediaCenter.exe PID 4248 wrote to memory of 2452 4248 cmd.exe MediaCenter.exe PID 4248 wrote to memory of 2452 4248 cmd.exe MediaCenter.exe PID 4216 wrote to memory of 1464 4216 cmd.exe PING.EXE PID 4216 wrote to memory of 1464 4216 cmd.exe PING.EXE PID 4216 wrote to memory of 1464 4216 cmd.exe PING.EXE PID 1688 wrote to memory of 1096 1688 cmd.exe reg.exe PID 1688 wrote to memory of 1096 1688 cmd.exe reg.exe PID 1688 wrote to memory of 1096 1688 cmd.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\87d289e296b3779a744d2ceac8ef592c510b7c6a34157a7f88ba19fa36113fbc.exe"C:\Users\Admin\AppData\Local\Temp\87d289e296b3779a744d2ceac8ef592c510b7c6a34157a7f88ba19fa36113fbc.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
PID:1096 -
C:\Windows\SysWOW64\cmd.execmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe3⤵
- Executes dropped EXE
PID:2452 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\87d289e296b3779a744d2ceac8ef592c510b7c6a34157a7f88ba19fa36113fbc.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:1464
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
44KB
MD55f35ec0b82bbbe75d78223d642d6b140
SHA187a0142cc41955abe77a1fd915aad96abbfd8535
SHA2562b48dc650155f3dc291dde3cb50c04dc2a8f92b0d3f32b9710b7e0e15fdf15c9
SHA51207fc4886c6682b21ba18d5bbfee88368b1cbf415e5ae1eb0437dcf5eb4605b564b8b49f0aced105a60e153396c56ceab1dc06b22860531804f0f9c06087c7ae8
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
44KB
MD55f35ec0b82bbbe75d78223d642d6b140
SHA187a0142cc41955abe77a1fd915aad96abbfd8535
SHA2562b48dc650155f3dc291dde3cb50c04dc2a8f92b0d3f32b9710b7e0e15fdf15c9
SHA51207fc4886c6682b21ba18d5bbfee88368b1cbf415e5ae1eb0437dcf5eb4605b564b8b49f0aced105a60e153396c56ceab1dc06b22860531804f0f9c06087c7ae8
-
memory/2252-0-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2252-2-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2452-6-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/2452-7-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB