Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
18-11-2023 04:05
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.cf5ed9452a032958fde928395fc87ff0.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.cf5ed9452a032958fde928395fc87ff0.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.cf5ed9452a032958fde928395fc87ff0.exe
-
Size
67KB
-
MD5
cf5ed9452a032958fde928395fc87ff0
-
SHA1
80ae08de3b9c77144dbb93ed2d24a566a618f9e0
-
SHA256
499d223a08077be5f3b434326af501092d8c6db5d77b914f0404ae7bae4cc1fe
-
SHA512
90cd955b0c4c36e956fb16ae0a0994803b90f47c029e171c60c11fe28f6a108ad56880847594e8672d9cdff808a4e97eb0d0de6a83cae016a06739f82ff765b2
-
SSDEEP
768:u7Xezc/T6Zp14hyYtoVxYF9mHF1yD3BmNV8PsED3VK2+ZtyOjgO4r9vFAg2rq8:a6zqhyYtkYWI3BDYTjipvF2R
Malware Config
Extracted
sakula
http://www.we11point.com:443/view.asp?cookie=%s&type=%d&vid=%d
http://www.we11point.com:443/photo/%s.jpg?vid=%d
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2484 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 1232 MediaCenter.exe -
Loads dropped DLL 2 IoCs
Processes:
NEAS.cf5ed9452a032958fde928395fc87ff0.exepid process 2040 NEAS.cf5ed9452a032958fde928395fc87ff0.exe 2040 NEAS.cf5ed9452a032958fde928395fc87ff0.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
NEAS.cf5ed9452a032958fde928395fc87ff0.execmd.execmd.exedescription pid process target process PID 2040 wrote to memory of 2156 2040 NEAS.cf5ed9452a032958fde928395fc87ff0.exe cmd.exe PID 2040 wrote to memory of 2156 2040 NEAS.cf5ed9452a032958fde928395fc87ff0.exe cmd.exe PID 2040 wrote to memory of 2156 2040 NEAS.cf5ed9452a032958fde928395fc87ff0.exe cmd.exe PID 2040 wrote to memory of 2156 2040 NEAS.cf5ed9452a032958fde928395fc87ff0.exe cmd.exe PID 2040 wrote to memory of 1232 2040 NEAS.cf5ed9452a032958fde928395fc87ff0.exe MediaCenter.exe PID 2040 wrote to memory of 1232 2040 NEAS.cf5ed9452a032958fde928395fc87ff0.exe MediaCenter.exe PID 2040 wrote to memory of 1232 2040 NEAS.cf5ed9452a032958fde928395fc87ff0.exe MediaCenter.exe PID 2040 wrote to memory of 1232 2040 NEAS.cf5ed9452a032958fde928395fc87ff0.exe MediaCenter.exe PID 2156 wrote to memory of 2268 2156 cmd.exe reg.exe PID 2156 wrote to memory of 2268 2156 cmd.exe reg.exe PID 2156 wrote to memory of 2268 2156 cmd.exe reg.exe PID 2156 wrote to memory of 2268 2156 cmd.exe reg.exe PID 2040 wrote to memory of 2484 2040 NEAS.cf5ed9452a032958fde928395fc87ff0.exe cmd.exe PID 2040 wrote to memory of 2484 2040 NEAS.cf5ed9452a032958fde928395fc87ff0.exe cmd.exe PID 2040 wrote to memory of 2484 2040 NEAS.cf5ed9452a032958fde928395fc87ff0.exe cmd.exe PID 2040 wrote to memory of 2484 2040 NEAS.cf5ed9452a032958fde928395fc87ff0.exe cmd.exe PID 2484 wrote to memory of 2584 2484 cmd.exe PING.EXE PID 2484 wrote to memory of 2584 2484 cmd.exe PING.EXE PID 2484 wrote to memory of 2584 2484 cmd.exe PING.EXE PID 2484 wrote to memory of 2584 2484 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cf5ed9452a032958fde928395fc87ff0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cf5ed9452a032958fde928395fc87ff0.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:1232 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\NEAS.cf5ed9452a032958fde928395fc87ff0.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:2584
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
67KB
MD5cced471c3a634713dc7799cbc9eba02a
SHA1ebba4c3816d421f92ba4e161d7c8a1577e769622
SHA256957465838a29f0bb02cdd6f57d4d2a50e2b7a47f47bfe0e4b415953f45621b22
SHA5126c986e37de4307faf27cfe882d16a4ed4c7224c2af93c40ace0e83772e1a4a81fc3dce8a3e9a5d6a77252323a2aafd6441ecd72b2b585783f0a1ea01269b512b
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
67KB
MD5cced471c3a634713dc7799cbc9eba02a
SHA1ebba4c3816d421f92ba4e161d7c8a1577e769622
SHA256957465838a29f0bb02cdd6f57d4d2a50e2b7a47f47bfe0e4b415953f45621b22
SHA5126c986e37de4307faf27cfe882d16a4ed4c7224c2af93c40ace0e83772e1a4a81fc3dce8a3e9a5d6a77252323a2aafd6441ecd72b2b585783f0a1ea01269b512b
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
67KB
MD5cced471c3a634713dc7799cbc9eba02a
SHA1ebba4c3816d421f92ba4e161d7c8a1577e769622
SHA256957465838a29f0bb02cdd6f57d4d2a50e2b7a47f47bfe0e4b415953f45621b22
SHA5126c986e37de4307faf27cfe882d16a4ed4c7224c2af93c40ace0e83772e1a4a81fc3dce8a3e9a5d6a77252323a2aafd6441ecd72b2b585783f0a1ea01269b512b
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
67KB
MD5cced471c3a634713dc7799cbc9eba02a
SHA1ebba4c3816d421f92ba4e161d7c8a1577e769622
SHA256957465838a29f0bb02cdd6f57d4d2a50e2b7a47f47bfe0e4b415953f45621b22
SHA5126c986e37de4307faf27cfe882d16a4ed4c7224c2af93c40ace0e83772e1a4a81fc3dce8a3e9a5d6a77252323a2aafd6441ecd72b2b585783f0a1ea01269b512b
-
memory/1232-12-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1232-14-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2040-0-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2040-2-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2040-10-0x0000000000220000-0x000000000022A000-memory.dmpFilesize
40KB
-
memory/2040-11-0x0000000000220000-0x000000000022A000-memory.dmpFilesize
40KB
-
memory/2040-13-0x0000000000220000-0x000000000022A000-memory.dmpFilesize
40KB