Analysis
-
max time kernel
142s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
18-11-2023 04:05
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.cf5ed9452a032958fde928395fc87ff0.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.cf5ed9452a032958fde928395fc87ff0.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.cf5ed9452a032958fde928395fc87ff0.exe
-
Size
67KB
-
MD5
cf5ed9452a032958fde928395fc87ff0
-
SHA1
80ae08de3b9c77144dbb93ed2d24a566a618f9e0
-
SHA256
499d223a08077be5f3b434326af501092d8c6db5d77b914f0404ae7bae4cc1fe
-
SHA512
90cd955b0c4c36e956fb16ae0a0994803b90f47c029e171c60c11fe28f6a108ad56880847594e8672d9cdff808a4e97eb0d0de6a83cae016a06739f82ff765b2
-
SSDEEP
768:u7Xezc/T6Zp14hyYtoVxYF9mHF1yD3BmNV8PsED3VK2+ZtyOjgO4r9vFAg2rq8:a6zqhyYtkYWI3BDYTjipvF2R
Malware Config
Extracted
sakula
http://www.we11point.com:443/view.asp?cookie=%s&type=%d&vid=%d
http://www.we11point.com:443/photo/%s.jpg?vid=%d
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 2160 MediaCenter.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" reg.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
NEAS.cf5ed9452a032958fde928395fc87ff0.execmd.execmd.exedescription pid process target process PID 4248 wrote to memory of 4948 4248 NEAS.cf5ed9452a032958fde928395fc87ff0.exe cmd.exe PID 4248 wrote to memory of 4948 4248 NEAS.cf5ed9452a032958fde928395fc87ff0.exe cmd.exe PID 4248 wrote to memory of 4948 4248 NEAS.cf5ed9452a032958fde928395fc87ff0.exe cmd.exe PID 4248 wrote to memory of 2160 4248 NEAS.cf5ed9452a032958fde928395fc87ff0.exe MediaCenter.exe PID 4248 wrote to memory of 2160 4248 NEAS.cf5ed9452a032958fde928395fc87ff0.exe MediaCenter.exe PID 4248 wrote to memory of 2160 4248 NEAS.cf5ed9452a032958fde928395fc87ff0.exe MediaCenter.exe PID 4948 wrote to memory of 2752 4948 cmd.exe reg.exe PID 4948 wrote to memory of 2752 4948 cmd.exe reg.exe PID 4948 wrote to memory of 2752 4948 cmd.exe reg.exe PID 4248 wrote to memory of 2276 4248 NEAS.cf5ed9452a032958fde928395fc87ff0.exe cmd.exe PID 4248 wrote to memory of 2276 4248 NEAS.cf5ed9452a032958fde928395fc87ff0.exe cmd.exe PID 4248 wrote to memory of 2276 4248 NEAS.cf5ed9452a032958fde928395fc87ff0.exe cmd.exe PID 2276 wrote to memory of 3856 2276 cmd.exe PING.EXE PID 2276 wrote to memory of 3856 2276 cmd.exe PING.EXE PID 2276 wrote to memory of 3856 2276 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cf5ed9452a032958fde928395fc87ff0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cf5ed9452a032958fde928395fc87ff0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"3⤵
- Adds Run key to start application
- Modifies registry key
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:2160 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\NEAS.cf5ed9452a032958fde928395fc87ff0.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:3856
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
67KB
MD5115668adf931bee664062d64ae45e6ee
SHA169c38f4b54cc8a09ab28fc22c9830e7807fb59dc
SHA256f2ec90e03b99fea3946b0031fdee2b7f7c4605d0a821b46f870545a092a22747
SHA512f03969b3130e51849a2a38d7bf93f6ee415bc9f803a016c01b50d80cc774d518f7001c38a982951030b7eb47b571c13c157f2d7aabfd0a8203b191f778d8bf67
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
67KB
MD5115668adf931bee664062d64ae45e6ee
SHA169c38f4b54cc8a09ab28fc22c9830e7807fb59dc
SHA256f2ec90e03b99fea3946b0031fdee2b7f7c4605d0a821b46f870545a092a22747
SHA512f03969b3130e51849a2a38d7bf93f6ee415bc9f803a016c01b50d80cc774d518f7001c38a982951030b7eb47b571c13c157f2d7aabfd0a8203b191f778d8bf67
-
memory/2160-7-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/4248-0-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/4248-1-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/4248-6-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB