Analysis
-
max time kernel
168s -
max time network
184s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
11-11-2023 06:01
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.9a34b739c35e37e7bffa7e46b73a0b50.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.9a34b739c35e37e7bffa7e46b73a0b50.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.9a34b739c35e37e7bffa7e46b73a0b50.exe
-
Size
40KB
-
MD5
9a34b739c35e37e7bffa7e46b73a0b50
-
SHA1
c0d7c30c0a973a501ef3365032607828a80ae2aa
-
SHA256
26fc1f02e0b88017b99d811342a5b00753a944832fcf94b2a08b59065eeaa590
-
SHA512
dcbb30236d5c4f76f124ac41507e51d5de37773f3a5b91223f6eba62015aba0b7305cfe6d875606d3ea3e10bebe7850c7b003873e95a6c973ab65c6362625b83
-
SSDEEP
768:q7Xezc/T6Zp14hyYtoVxYF9mHfCBJTAIO3OtYVo:G6zqhyYtkYW/CPnO3A
Malware Config
Extracted
sakula
http://www.we11point.com:443/view.asp?cookie=%s&type=%d&vid=%d
http://www.we11point.com:443/photo/%s.jpg?vid=%d
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 3580 MediaCenter.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
NEAS.9a34b739c35e37e7bffa7e46b73a0b50.execmd.execmd.exedescription pid process target process PID 1972 wrote to memory of 4176 1972 NEAS.9a34b739c35e37e7bffa7e46b73a0b50.exe cmd.exe PID 1972 wrote to memory of 4176 1972 NEAS.9a34b739c35e37e7bffa7e46b73a0b50.exe cmd.exe PID 1972 wrote to memory of 4176 1972 NEAS.9a34b739c35e37e7bffa7e46b73a0b50.exe cmd.exe PID 1972 wrote to memory of 3580 1972 NEAS.9a34b739c35e37e7bffa7e46b73a0b50.exe MediaCenter.exe PID 1972 wrote to memory of 3580 1972 NEAS.9a34b739c35e37e7bffa7e46b73a0b50.exe MediaCenter.exe PID 1972 wrote to memory of 3580 1972 NEAS.9a34b739c35e37e7bffa7e46b73a0b50.exe MediaCenter.exe PID 4176 wrote to memory of 5056 4176 cmd.exe reg.exe PID 4176 wrote to memory of 5056 4176 cmd.exe reg.exe PID 4176 wrote to memory of 5056 4176 cmd.exe reg.exe PID 1972 wrote to memory of 372 1972 NEAS.9a34b739c35e37e7bffa7e46b73a0b50.exe cmd.exe PID 1972 wrote to memory of 372 1972 NEAS.9a34b739c35e37e7bffa7e46b73a0b50.exe cmd.exe PID 1972 wrote to memory of 372 1972 NEAS.9a34b739c35e37e7bffa7e46b73a0b50.exe cmd.exe PID 372 wrote to memory of 5080 372 cmd.exe PING.EXE PID 372 wrote to memory of 5080 372 cmd.exe PING.EXE PID 372 wrote to memory of 5080 372 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.9a34b739c35e37e7bffa7e46b73a0b50.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.9a34b739c35e37e7bffa7e46b73a0b50.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:3580 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\NEAS.9a34b739c35e37e7bffa7e46b73a0b50.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:372 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:5080
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
40KB
MD5e1f2a812be2609e8da8a0a56557521d3
SHA1c33f9fa2f52d3edc05d0ac30a64c9d5062b71906
SHA256ce4af4c1fdcbeda0fc849b4557354a92dc092e6a17da185b0f6c0019131be969
SHA512c0b250b02f1991bd98d306f5c7dc4878990462809171e3faa4f11134679747cb7ca2be04490c1d021205ccd7b834240ff07be230aa74b4a1d06f53c7b552bd2a
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
40KB
MD5e1f2a812be2609e8da8a0a56557521d3
SHA1c33f9fa2f52d3edc05d0ac30a64c9d5062b71906
SHA256ce4af4c1fdcbeda0fc849b4557354a92dc092e6a17da185b0f6c0019131be969
SHA512c0b250b02f1991bd98d306f5c7dc4878990462809171e3faa4f11134679747cb7ca2be04490c1d021205ccd7b834240ff07be230aa74b4a1d06f53c7b552bd2a
-
memory/1972-0-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1972-1-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1972-3-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/3580-7-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/3580-8-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB