Analysis
-
max time kernel
144s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2023 10:57
Static task
static1
Behavioral task
behavioral1
Sample
0e7c9a03eb6dd834ace9b57347287895.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0e7c9a03eb6dd834ace9b57347287895.exe
Resource
win10v2004-20231215-en
General
-
Target
0e7c9a03eb6dd834ace9b57347287895.exe
-
Size
58KB
-
MD5
0e7c9a03eb6dd834ace9b57347287895
-
SHA1
4964c09bf7ef04922fc31ac0ec771548de0cf1ec
-
SHA256
b8315b29efea180f7fb39bc4b553101cf9e0060d80f496d1276d38e5e7268fa1
-
SHA512
8c7479da2f98e6412b431ede3c1e77e7f4a2326ffe3f45d25dd2d03dea08199dcc27be3494b7e7bdbbb622a8589341792cb18d9c0826fa340a3ebca7de5f0694
-
SSDEEP
1536:iZioIoCwbYP4nuEApQK4TQbtY2gA9DX+ytBO8c3G3eTJ/p:iEoIlwIguEA4c5DgA9DOyq0eFh
Malware Config
Signatures
-
Sakula payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/4524-5-0x0000000000400000-0x000000000041A000-memory.dmp family_sakula behavioral2/memory/3496-6-0x0000000000400000-0x000000000041A000-memory.dmp family_sakula behavioral2/memory/4524-7-0x0000000000400000-0x000000000041A000-memory.dmp family_sakula behavioral2/memory/3496-12-0x0000000000400000-0x000000000041A000-memory.dmp family_sakula behavioral2/memory/4524-16-0x0000000000400000-0x000000000041A000-memory.dmp family_sakula -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
0e7c9a03eb6dd834ace9b57347287895.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation 0e7c9a03eb6dd834ace9b57347287895.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 4524 MediaCenter.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
0e7c9a03eb6dd834ace9b57347287895.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" 0e7c9a03eb6dd834ace9b57347287895.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
0e7c9a03eb6dd834ace9b57347287895.exedescription pid process Token: SeIncBasePriorityPrivilege 3496 0e7c9a03eb6dd834ace9b57347287895.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
0e7c9a03eb6dd834ace9b57347287895.execmd.exedescription pid process target process PID 3496 wrote to memory of 4524 3496 0e7c9a03eb6dd834ace9b57347287895.exe MediaCenter.exe PID 3496 wrote to memory of 4524 3496 0e7c9a03eb6dd834ace9b57347287895.exe MediaCenter.exe PID 3496 wrote to memory of 4524 3496 0e7c9a03eb6dd834ace9b57347287895.exe MediaCenter.exe PID 3496 wrote to memory of 4372 3496 0e7c9a03eb6dd834ace9b57347287895.exe cmd.exe PID 3496 wrote to memory of 4372 3496 0e7c9a03eb6dd834ace9b57347287895.exe cmd.exe PID 3496 wrote to memory of 4372 3496 0e7c9a03eb6dd834ace9b57347287895.exe cmd.exe PID 4372 wrote to memory of 1876 4372 cmd.exe PING.EXE PID 4372 wrote to memory of 1876 4372 cmd.exe PING.EXE PID 4372 wrote to memory of 1876 4372 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e7c9a03eb6dd834ace9b57347287895.exe"C:\Users\Admin\AppData\Local\Temp\0e7c9a03eb6dd834ace9b57347287895.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:4524 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\0e7c9a03eb6dd834ace9b57347287895.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:1876
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
58KB
MD5d4ede140c3c1bf6b203ec2b24cd76c74
SHA11233ab8b90c9eb94ecea1ba8a6f94c0a131dbafe
SHA256afac31fc5438d0011755485f7eace851032096254d57d6585a3a828674e793bb
SHA512ca6db08822fa01dad6a95f9ba6eea25f4be70ad51957bbad7b2dcf4d8ff27afcaeefd766388f7cb70d35b1ef4348abe9bf1bbe38bf66592f13793450385b9e12
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
44KB
MD58e4ab7340e4f0f613e76e8d5e8eefd78
SHA1f33a7eb1ce1ee12f8e8980a416c7d4e35d31677f
SHA256c751b846efe8ed016a8303273ea5c1ade77da28f6d23fe5ce96b82fdc7f0eda7
SHA512fa05f8e727f200cac8d962b844d374b12b34cd31faa86918c52da6795c889160d7bed91e249f4ca4c467b5770c648283093458accae174f69b828faf222eec54
-
memory/3496-0-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/3496-6-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/3496-12-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/4524-5-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/4524-7-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/4524-16-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB