Analysis
-
max time kernel
136s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20231025-en -
resource tags
arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system -
submitted
11-11-2023 05:11
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.5cac1a606e13a1d16df08c202807f5f0.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
NEAS.5cac1a606e13a1d16df08c202807f5f0.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.5cac1a606e13a1d16df08c202807f5f0.exe
-
Size
67KB
-
MD5
5cac1a606e13a1d16df08c202807f5f0
-
SHA1
e75930c9cf14dce5125f653aa8b997eeaadf9f10
-
SHA256
6b7614ac78e4f5f0d9d3fed2d0a33796c449866555e3945b84ba36bfb435f510
-
SHA512
0caf9e64ca631cd1b2d4a68f9a2572fbe235b0288a13065aff84c9aff3d3a833406f67824e49fc05c4e5bf4514d43a16d31f01d187f1971b7fa99a290f6509b7
-
SSDEEP
768:u7Xezc/T6Zp14hyYtoVxYF9mHF1yD3BmNV8PsED3VK2+ZtyOjgO4r9vFAg2rq+:a6zqhyYtkYWI3BDYTjipvF2v
Malware Config
Extracted
sakula
http://www.we11point.com:443/view.asp?cookie=%s&type=%d&vid=%d
http://www.we11point.com:443/photo/%s.jpg?vid=%d
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2504 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 1720 MediaCenter.exe -
Loads dropped DLL 2 IoCs
Processes:
NEAS.5cac1a606e13a1d16df08c202807f5f0.exepid process 2092 NEAS.5cac1a606e13a1d16df08c202807f5f0.exe 2092 NEAS.5cac1a606e13a1d16df08c202807f5f0.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
NEAS.5cac1a606e13a1d16df08c202807f5f0.execmd.execmd.exedescription pid process target process PID 2092 wrote to memory of 1220 2092 NEAS.5cac1a606e13a1d16df08c202807f5f0.exe cmd.exe PID 2092 wrote to memory of 1220 2092 NEAS.5cac1a606e13a1d16df08c202807f5f0.exe cmd.exe PID 2092 wrote to memory of 1220 2092 NEAS.5cac1a606e13a1d16df08c202807f5f0.exe cmd.exe PID 2092 wrote to memory of 1220 2092 NEAS.5cac1a606e13a1d16df08c202807f5f0.exe cmd.exe PID 2092 wrote to memory of 1720 2092 NEAS.5cac1a606e13a1d16df08c202807f5f0.exe MediaCenter.exe PID 2092 wrote to memory of 1720 2092 NEAS.5cac1a606e13a1d16df08c202807f5f0.exe MediaCenter.exe PID 2092 wrote to memory of 1720 2092 NEAS.5cac1a606e13a1d16df08c202807f5f0.exe MediaCenter.exe PID 2092 wrote to memory of 1720 2092 NEAS.5cac1a606e13a1d16df08c202807f5f0.exe MediaCenter.exe PID 1220 wrote to memory of 2616 1220 cmd.exe reg.exe PID 1220 wrote to memory of 2616 1220 cmd.exe reg.exe PID 1220 wrote to memory of 2616 1220 cmd.exe reg.exe PID 1220 wrote to memory of 2616 1220 cmd.exe reg.exe PID 2092 wrote to memory of 2504 2092 NEAS.5cac1a606e13a1d16df08c202807f5f0.exe cmd.exe PID 2092 wrote to memory of 2504 2092 NEAS.5cac1a606e13a1d16df08c202807f5f0.exe cmd.exe PID 2092 wrote to memory of 2504 2092 NEAS.5cac1a606e13a1d16df08c202807f5f0.exe cmd.exe PID 2092 wrote to memory of 2504 2092 NEAS.5cac1a606e13a1d16df08c202807f5f0.exe cmd.exe PID 2504 wrote to memory of 2608 2504 cmd.exe PING.EXE PID 2504 wrote to memory of 2608 2504 cmd.exe PING.EXE PID 2504 wrote to memory of 2608 2504 cmd.exe PING.EXE PID 2504 wrote to memory of 2608 2504 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.5cac1a606e13a1d16df08c202807f5f0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.5cac1a606e13a1d16df08c202807f5f0.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:1720 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\NEAS.5cac1a606e13a1d16df08c202807f5f0.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:2608
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
67KB
MD5b1ba85e2cfcdaaf64fb1eb291ad3436e
SHA143bab7973ee77589e13eb6ee1dbfe14b3af0040e
SHA2563a337ccd70f3ad5ef287e8bd8b745b1ab959723bb222e7730d8f381c1c7128ea
SHA5124afc85ebe171b904ad545992c69d5e9d6f2d6e717d940be63737d24cfd4694c45a7f21b4db32484b4b61ac6c78495b9869e50f7a0a17816ad10761968777818b
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
67KB
MD5b1ba85e2cfcdaaf64fb1eb291ad3436e
SHA143bab7973ee77589e13eb6ee1dbfe14b3af0040e
SHA2563a337ccd70f3ad5ef287e8bd8b745b1ab959723bb222e7730d8f381c1c7128ea
SHA5124afc85ebe171b904ad545992c69d5e9d6f2d6e717d940be63737d24cfd4694c45a7f21b4db32484b4b61ac6c78495b9869e50f7a0a17816ad10761968777818b
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
67KB
MD5b1ba85e2cfcdaaf64fb1eb291ad3436e
SHA143bab7973ee77589e13eb6ee1dbfe14b3af0040e
SHA2563a337ccd70f3ad5ef287e8bd8b745b1ab959723bb222e7730d8f381c1c7128ea
SHA5124afc85ebe171b904ad545992c69d5e9d6f2d6e717d940be63737d24cfd4694c45a7f21b4db32484b4b61ac6c78495b9869e50f7a0a17816ad10761968777818b
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
67KB
MD5b1ba85e2cfcdaaf64fb1eb291ad3436e
SHA143bab7973ee77589e13eb6ee1dbfe14b3af0040e
SHA2563a337ccd70f3ad5ef287e8bd8b745b1ab959723bb222e7730d8f381c1c7128ea
SHA5124afc85ebe171b904ad545992c69d5e9d6f2d6e717d940be63737d24cfd4694c45a7f21b4db32484b4b61ac6c78495b9869e50f7a0a17816ad10761968777818b
-
memory/1720-13-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2092-0-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2092-1-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2092-10-0x00000000001B0000-0x00000000001BA000-memory.dmpFilesize
40KB
-
memory/2092-11-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2092-12-0x00000000001B0000-0x00000000001BA000-memory.dmpFilesize
40KB