Analysis
-
max time kernel
206s -
max time network
235s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
11-11-2023 03:01
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.fe05506095a768ea6ce511f3204c4020.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.fe05506095a768ea6ce511f3204c4020.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.fe05506095a768ea6ce511f3204c4020.exe
-
Size
72KB
-
MD5
fe05506095a768ea6ce511f3204c4020
-
SHA1
14c9560f508f886d8e555315a4476f69ab21a6c6
-
SHA256
61294488291d45b3825769e81fa83fba201fe06b1a35f180c8fbe3c6a6776049
-
SHA512
820f38477c4d49ad271898a49f5deaafbc48aa239549f6e6bdfce6c568824a9f5ebf08dd1c94521864774abf56f60d33435e2bcd56d3acce8627fa7a3596fa67
-
SSDEEP
768:q7Xezc/T6Zp14hyYtoVxYF9mHfCBJTAIO3OtYVW6QptwyH:G6zqhyYtkYW/CPnO3ajwyH
Malware Config
Extracted
sakula
http://www.we11point.com:443/view.asp?cookie=%s&type=%d&vid=%d
http://www.we11point.com:443/photo/%s.jpg?vid=%d
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1644 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 2504 MediaCenter.exe -
Loads dropped DLL 2 IoCs
Processes:
NEAS.fe05506095a768ea6ce511f3204c4020.exepid process 2604 NEAS.fe05506095a768ea6ce511f3204c4020.exe 2604 NEAS.fe05506095a768ea6ce511f3204c4020.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
NEAS.fe05506095a768ea6ce511f3204c4020.execmd.execmd.exedescription pid process target process PID 2604 wrote to memory of 2516 2604 NEAS.fe05506095a768ea6ce511f3204c4020.exe cmd.exe PID 2604 wrote to memory of 2516 2604 NEAS.fe05506095a768ea6ce511f3204c4020.exe cmd.exe PID 2604 wrote to memory of 2516 2604 NEAS.fe05506095a768ea6ce511f3204c4020.exe cmd.exe PID 2604 wrote to memory of 2516 2604 NEAS.fe05506095a768ea6ce511f3204c4020.exe cmd.exe PID 2516 wrote to memory of 2896 2516 cmd.exe reg.exe PID 2516 wrote to memory of 2896 2516 cmd.exe reg.exe PID 2516 wrote to memory of 2896 2516 cmd.exe reg.exe PID 2516 wrote to memory of 2896 2516 cmd.exe reg.exe PID 2604 wrote to memory of 2504 2604 NEAS.fe05506095a768ea6ce511f3204c4020.exe MediaCenter.exe PID 2604 wrote to memory of 2504 2604 NEAS.fe05506095a768ea6ce511f3204c4020.exe MediaCenter.exe PID 2604 wrote to memory of 2504 2604 NEAS.fe05506095a768ea6ce511f3204c4020.exe MediaCenter.exe PID 2604 wrote to memory of 2504 2604 NEAS.fe05506095a768ea6ce511f3204c4020.exe MediaCenter.exe PID 2604 wrote to memory of 1644 2604 NEAS.fe05506095a768ea6ce511f3204c4020.exe cmd.exe PID 2604 wrote to memory of 1644 2604 NEAS.fe05506095a768ea6ce511f3204c4020.exe cmd.exe PID 2604 wrote to memory of 1644 2604 NEAS.fe05506095a768ea6ce511f3204c4020.exe cmd.exe PID 2604 wrote to memory of 1644 2604 NEAS.fe05506095a768ea6ce511f3204c4020.exe cmd.exe PID 1644 wrote to memory of 296 1644 cmd.exe PING.EXE PID 1644 wrote to memory of 296 1644 cmd.exe PING.EXE PID 1644 wrote to memory of 296 1644 cmd.exe PING.EXE PID 1644 wrote to memory of 296 1644 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.fe05506095a768ea6ce511f3204c4020.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.fe05506095a768ea6ce511f3204c4020.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:2504 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\NEAS.fe05506095a768ea6ce511f3204c4020.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:296
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
72KB
MD5bc01fb55eca5cc9538fe58f779d0d710
SHA18cbf65d3c0996aead4db96d5304e75371bcfb80d
SHA2563e8394dd305c32c9cb9166b4b955421716bc9341f34582b18fceeeb0eb6b4e7f
SHA51251163d802e5c903307a8795119cbd8a7b9040238f833dee064b4f44717a84f26cfbaafaed91517fb70e24af98c674dcf3948e381b927da2f23a4d38170f8f507
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
72KB
MD5bc01fb55eca5cc9538fe58f779d0d710
SHA18cbf65d3c0996aead4db96d5304e75371bcfb80d
SHA2563e8394dd305c32c9cb9166b4b955421716bc9341f34582b18fceeeb0eb6b4e7f
SHA51251163d802e5c903307a8795119cbd8a7b9040238f833dee064b4f44717a84f26cfbaafaed91517fb70e24af98c674dcf3948e381b927da2f23a4d38170f8f507
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
72KB
MD5bc01fb55eca5cc9538fe58f779d0d710
SHA18cbf65d3c0996aead4db96d5304e75371bcfb80d
SHA2563e8394dd305c32c9cb9166b4b955421716bc9341f34582b18fceeeb0eb6b4e7f
SHA51251163d802e5c903307a8795119cbd8a7b9040238f833dee064b4f44717a84f26cfbaafaed91517fb70e24af98c674dcf3948e381b927da2f23a4d38170f8f507
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
72KB
MD5bc01fb55eca5cc9538fe58f779d0d710
SHA18cbf65d3c0996aead4db96d5304e75371bcfb80d
SHA2563e8394dd305c32c9cb9166b4b955421716bc9341f34582b18fceeeb0eb6b4e7f
SHA51251163d802e5c903307a8795119cbd8a7b9040238f833dee064b4f44717a84f26cfbaafaed91517fb70e24af98c674dcf3948e381b927da2f23a4d38170f8f507
-
memory/2504-11-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2504-14-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2604-0-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2604-1-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2604-10-0x0000000000220000-0x000000000022A000-memory.dmpFilesize
40KB
-
memory/2604-12-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2604-13-0x0000000000220000-0x000000000022A000-memory.dmpFilesize
40KB