Analysis
-
max time kernel
163s -
max time network
180s -
platform
windows7_x64 -
resource
win7-20231025-en -
resource tags
arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system -
submitted
18-11-2023 02:48
Behavioral task
behavioral1
Sample
NEAS.bdc85b65d3e97dc0c7652f16bd2e5d70.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
NEAS.bdc85b65d3e97dc0c7652f16bd2e5d70.exe
Resource
win10v2004-20231023-en
General
-
Target
NEAS.bdc85b65d3e97dc0c7652f16bd2e5d70.exe
-
Size
92KB
-
MD5
bdc85b65d3e97dc0c7652f16bd2e5d70
-
SHA1
1b5786e8e13e8367ab267c04f31802e6002ce891
-
SHA256
9280b0227c5afac24657d29984c2303baf48db2451e292345757ca5736cbc630
-
SHA512
da3039d6dc74c08c98be2e2c6ab7ac5d4bd368ae72bb1b0cf4cc05f2108bd48c1c1636566334cd06afc293c703e267cfb1195d6a02c001d81e28ca78a3eb7c37
-
SSDEEP
1536:TJbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtrf:9bfVk29te2jqxCEtg30B7
Malware Config
Extracted
sakula
www.savmpet.com
Signatures
-
Sakula payload 6 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula \Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula \Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula \Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2472 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
AdobeUpdate.exepid process 2912 AdobeUpdate.exe -
Loads dropped DLL 4 IoCs
Processes:
NEAS.bdc85b65d3e97dc0c7652f16bd2e5d70.exeAdobeUpdate.exepid process 1268 NEAS.bdc85b65d3e97dc0c7652f16bd2e5d70.exe 2912 AdobeUpdate.exe 2912 AdobeUpdate.exe 2912 AdobeUpdate.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
NEAS.bdc85b65d3e97dc0c7652f16bd2e5d70.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AdobeUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\AdobeUpdate.exe" NEAS.bdc85b65d3e97dc0c7652f16bd2e5d70.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
NEAS.bdc85b65d3e97dc0c7652f16bd2e5d70.exedescription pid process Token: SeIncBasePriorityPrivilege 1268 NEAS.bdc85b65d3e97dc0c7652f16bd2e5d70.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
NEAS.bdc85b65d3e97dc0c7652f16bd2e5d70.execmd.exedescription pid process target process PID 1268 wrote to memory of 2912 1268 NEAS.bdc85b65d3e97dc0c7652f16bd2e5d70.exe AdobeUpdate.exe PID 1268 wrote to memory of 2912 1268 NEAS.bdc85b65d3e97dc0c7652f16bd2e5d70.exe AdobeUpdate.exe PID 1268 wrote to memory of 2912 1268 NEAS.bdc85b65d3e97dc0c7652f16bd2e5d70.exe AdobeUpdate.exe PID 1268 wrote to memory of 2912 1268 NEAS.bdc85b65d3e97dc0c7652f16bd2e5d70.exe AdobeUpdate.exe PID 1268 wrote to memory of 2912 1268 NEAS.bdc85b65d3e97dc0c7652f16bd2e5d70.exe AdobeUpdate.exe PID 1268 wrote to memory of 2912 1268 NEAS.bdc85b65d3e97dc0c7652f16bd2e5d70.exe AdobeUpdate.exe PID 1268 wrote to memory of 2912 1268 NEAS.bdc85b65d3e97dc0c7652f16bd2e5d70.exe AdobeUpdate.exe PID 1268 wrote to memory of 2472 1268 NEAS.bdc85b65d3e97dc0c7652f16bd2e5d70.exe cmd.exe PID 1268 wrote to memory of 2472 1268 NEAS.bdc85b65d3e97dc0c7652f16bd2e5d70.exe cmd.exe PID 1268 wrote to memory of 2472 1268 NEAS.bdc85b65d3e97dc0c7652f16bd2e5d70.exe cmd.exe PID 1268 wrote to memory of 2472 1268 NEAS.bdc85b65d3e97dc0c7652f16bd2e5d70.exe cmd.exe PID 2472 wrote to memory of 2532 2472 cmd.exe PING.EXE PID 2472 wrote to memory of 2532 2472 cmd.exe PING.EXE PID 2472 wrote to memory of 2532 2472 cmd.exe PING.EXE PID 2472 wrote to memory of 2532 2472 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.bdc85b65d3e97dc0c7652f16bd2e5d70.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.bdc85b65d3e97dc0c7652f16bd2e5d70.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2912 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\NEAS.bdc85b65d3e97dc0c7652f16bd2e5d70.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:2532
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeFilesize
92KB
MD5455ff9673ecb492cb0df917092c25512
SHA1fecf53f2dc1546349a3cc4cff1aa2b73900dad2c
SHA25659461add04ced48fd536fc09e7d5ae3507294cec7eacc60fb1f1bb268070a39c
SHA5125230d37fcbaf5a73ea860243293bc7be33851dcc81b56e5431c706ba88b8f7bde9ecb37d64270e89907cf85a1f81896197e60f6806d425563ccafb1d1ed0c69a
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeFilesize
92KB
MD5455ff9673ecb492cb0df917092c25512
SHA1fecf53f2dc1546349a3cc4cff1aa2b73900dad2c
SHA25659461add04ced48fd536fc09e7d5ae3507294cec7eacc60fb1f1bb268070a39c
SHA5125230d37fcbaf5a73ea860243293bc7be33851dcc81b56e5431c706ba88b8f7bde9ecb37d64270e89907cf85a1f81896197e60f6806d425563ccafb1d1ed0c69a
-
\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeFilesize
92KB
MD5455ff9673ecb492cb0df917092c25512
SHA1fecf53f2dc1546349a3cc4cff1aa2b73900dad2c
SHA25659461add04ced48fd536fc09e7d5ae3507294cec7eacc60fb1f1bb268070a39c
SHA5125230d37fcbaf5a73ea860243293bc7be33851dcc81b56e5431c706ba88b8f7bde9ecb37d64270e89907cf85a1f81896197e60f6806d425563ccafb1d1ed0c69a
-
\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeFilesize
92KB
MD5455ff9673ecb492cb0df917092c25512
SHA1fecf53f2dc1546349a3cc4cff1aa2b73900dad2c
SHA25659461add04ced48fd536fc09e7d5ae3507294cec7eacc60fb1f1bb268070a39c
SHA5125230d37fcbaf5a73ea860243293bc7be33851dcc81b56e5431c706ba88b8f7bde9ecb37d64270e89907cf85a1f81896197e60f6806d425563ccafb1d1ed0c69a
-
\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeFilesize
92KB
MD5455ff9673ecb492cb0df917092c25512
SHA1fecf53f2dc1546349a3cc4cff1aa2b73900dad2c
SHA25659461add04ced48fd536fc09e7d5ae3507294cec7eacc60fb1f1bb268070a39c
SHA5125230d37fcbaf5a73ea860243293bc7be33851dcc81b56e5431c706ba88b8f7bde9ecb37d64270e89907cf85a1f81896197e60f6806d425563ccafb1d1ed0c69a
-
\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeFilesize
92KB
MD5455ff9673ecb492cb0df917092c25512
SHA1fecf53f2dc1546349a3cc4cff1aa2b73900dad2c
SHA25659461add04ced48fd536fc09e7d5ae3507294cec7eacc60fb1f1bb268070a39c
SHA5125230d37fcbaf5a73ea860243293bc7be33851dcc81b56e5431c706ba88b8f7bde9ecb37d64270e89907cf85a1f81896197e60f6806d425563ccafb1d1ed0c69a