Analysis
-
max time kernel
137s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
15-11-2023 06:57
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.d19f155c08dd3c74c5054db14a3a9e20.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.d19f155c08dd3c74c5054db14a3a9e20.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.d19f155c08dd3c74c5054db14a3a9e20.exe
-
Size
67KB
-
MD5
d19f155c08dd3c74c5054db14a3a9e20
-
SHA1
9bf1740dc739b076b9827a0700663e62c97e8f9c
-
SHA256
e520e77cef483db5b8dd39efecdcf73989970d32c5c37690fdf77158bdd3514d
-
SHA512
b76a2a8dce84db2166e3ef9e71edfab9000d8b1fdc745bc5183857c702a67c02c6298789745bd96ed232a06162fca04f9e26c6c4d11fe443cf7167a43f33537a
-
SSDEEP
768:u7Xezc/T6Zp14hyYtoVxYF9mHF1yD3BmNV8PsED3VK2+ZtyOjgO4r9vFAg2rqi:a6zqhyYtkYWI3BDYTjipvF2L
Malware Config
Extracted
sakula
http://www.we11point.com:443/view.asp?cookie=%s&type=%d&vid=%d
http://www.we11point.com:443/photo/%s.jpg?vid=%d
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 3592 MediaCenter.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
NEAS.d19f155c08dd3c74c5054db14a3a9e20.execmd.execmd.exedescription pid process target process PID 4488 wrote to memory of 1600 4488 NEAS.d19f155c08dd3c74c5054db14a3a9e20.exe cmd.exe PID 4488 wrote to memory of 1600 4488 NEAS.d19f155c08dd3c74c5054db14a3a9e20.exe cmd.exe PID 4488 wrote to memory of 1600 4488 NEAS.d19f155c08dd3c74c5054db14a3a9e20.exe cmd.exe PID 4488 wrote to memory of 3592 4488 NEAS.d19f155c08dd3c74c5054db14a3a9e20.exe MediaCenter.exe PID 4488 wrote to memory of 3592 4488 NEAS.d19f155c08dd3c74c5054db14a3a9e20.exe MediaCenter.exe PID 4488 wrote to memory of 3592 4488 NEAS.d19f155c08dd3c74c5054db14a3a9e20.exe MediaCenter.exe PID 1600 wrote to memory of 1536 1600 cmd.exe reg.exe PID 1600 wrote to memory of 1536 1600 cmd.exe reg.exe PID 1600 wrote to memory of 1536 1600 cmd.exe reg.exe PID 4488 wrote to memory of 1772 4488 NEAS.d19f155c08dd3c74c5054db14a3a9e20.exe cmd.exe PID 4488 wrote to memory of 1772 4488 NEAS.d19f155c08dd3c74c5054db14a3a9e20.exe cmd.exe PID 4488 wrote to memory of 1772 4488 NEAS.d19f155c08dd3c74c5054db14a3a9e20.exe cmd.exe PID 1772 wrote to memory of 3928 1772 cmd.exe PING.EXE PID 1772 wrote to memory of 3928 1772 cmd.exe PING.EXE PID 1772 wrote to memory of 3928 1772 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.d19f155c08dd3c74c5054db14a3a9e20.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.d19f155c08dd3c74c5054db14a3a9e20.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:3592 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\NEAS.d19f155c08dd3c74c5054db14a3a9e20.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:3928
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
67KB
MD570e2657e7963fe47d6bca4db7f8f4efa
SHA1a7a8d345581bc8e8ad32ee87f577f7eb174e1eee
SHA256e258b43f229ed4829ec5443821da635e3b61180c2d596698b8e9773df19924b0
SHA512e3f4770de2b4c0640d1b6f80fe8648573e9733d1bf086a75705d4073897fbb3d1774a76ff1b36bc470c38a81f4a841218f2429048cf76018d6e53865a6739f0f
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
67KB
MD570e2657e7963fe47d6bca4db7f8f4efa
SHA1a7a8d345581bc8e8ad32ee87f577f7eb174e1eee
SHA256e258b43f229ed4829ec5443821da635e3b61180c2d596698b8e9773df19924b0
SHA512e3f4770de2b4c0640d1b6f80fe8648573e9733d1bf086a75705d4073897fbb3d1774a76ff1b36bc470c38a81f4a841218f2429048cf76018d6e53865a6739f0f
-
memory/3592-6-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/3592-7-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/3592-8-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/4488-0-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/4488-1-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB