Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
12-11-2023 09:42
Behavioral task
behavioral1
Sample
NEAS.0874c72cf3157536d1c3d17ce83313f0.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.0874c72cf3157536d1c3d17ce83313f0.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.0874c72cf3157536d1c3d17ce83313f0.exe
-
Size
101KB
-
MD5
0874c72cf3157536d1c3d17ce83313f0
-
SHA1
f92a67d41abf9ae8de071e721964e8071540863a
-
SHA256
ca219104cc6495a3e0956e17f5ab480d270e45df82ebc09319a98110c6f44413
-
SHA512
349d519d74a727812d40aef9465b2735424201d6c30cbe1eb3c62f6d0475570b440402674ef8bafb57e63f3cd4328e8d50e92b5de138ac0b6154f56d9042df13
-
SSDEEP
1536:9JbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtrfPTEz2:/bfVk29te2jqxCEtg30BLbEK
Malware Config
Extracted
sakula
www.savmpet.com
Signatures
-
Sakula payload 6 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula \Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula \Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula \Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2716 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
AdobeUpdate.exepid process 2920 AdobeUpdate.exe -
Loads dropped DLL 4 IoCs
Processes:
NEAS.0874c72cf3157536d1c3d17ce83313f0.exeAdobeUpdate.exepid process 2028 NEAS.0874c72cf3157536d1c3d17ce83313f0.exe 2920 AdobeUpdate.exe 2920 AdobeUpdate.exe 2920 AdobeUpdate.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
NEAS.0874c72cf3157536d1c3d17ce83313f0.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AdobeUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\AdobeUpdate.exe" NEAS.0874c72cf3157536d1c3d17ce83313f0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
NEAS.0874c72cf3157536d1c3d17ce83313f0.exedescription pid process Token: SeIncBasePriorityPrivilege 2028 NEAS.0874c72cf3157536d1c3d17ce83313f0.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
NEAS.0874c72cf3157536d1c3d17ce83313f0.execmd.exedescription pid process target process PID 2028 wrote to memory of 2920 2028 NEAS.0874c72cf3157536d1c3d17ce83313f0.exe AdobeUpdate.exe PID 2028 wrote to memory of 2920 2028 NEAS.0874c72cf3157536d1c3d17ce83313f0.exe AdobeUpdate.exe PID 2028 wrote to memory of 2920 2028 NEAS.0874c72cf3157536d1c3d17ce83313f0.exe AdobeUpdate.exe PID 2028 wrote to memory of 2920 2028 NEAS.0874c72cf3157536d1c3d17ce83313f0.exe AdobeUpdate.exe PID 2028 wrote to memory of 2920 2028 NEAS.0874c72cf3157536d1c3d17ce83313f0.exe AdobeUpdate.exe PID 2028 wrote to memory of 2920 2028 NEAS.0874c72cf3157536d1c3d17ce83313f0.exe AdobeUpdate.exe PID 2028 wrote to memory of 2920 2028 NEAS.0874c72cf3157536d1c3d17ce83313f0.exe AdobeUpdate.exe PID 2028 wrote to memory of 2716 2028 NEAS.0874c72cf3157536d1c3d17ce83313f0.exe cmd.exe PID 2028 wrote to memory of 2716 2028 NEAS.0874c72cf3157536d1c3d17ce83313f0.exe cmd.exe PID 2028 wrote to memory of 2716 2028 NEAS.0874c72cf3157536d1c3d17ce83313f0.exe cmd.exe PID 2028 wrote to memory of 2716 2028 NEAS.0874c72cf3157536d1c3d17ce83313f0.exe cmd.exe PID 2716 wrote to memory of 2616 2716 cmd.exe PING.EXE PID 2716 wrote to memory of 2616 2716 cmd.exe PING.EXE PID 2716 wrote to memory of 2616 2716 cmd.exe PING.EXE PID 2716 wrote to memory of 2616 2716 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.0874c72cf3157536d1c3d17ce83313f0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.0874c72cf3157536d1c3d17ce83313f0.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2920 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\NEAS.0874c72cf3157536d1c3d17ce83313f0.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:2616
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeFilesize
101KB
MD514e80e0c556b305d953cd8fa4b8f1f6a
SHA1c05cf15c032ca06dc9ead2d37964159afc4fbba8
SHA256524778b51d633ab4e170fc029cd63c01b950a31422386b60e8067113609e06b5
SHA5129fa055ab95d329e75ed535a10768286b4df753f149ca6dfd0e7d7c7e5d83af07b069018a51c9f0b135d24f078f23a7c9f3ee1672b207c19df1171ccee9892676
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeFilesize
101KB
MD514e80e0c556b305d953cd8fa4b8f1f6a
SHA1c05cf15c032ca06dc9ead2d37964159afc4fbba8
SHA256524778b51d633ab4e170fc029cd63c01b950a31422386b60e8067113609e06b5
SHA5129fa055ab95d329e75ed535a10768286b4df753f149ca6dfd0e7d7c7e5d83af07b069018a51c9f0b135d24f078f23a7c9f3ee1672b207c19df1171ccee9892676
-
\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeFilesize
101KB
MD514e80e0c556b305d953cd8fa4b8f1f6a
SHA1c05cf15c032ca06dc9ead2d37964159afc4fbba8
SHA256524778b51d633ab4e170fc029cd63c01b950a31422386b60e8067113609e06b5
SHA5129fa055ab95d329e75ed535a10768286b4df753f149ca6dfd0e7d7c7e5d83af07b069018a51c9f0b135d24f078f23a7c9f3ee1672b207c19df1171ccee9892676
-
\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeFilesize
101KB
MD514e80e0c556b305d953cd8fa4b8f1f6a
SHA1c05cf15c032ca06dc9ead2d37964159afc4fbba8
SHA256524778b51d633ab4e170fc029cd63c01b950a31422386b60e8067113609e06b5
SHA5129fa055ab95d329e75ed535a10768286b4df753f149ca6dfd0e7d7c7e5d83af07b069018a51c9f0b135d24f078f23a7c9f3ee1672b207c19df1171ccee9892676
-
\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeFilesize
101KB
MD514e80e0c556b305d953cd8fa4b8f1f6a
SHA1c05cf15c032ca06dc9ead2d37964159afc4fbba8
SHA256524778b51d633ab4e170fc029cd63c01b950a31422386b60e8067113609e06b5
SHA5129fa055ab95d329e75ed535a10768286b4df753f149ca6dfd0e7d7c7e5d83af07b069018a51c9f0b135d24f078f23a7c9f3ee1672b207c19df1171ccee9892676
-
\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeFilesize
101KB
MD514e80e0c556b305d953cd8fa4b8f1f6a
SHA1c05cf15c032ca06dc9ead2d37964159afc4fbba8
SHA256524778b51d633ab4e170fc029cd63c01b950a31422386b60e8067113609e06b5
SHA5129fa055ab95d329e75ed535a10768286b4df753f149ca6dfd0e7d7c7e5d83af07b069018a51c9f0b135d24f078f23a7c9f3ee1672b207c19df1171ccee9892676