Analysis
-
max time kernel
154s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2023 13:16
Static task
static1
Behavioral task
behavioral1
Sample
30061268063116f854b0d852633da766.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
30061268063116f854b0d852633da766.exe
Resource
win10v2004-20231215-en
General
-
Target
30061268063116f854b0d852633da766.exe
-
Size
35KB
-
MD5
30061268063116f854b0d852633da766
-
SHA1
b884240ccdca0945936936d5bdbb5e9c1be5644a
-
SHA256
6cf59fb86fb64ec86d78df143339d3c2c6e35eef58d3b256bc727075e5d59389
-
SHA512
763c99c80a65920d1742cbcc8f32e815d34dfcdaa35d1a17fd2746a53d172206f01bd7560d23e7e52b370353c2d277892161574b69ded0f5244be5e0f1f11289
-
SSDEEP
768:lwbYGCv4nuEcJpQK4TQbtKvXwXgA9lJJea+yGCJQqeWnAEv2647D7:lwbYP4nuEApQK4TQbtY2gA9DX+ytBOF
Malware Config
Signatures
-
Sakula payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3104-6-0x0000000000400000-0x000000000041A000-memory.dmp family_sakula behavioral2/memory/3920-7-0x0000000000400000-0x000000000041A000-memory.dmp family_sakula behavioral2/memory/3104-12-0x0000000000400000-0x000000000041A000-memory.dmp family_sakula behavioral2/memory/3920-18-0x0000000000400000-0x000000000041A000-memory.dmp family_sakula -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
30061268063116f854b0d852633da766.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation 30061268063116f854b0d852633da766.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 3920 MediaCenter.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
30061268063116f854b0d852633da766.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" 30061268063116f854b0d852633da766.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
30061268063116f854b0d852633da766.exedescription pid process Token: SeIncBasePriorityPrivilege 3104 30061268063116f854b0d852633da766.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
30061268063116f854b0d852633da766.execmd.exedescription pid process target process PID 3104 wrote to memory of 3920 3104 30061268063116f854b0d852633da766.exe MediaCenter.exe PID 3104 wrote to memory of 3920 3104 30061268063116f854b0d852633da766.exe MediaCenter.exe PID 3104 wrote to memory of 3920 3104 30061268063116f854b0d852633da766.exe MediaCenter.exe PID 3104 wrote to memory of 3000 3104 30061268063116f854b0d852633da766.exe cmd.exe PID 3104 wrote to memory of 3000 3104 30061268063116f854b0d852633da766.exe cmd.exe PID 3104 wrote to memory of 3000 3104 30061268063116f854b0d852633da766.exe cmd.exe PID 3000 wrote to memory of 4268 3000 cmd.exe PING.EXE PID 3000 wrote to memory of 4268 3000 cmd.exe PING.EXE PID 3000 wrote to memory of 4268 3000 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\30061268063116f854b0d852633da766.exe"C:\Users\Admin\AppData\Local\Temp\30061268063116f854b0d852633da766.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:3920 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\30061268063116f854b0d852633da766.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:4268
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
35KB
MD530f9b5f7eb94c457a93a49aa919bd5b6
SHA195b3fe50de2bc10361bf951a8c2182788615e553
SHA2566fd62e80b681877ccbc33957864964e6a19cd7fa195e2749bb3e8c1ce742a10f
SHA512a0b9a815cc83e2b9b16961caf72d4ecbf5278bdd7300469dbd6c3c76573b0fc120883ec3aecb0eb1413142dec6dec8da455859baec0621c2715811e716b5ff43
-
memory/3104-0-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/3104-6-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/3104-12-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/3920-5-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/3920-7-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/3920-18-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB