Analysis
-
max time kernel
156s -
max time network
169s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
10-11-2023 02:59
Static task
static1
Behavioral task
behavioral1
Sample
6de45d12ecbb43adb995681c0fa32fef9aeeebc3b645105ce9d0d94a9781fdc8.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
6de45d12ecbb43adb995681c0fa32fef9aeeebc3b645105ce9d0d94a9781fdc8.exe
Resource
win10v2004-20231023-en
General
-
Target
6de45d12ecbb43adb995681c0fa32fef9aeeebc3b645105ce9d0d94a9781fdc8.exe
-
Size
44KB
-
MD5
d24231c7fd3434c343289eefe8d9e561
-
SHA1
9b554dedf014e6518796d657fae6c9786a6c9a27
-
SHA256
6de45d12ecbb43adb995681c0fa32fef9aeeebc3b645105ce9d0d94a9781fdc8
-
SHA512
071668c29357e18d441d6136b4461bb52337ea65f67381728271445604b9d0bd870b86807157f5f1e1e0d63c7ff33fe61608957828459290d8e6836bc7d8529c
-
SSDEEP
768:GhSksandb4GgyMsw4hyYtoVxYMcm1oUt1vnhBl:GTsGpjhyYtkYMRyUFb
Malware Config
Extracted
sakula
http://vpn.premrera.com:443/viewpre.asp?cstring=%s&tom=%d&id=%d
http://vpn.premrera.com:443/photo/%s.jpg?id=%d
http://173.254.226.212:443/viewpre.asp?cstring=%s&tom=%d&id=%d
http://173.254.226.212:443/photo/%s.jpg?id=%d
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 1320 MediaCenter.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
6de45d12ecbb43adb995681c0fa32fef9aeeebc3b645105ce9d0d94a9781fdc8.execmd.execmd.execmd.exedescription pid process target process PID 3776 wrote to memory of 4008 3776 6de45d12ecbb43adb995681c0fa32fef9aeeebc3b645105ce9d0d94a9781fdc8.exe cmd.exe PID 3776 wrote to memory of 4008 3776 6de45d12ecbb43adb995681c0fa32fef9aeeebc3b645105ce9d0d94a9781fdc8.exe cmd.exe PID 3776 wrote to memory of 4008 3776 6de45d12ecbb43adb995681c0fa32fef9aeeebc3b645105ce9d0d94a9781fdc8.exe cmd.exe PID 3776 wrote to memory of 3924 3776 6de45d12ecbb43adb995681c0fa32fef9aeeebc3b645105ce9d0d94a9781fdc8.exe cmd.exe PID 3776 wrote to memory of 3924 3776 6de45d12ecbb43adb995681c0fa32fef9aeeebc3b645105ce9d0d94a9781fdc8.exe cmd.exe PID 3776 wrote to memory of 3924 3776 6de45d12ecbb43adb995681c0fa32fef9aeeebc3b645105ce9d0d94a9781fdc8.exe cmd.exe PID 3776 wrote to memory of 1464 3776 6de45d12ecbb43adb995681c0fa32fef9aeeebc3b645105ce9d0d94a9781fdc8.exe cmd.exe PID 3776 wrote to memory of 1464 3776 6de45d12ecbb43adb995681c0fa32fef9aeeebc3b645105ce9d0d94a9781fdc8.exe cmd.exe PID 3776 wrote to memory of 1464 3776 6de45d12ecbb43adb995681c0fa32fef9aeeebc3b645105ce9d0d94a9781fdc8.exe cmd.exe PID 3924 wrote to memory of 1320 3924 cmd.exe MediaCenter.exe PID 3924 wrote to memory of 1320 3924 cmd.exe MediaCenter.exe PID 3924 wrote to memory of 1320 3924 cmd.exe MediaCenter.exe PID 1464 wrote to memory of 5076 1464 cmd.exe PING.EXE PID 1464 wrote to memory of 5076 1464 cmd.exe PING.EXE PID 1464 wrote to memory of 5076 1464 cmd.exe PING.EXE PID 4008 wrote to memory of 1028 4008 cmd.exe reg.exe PID 4008 wrote to memory of 1028 4008 cmd.exe reg.exe PID 4008 wrote to memory of 1028 4008 cmd.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6de45d12ecbb43adb995681c0fa32fef9aeeebc3b645105ce9d0d94a9781fdc8.exe"C:\Users\Admin\AppData\Local\Temp\6de45d12ecbb43adb995681c0fa32fef9aeeebc3b645105ce9d0d94a9781fdc8.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
PID:1028 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\6de45d12ecbb43adb995681c0fa32fef9aeeebc3b645105ce9d0d94a9781fdc8.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:5076 -
C:\Windows\SysWOW64\cmd.execmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe3⤵
- Executes dropped EXE
PID:1320
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
44KB
MD5bbcee5135f77f80170881250efa63dd8
SHA1791d6eb401d6f14d666a2f76b295a827ff8fcf4d
SHA256b759c4112c8ddfe7ae1adb8223dec24e17191eae3e7af33f260b20ac92d4d8d4
SHA512f59270cacd0e308ddb810ffa292e74e1d647da749b2994237373a3e48a41c00ec99b2994fde2d8798d7f88264971c55fdf82a5800dcab6d834b3bfc7b310ced6
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
44KB
MD5bbcee5135f77f80170881250efa63dd8
SHA1791d6eb401d6f14d666a2f76b295a827ff8fcf4d
SHA256b759c4112c8ddfe7ae1adb8223dec24e17191eae3e7af33f260b20ac92d4d8d4
SHA512f59270cacd0e308ddb810ffa292e74e1d647da749b2994237373a3e48a41c00ec99b2994fde2d8798d7f88264971c55fdf82a5800dcab6d834b3bfc7b310ced6
-
memory/1320-6-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/1320-7-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/3776-0-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB
-
memory/3776-2-0x0000000000400000-0x000000000040B000-memory.dmpFilesize
44KB