Analysis
-
max time kernel
123s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
11-11-2023 03:08
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.e1c2289916677c38e9adc385bb0361e0.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.e1c2289916677c38e9adc385bb0361e0.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.e1c2289916677c38e9adc385bb0361e0.exe
-
Size
72KB
-
MD5
e1c2289916677c38e9adc385bb0361e0
-
SHA1
0d7e7a5e4b9eb3c9f06ff55d3f6de300f109a6b1
-
SHA256
9da04acbfa0b64d3a456dd54d731edac905289980b7863cbe3dde4cdd457cd80
-
SHA512
ddd23364ab50a06e1374368cc58c5a838c6885df357178bb78559dd17cfe8d847b67f0ee2149531f5c3972603c6d978d411d0dccdd0b938b828da262e2fc35bd
-
SSDEEP
768:q7Xezc/T6Zp14hyYtoVxYF9mHfCBJTAIO3OtYVW6Qptwy1:G6zqhyYtkYW/CPnO3ajwy1
Malware Config
Extracted
sakula
http://www.we11point.com:443/view.asp?cookie=%s&type=%d&vid=%d
http://www.we11point.com:443/photo/%s.jpg?vid=%d
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2984 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 3060 MediaCenter.exe -
Loads dropped DLL 2 IoCs
Processes:
NEAS.e1c2289916677c38e9adc385bb0361e0.exepid process 2516 NEAS.e1c2289916677c38e9adc385bb0361e0.exe 2516 NEAS.e1c2289916677c38e9adc385bb0361e0.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
NEAS.e1c2289916677c38e9adc385bb0361e0.execmd.execmd.exedescription pid process target process PID 2516 wrote to memory of 1468 2516 NEAS.e1c2289916677c38e9adc385bb0361e0.exe cmd.exe PID 2516 wrote to memory of 1468 2516 NEAS.e1c2289916677c38e9adc385bb0361e0.exe cmd.exe PID 2516 wrote to memory of 1468 2516 NEAS.e1c2289916677c38e9adc385bb0361e0.exe cmd.exe PID 2516 wrote to memory of 1468 2516 NEAS.e1c2289916677c38e9adc385bb0361e0.exe cmd.exe PID 2516 wrote to memory of 3060 2516 NEAS.e1c2289916677c38e9adc385bb0361e0.exe MediaCenter.exe PID 2516 wrote to memory of 3060 2516 NEAS.e1c2289916677c38e9adc385bb0361e0.exe MediaCenter.exe PID 2516 wrote to memory of 3060 2516 NEAS.e1c2289916677c38e9adc385bb0361e0.exe MediaCenter.exe PID 2516 wrote to memory of 3060 2516 NEAS.e1c2289916677c38e9adc385bb0361e0.exe MediaCenter.exe PID 1468 wrote to memory of 2704 1468 cmd.exe reg.exe PID 1468 wrote to memory of 2704 1468 cmd.exe reg.exe PID 1468 wrote to memory of 2704 1468 cmd.exe reg.exe PID 1468 wrote to memory of 2704 1468 cmd.exe reg.exe PID 2516 wrote to memory of 2984 2516 NEAS.e1c2289916677c38e9adc385bb0361e0.exe cmd.exe PID 2516 wrote to memory of 2984 2516 NEAS.e1c2289916677c38e9adc385bb0361e0.exe cmd.exe PID 2516 wrote to memory of 2984 2516 NEAS.e1c2289916677c38e9adc385bb0361e0.exe cmd.exe PID 2516 wrote to memory of 2984 2516 NEAS.e1c2289916677c38e9adc385bb0361e0.exe cmd.exe PID 2984 wrote to memory of 2352 2984 cmd.exe PING.EXE PID 2984 wrote to memory of 2352 2984 cmd.exe PING.EXE PID 2984 wrote to memory of 2352 2984 cmd.exe PING.EXE PID 2984 wrote to memory of 2352 2984 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.e1c2289916677c38e9adc385bb0361e0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.e1c2289916677c38e9adc385bb0361e0.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:3060 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\NEAS.e1c2289916677c38e9adc385bb0361e0.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:2352
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
72KB
MD5b79a08a4d37139daf11cd5e2ca8fd1ba
SHA1f1c30fa48804aeeb08f465abf19a2c2ba14a8e72
SHA25674ab276e46f6b969fd31ee0473fd6b9cbd7ad0ab22de560afcd6b85f9d515b8c
SHA512a6badf7554017b02ba3b16dfb86903ff45c08a6a674167d10be0bcc22e3ac474ee3724195900a41476d6932c3a34708d3ef3e3aa5dfacbded746aa7c4525115a
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
72KB
MD5b79a08a4d37139daf11cd5e2ca8fd1ba
SHA1f1c30fa48804aeeb08f465abf19a2c2ba14a8e72
SHA25674ab276e46f6b969fd31ee0473fd6b9cbd7ad0ab22de560afcd6b85f9d515b8c
SHA512a6badf7554017b02ba3b16dfb86903ff45c08a6a674167d10be0bcc22e3ac474ee3724195900a41476d6932c3a34708d3ef3e3aa5dfacbded746aa7c4525115a
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
72KB
MD5b79a08a4d37139daf11cd5e2ca8fd1ba
SHA1f1c30fa48804aeeb08f465abf19a2c2ba14a8e72
SHA25674ab276e46f6b969fd31ee0473fd6b9cbd7ad0ab22de560afcd6b85f9d515b8c
SHA512a6badf7554017b02ba3b16dfb86903ff45c08a6a674167d10be0bcc22e3ac474ee3724195900a41476d6932c3a34708d3ef3e3aa5dfacbded746aa7c4525115a
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
72KB
MD5b79a08a4d37139daf11cd5e2ca8fd1ba
SHA1f1c30fa48804aeeb08f465abf19a2c2ba14a8e72
SHA25674ab276e46f6b969fd31ee0473fd6b9cbd7ad0ab22de560afcd6b85f9d515b8c
SHA512a6badf7554017b02ba3b16dfb86903ff45c08a6a674167d10be0bcc22e3ac474ee3724195900a41476d6932c3a34708d3ef3e3aa5dfacbded746aa7c4525115a
-
memory/2516-0-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2516-1-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2516-5-0x0000000000220000-0x000000000022A000-memory.dmpFilesize
40KB
-
memory/2516-12-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2516-13-0x0000000000220000-0x000000000022A000-memory.dmpFilesize
40KB
-
memory/3060-11-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/3060-14-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB