Analysis
-
max time kernel
152s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
11-11-2023 03:08
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.e1c2289916677c38e9adc385bb0361e0.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.e1c2289916677c38e9adc385bb0361e0.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.e1c2289916677c38e9adc385bb0361e0.exe
-
Size
72KB
-
MD5
e1c2289916677c38e9adc385bb0361e0
-
SHA1
0d7e7a5e4b9eb3c9f06ff55d3f6de300f109a6b1
-
SHA256
9da04acbfa0b64d3a456dd54d731edac905289980b7863cbe3dde4cdd457cd80
-
SHA512
ddd23364ab50a06e1374368cc58c5a838c6885df357178bb78559dd17cfe8d847b67f0ee2149531f5c3972603c6d978d411d0dccdd0b938b828da262e2fc35bd
-
SSDEEP
768:q7Xezc/T6Zp14hyYtoVxYF9mHfCBJTAIO3OtYVW6Qptwy1:G6zqhyYtkYW/CPnO3ajwy1
Malware Config
Extracted
sakula
http://www.we11point.com:443/view.asp?cookie=%s&type=%d&vid=%d
http://www.we11point.com:443/photo/%s.jpg?vid=%d
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 1556 MediaCenter.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
NEAS.e1c2289916677c38e9adc385bb0361e0.execmd.execmd.exedescription pid process target process PID 5076 wrote to memory of 1048 5076 NEAS.e1c2289916677c38e9adc385bb0361e0.exe cmd.exe PID 5076 wrote to memory of 1048 5076 NEAS.e1c2289916677c38e9adc385bb0361e0.exe cmd.exe PID 5076 wrote to memory of 1048 5076 NEAS.e1c2289916677c38e9adc385bb0361e0.exe cmd.exe PID 5076 wrote to memory of 1556 5076 NEAS.e1c2289916677c38e9adc385bb0361e0.exe MediaCenter.exe PID 5076 wrote to memory of 1556 5076 NEAS.e1c2289916677c38e9adc385bb0361e0.exe MediaCenter.exe PID 5076 wrote to memory of 1556 5076 NEAS.e1c2289916677c38e9adc385bb0361e0.exe MediaCenter.exe PID 1048 wrote to memory of 4132 1048 cmd.exe reg.exe PID 1048 wrote to memory of 4132 1048 cmd.exe reg.exe PID 1048 wrote to memory of 4132 1048 cmd.exe reg.exe PID 5076 wrote to memory of 1484 5076 NEAS.e1c2289916677c38e9adc385bb0361e0.exe cmd.exe PID 5076 wrote to memory of 1484 5076 NEAS.e1c2289916677c38e9adc385bb0361e0.exe cmd.exe PID 5076 wrote to memory of 1484 5076 NEAS.e1c2289916677c38e9adc385bb0361e0.exe cmd.exe PID 1484 wrote to memory of 2480 1484 cmd.exe PING.EXE PID 1484 wrote to memory of 2480 1484 cmd.exe PING.EXE PID 1484 wrote to memory of 2480 1484 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.e1c2289916677c38e9adc385bb0361e0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.e1c2289916677c38e9adc385bb0361e0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:1556 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\NEAS.e1c2289916677c38e9adc385bb0361e0.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:2480
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
72KB
MD5a19b2a17a3ff43989df983348fb50d66
SHA174045e8d9e47979397cb505c6bf055ba66fa93e7
SHA25603b6300da5e19d4e22b0601f059f3d99f7b0ec424bff94b926bfec8463dccce4
SHA512775854f9bc7a7e91f2f5fd369b4f073810dde3f6d5c42e157e150039c4b4d779f8389bb1fe61198550c5a8f455d5ccb19f916f3cf3c847bfecc1c7f2037d6477
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
72KB
MD5a19b2a17a3ff43989df983348fb50d66
SHA174045e8d9e47979397cb505c6bf055ba66fa93e7
SHA25603b6300da5e19d4e22b0601f059f3d99f7b0ec424bff94b926bfec8463dccce4
SHA512775854f9bc7a7e91f2f5fd369b4f073810dde3f6d5c42e157e150039c4b4d779f8389bb1fe61198550c5a8f455d5ccb19f916f3cf3c847bfecc1c7f2037d6477
-
memory/1556-6-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1556-7-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/5076-0-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/5076-2-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB