Analysis
-
max time kernel
118s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
11-11-2023 13:08
Behavioral task
behavioral1
Sample
NEAS.4ec630cb3c17ea868f7684de52474290.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.4ec630cb3c17ea868f7684de52474290.exe
Resource
win10v2004-20231025-en
General
-
Target
NEAS.4ec630cb3c17ea868f7684de52474290.exe
-
Size
101KB
-
MD5
4ec630cb3c17ea868f7684de52474290
-
SHA1
f1341276ad3ecc993872f479aef8a03a72a0dd33
-
SHA256
b5fc2ab9a024851867a3bd70e662db6fd1ce3ef724c77f2b39bbda7f13407585
-
SHA512
635af0624ed899dd5955025989e883de099f150bd3c7133fcb07670bb4ca06b9002dffea91c1db9bdea7a2398ef4980ce0bb79743696eeb3d6a1383c0093e604
-
SSDEEP
1536:9JbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtrfPTEzW:/bfVk29te2jqxCEtg30BLbEq
Malware Config
Extracted
sakula
www.savmpet.com
Signatures
-
Sakula payload 6 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula \Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula \Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula \Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2788 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
AdobeUpdate.exepid process 2044 AdobeUpdate.exe -
Loads dropped DLL 4 IoCs
Processes:
NEAS.4ec630cb3c17ea868f7684de52474290.exeAdobeUpdate.exepid process 2196 NEAS.4ec630cb3c17ea868f7684de52474290.exe 2044 AdobeUpdate.exe 2044 AdobeUpdate.exe 2044 AdobeUpdate.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
NEAS.4ec630cb3c17ea868f7684de52474290.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AdobeUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\AdobeUpdate.exe" NEAS.4ec630cb3c17ea868f7684de52474290.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
NEAS.4ec630cb3c17ea868f7684de52474290.exedescription pid process Token: SeIncBasePriorityPrivilege 2196 NEAS.4ec630cb3c17ea868f7684de52474290.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
NEAS.4ec630cb3c17ea868f7684de52474290.execmd.exedescription pid process target process PID 2196 wrote to memory of 2044 2196 NEAS.4ec630cb3c17ea868f7684de52474290.exe AdobeUpdate.exe PID 2196 wrote to memory of 2044 2196 NEAS.4ec630cb3c17ea868f7684de52474290.exe AdobeUpdate.exe PID 2196 wrote to memory of 2044 2196 NEAS.4ec630cb3c17ea868f7684de52474290.exe AdobeUpdate.exe PID 2196 wrote to memory of 2044 2196 NEAS.4ec630cb3c17ea868f7684de52474290.exe AdobeUpdate.exe PID 2196 wrote to memory of 2044 2196 NEAS.4ec630cb3c17ea868f7684de52474290.exe AdobeUpdate.exe PID 2196 wrote to memory of 2044 2196 NEAS.4ec630cb3c17ea868f7684de52474290.exe AdobeUpdate.exe PID 2196 wrote to memory of 2044 2196 NEAS.4ec630cb3c17ea868f7684de52474290.exe AdobeUpdate.exe PID 2196 wrote to memory of 2788 2196 NEAS.4ec630cb3c17ea868f7684de52474290.exe cmd.exe PID 2196 wrote to memory of 2788 2196 NEAS.4ec630cb3c17ea868f7684de52474290.exe cmd.exe PID 2196 wrote to memory of 2788 2196 NEAS.4ec630cb3c17ea868f7684de52474290.exe cmd.exe PID 2196 wrote to memory of 2788 2196 NEAS.4ec630cb3c17ea868f7684de52474290.exe cmd.exe PID 2788 wrote to memory of 2856 2788 cmd.exe PING.EXE PID 2788 wrote to memory of 2856 2788 cmd.exe PING.EXE PID 2788 wrote to memory of 2856 2788 cmd.exe PING.EXE PID 2788 wrote to memory of 2856 2788 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.4ec630cb3c17ea868f7684de52474290.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.4ec630cb3c17ea868f7684de52474290.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2044 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\NEAS.4ec630cb3c17ea868f7684de52474290.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:2856
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeFilesize
101KB
MD5e352f4f35d9af71b6607027dd944cc22
SHA19d3a20305345e2d5b73d84ae57e3eb053484a51c
SHA25646846a781c22be18368d20d1a5e4a8e3b58e01a75108cf8df55c6fd05aa16680
SHA512569b4bbf46857e98d29b1e169f480cbbbab8b80ce26cd8ad1e1f0da9586b64d588392cc25da62bccf6231eaf24c91270d1db0451a6ae348640ab628aae8f1c1c
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeFilesize
101KB
MD5e352f4f35d9af71b6607027dd944cc22
SHA19d3a20305345e2d5b73d84ae57e3eb053484a51c
SHA25646846a781c22be18368d20d1a5e4a8e3b58e01a75108cf8df55c6fd05aa16680
SHA512569b4bbf46857e98d29b1e169f480cbbbab8b80ce26cd8ad1e1f0da9586b64d588392cc25da62bccf6231eaf24c91270d1db0451a6ae348640ab628aae8f1c1c
-
\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeFilesize
101KB
MD5e352f4f35d9af71b6607027dd944cc22
SHA19d3a20305345e2d5b73d84ae57e3eb053484a51c
SHA25646846a781c22be18368d20d1a5e4a8e3b58e01a75108cf8df55c6fd05aa16680
SHA512569b4bbf46857e98d29b1e169f480cbbbab8b80ce26cd8ad1e1f0da9586b64d588392cc25da62bccf6231eaf24c91270d1db0451a6ae348640ab628aae8f1c1c
-
\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeFilesize
101KB
MD5e352f4f35d9af71b6607027dd944cc22
SHA19d3a20305345e2d5b73d84ae57e3eb053484a51c
SHA25646846a781c22be18368d20d1a5e4a8e3b58e01a75108cf8df55c6fd05aa16680
SHA512569b4bbf46857e98d29b1e169f480cbbbab8b80ce26cd8ad1e1f0da9586b64d588392cc25da62bccf6231eaf24c91270d1db0451a6ae348640ab628aae8f1c1c
-
\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeFilesize
101KB
MD5e352f4f35d9af71b6607027dd944cc22
SHA19d3a20305345e2d5b73d84ae57e3eb053484a51c
SHA25646846a781c22be18368d20d1a5e4a8e3b58e01a75108cf8df55c6fd05aa16680
SHA512569b4bbf46857e98d29b1e169f480cbbbab8b80ce26cd8ad1e1f0da9586b64d588392cc25da62bccf6231eaf24c91270d1db0451a6ae348640ab628aae8f1c1c
-
\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeFilesize
101KB
MD5e352f4f35d9af71b6607027dd944cc22
SHA19d3a20305345e2d5b73d84ae57e3eb053484a51c
SHA25646846a781c22be18368d20d1a5e4a8e3b58e01a75108cf8df55c6fd05aa16680
SHA512569b4bbf46857e98d29b1e169f480cbbbab8b80ce26cd8ad1e1f0da9586b64d588392cc25da62bccf6231eaf24c91270d1db0451a6ae348640ab628aae8f1c1c