Analysis
-
max time kernel
192s -
max time network
225s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
11-11-2023 05:11
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.5cac1a606e13a1d16df08c202807f5f0.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
NEAS.5cac1a606e13a1d16df08c202807f5f0.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.5cac1a606e13a1d16df08c202807f5f0.exe
-
Size
67KB
-
MD5
5cac1a606e13a1d16df08c202807f5f0
-
SHA1
e75930c9cf14dce5125f653aa8b997eeaadf9f10
-
SHA256
6b7614ac78e4f5f0d9d3fed2d0a33796c449866555e3945b84ba36bfb435f510
-
SHA512
0caf9e64ca631cd1b2d4a68f9a2572fbe235b0288a13065aff84c9aff3d3a833406f67824e49fc05c4e5bf4514d43a16d31f01d187f1971b7fa99a290f6509b7
-
SSDEEP
768:u7Xezc/T6Zp14hyYtoVxYF9mHF1yD3BmNV8PsED3VK2+ZtyOjgO4r9vFAg2rq+:a6zqhyYtkYWI3BDYTjipvF2v
Malware Config
Extracted
sakula
http://www.we11point.com:443/view.asp?cookie=%s&type=%d&vid=%d
http://www.we11point.com:443/photo/%s.jpg?vid=%d
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 2056 MediaCenter.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
NEAS.5cac1a606e13a1d16df08c202807f5f0.execmd.execmd.exedescription pid process target process PID 3304 wrote to memory of 3692 3304 NEAS.5cac1a606e13a1d16df08c202807f5f0.exe cmd.exe PID 3304 wrote to memory of 3692 3304 NEAS.5cac1a606e13a1d16df08c202807f5f0.exe cmd.exe PID 3304 wrote to memory of 3692 3304 NEAS.5cac1a606e13a1d16df08c202807f5f0.exe cmd.exe PID 3304 wrote to memory of 2056 3304 NEAS.5cac1a606e13a1d16df08c202807f5f0.exe MediaCenter.exe PID 3304 wrote to memory of 2056 3304 NEAS.5cac1a606e13a1d16df08c202807f5f0.exe MediaCenter.exe PID 3304 wrote to memory of 2056 3304 NEAS.5cac1a606e13a1d16df08c202807f5f0.exe MediaCenter.exe PID 3692 wrote to memory of 4988 3692 cmd.exe reg.exe PID 3692 wrote to memory of 4988 3692 cmd.exe reg.exe PID 3692 wrote to memory of 4988 3692 cmd.exe reg.exe PID 3304 wrote to memory of 1572 3304 NEAS.5cac1a606e13a1d16df08c202807f5f0.exe cmd.exe PID 3304 wrote to memory of 1572 3304 NEAS.5cac1a606e13a1d16df08c202807f5f0.exe cmd.exe PID 3304 wrote to memory of 1572 3304 NEAS.5cac1a606e13a1d16df08c202807f5f0.exe cmd.exe PID 1572 wrote to memory of 696 1572 cmd.exe PING.EXE PID 1572 wrote to memory of 696 1572 cmd.exe PING.EXE PID 1572 wrote to memory of 696 1572 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.5cac1a606e13a1d16df08c202807f5f0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.5cac1a606e13a1d16df08c202807f5f0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:2056 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\NEAS.5cac1a606e13a1d16df08c202807f5f0.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:696
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
67KB
MD53f7e78ec0f0320167cb0b2a82c92d5de
SHA127ae09d18c47dfbac97b5b26246ad51f661d9cb7
SHA256c897809363e00200817694ee6afe1e99542d3e1f06eb70b9b301a191cb445f4e
SHA512b3d2109c28e82e5f414f3236567f75881c640dba8a17a6df628ae895357ff6d10338647988d7274cfaf85bd352230b5623883c66311921011c645368f573fba5
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
67KB
MD53f7e78ec0f0320167cb0b2a82c92d5de
SHA127ae09d18c47dfbac97b5b26246ad51f661d9cb7
SHA256c897809363e00200817694ee6afe1e99542d3e1f06eb70b9b301a191cb445f4e
SHA512b3d2109c28e82e5f414f3236567f75881c640dba8a17a6df628ae895357ff6d10338647988d7274cfaf85bd352230b5623883c66311921011c645368f573fba5
-
memory/2056-7-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/3304-0-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/3304-1-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/3304-3-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB