Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2023 17:44
Behavioral task
behavioral1
Sample
6d8032357e664749d95c74c3cc618231.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
6d8032357e664749d95c74c3cc618231.exe
Resource
win10v2004-20231215-en
General
-
Target
6d8032357e664749d95c74c3cc618231.exe
-
Size
3.6MB
-
MD5
6d8032357e664749d95c74c3cc618231
-
SHA1
ea0f06dc70bd88554e2231d8a9e8545e40dc4df1
-
SHA256
2cca320792270200228141c046006de65a23d2d75ae736216d27d7b1f6161b6a
-
SHA512
4eed9e97c4e9e5cca3c71fce9bbb0880e9c9fa36b8db9e55f95bdab7a536b8e410bd223e5723d5ae54e6850ec896fcd1977911f7edf74c6288d3a0f01d45abac
-
SSDEEP
49152:o852ZjeUNZZH46HsnHVT5ZA+acdD6xXTIN:oU6eUNZZJHsHr
Malware Config
Extracted
sakula
www.polarroute.com
Signatures
-
Sakula payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
6d8032357e664749d95c74c3cc618231.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation 6d8032357e664749d95c74c3cc618231.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 3884 MediaCenter.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
6d8032357e664749d95c74c3cc618231.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" 6d8032357e664749d95c74c3cc618231.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
6d8032357e664749d95c74c3cc618231.exedescription pid process Token: SeIncBasePriorityPrivilege 1604 6d8032357e664749d95c74c3cc618231.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
6d8032357e664749d95c74c3cc618231.execmd.exedescription pid process target process PID 1604 wrote to memory of 3884 1604 6d8032357e664749d95c74c3cc618231.exe MediaCenter.exe PID 1604 wrote to memory of 3884 1604 6d8032357e664749d95c74c3cc618231.exe MediaCenter.exe PID 1604 wrote to memory of 3884 1604 6d8032357e664749d95c74c3cc618231.exe MediaCenter.exe PID 1604 wrote to memory of 5100 1604 6d8032357e664749d95c74c3cc618231.exe cmd.exe PID 1604 wrote to memory of 5100 1604 6d8032357e664749d95c74c3cc618231.exe cmd.exe PID 1604 wrote to memory of 5100 1604 6d8032357e664749d95c74c3cc618231.exe cmd.exe PID 5100 wrote to memory of 2756 5100 cmd.exe PING.EXE PID 5100 wrote to memory of 2756 5100 cmd.exe PING.EXE PID 5100 wrote to memory of 2756 5100 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\6d8032357e664749d95c74c3cc618231.exe"C:\Users\Admin\AppData\Local\Temp\6d8032357e664749d95c74c3cc618231.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:3884 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\6d8032357e664749d95c74c3cc618231.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:2756
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BP0ZYM9B\vzkfqalw186918827[1].htmFilesize
1KB
MD58d4c07efda188f4ca3290b68b7b5c2b4
SHA1ba392480e4f36eaf02ce8df0e7b3ca86aebbd3ea
SHA256e27b64c9737988f9d6a1bff653e7de7b46c8150133d6b4e9061b70d70dbde8b4
SHA512fbbd1b4596151b13a9de1ed87c37783f2e7519c1e0b7f90fe00cba33a848b538fcb8474d0975fb18568085e81e84053d4ec2f18021fcc76cda68e0b808ed2ef2
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
3.6MB
MD54dfa00b1fe8ac1a0d30f42b364e6924d
SHA17fbfc0d09126eb02a5376b0814a88ee00a1518ab
SHA25693deaf7a324ec112242d728d44e7909f4abce846fc1ab43aede51dab897c6450
SHA5120e868c3f4e4add2d9df9873675d730ada2fbcbeeccfc559a6b7b8c4ff4ed95c408ab1e206a0f7ea34e003736afc0ceffdab2e5203ccb0fd9c45184a5cb186080
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
3.5MB
MD5b4e299934130265d4441da2697638523
SHA1e046550d11c916112cb11d63ceacfd1603d35722
SHA256fa899ac65bd3d7b4d728c02a59de729e7ca1e5187e13ef0a891b0741cbe9afc6
SHA512dbaf95b369c533f4fa93449bc6b1f2a1d83857034b9de5b119160e65f7d259f7ebdda7c78f3571a3ac0e68b1e6b35a2a4bd0221c4ef8627f6acc4fae3fe8a992