Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2023 18:05
Behavioral task
behavioral1
Sample
7202973e034fa97cee62bc034fb13a15.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7202973e034fa97cee62bc034fb13a15.exe
Resource
win10v2004-20231215-en
General
-
Target
7202973e034fa97cee62bc034fb13a15.exe
-
Size
89KB
-
MD5
7202973e034fa97cee62bc034fb13a15
-
SHA1
c00277d3840d0f4c246e60dab49d959326c06d9a
-
SHA256
7d609fdde3af560d4ca2f18921f0a4ec97c63960e503cc20890b571fc1578f95
-
SHA512
efdd65a43bbb4e308f87b26b9d873503cf8633c68f8122876c0e1547ea1643c274ab7c52e4a280035a747923cb4e17f9e4d3c8ef4c58a1da35afeee93b17d621
-
SSDEEP
1536:lQFl29mEkE0L1rDEKrxZKF2zf9g2Pl7W/MwbxMX+ees52z30rtrg:e29DkEGRQixVSjLaes5G30BM
Malware Config
Extracted
sakula
www.polarroute.com
Signatures
-
Sakula payload 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
7202973e034fa97cee62bc034fb13a15.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation 7202973e034fa97cee62bc034fb13a15.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 4908 MediaCenter.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
7202973e034fa97cee62bc034fb13a15.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" 7202973e034fa97cee62bc034fb13a15.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
7202973e034fa97cee62bc034fb13a15.exedescription pid process Token: SeIncBasePriorityPrivilege 2148 7202973e034fa97cee62bc034fb13a15.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
7202973e034fa97cee62bc034fb13a15.execmd.exedescription pid process target process PID 2148 wrote to memory of 4908 2148 7202973e034fa97cee62bc034fb13a15.exe MediaCenter.exe PID 2148 wrote to memory of 4908 2148 7202973e034fa97cee62bc034fb13a15.exe MediaCenter.exe PID 2148 wrote to memory of 4908 2148 7202973e034fa97cee62bc034fb13a15.exe MediaCenter.exe PID 2148 wrote to memory of 720 2148 7202973e034fa97cee62bc034fb13a15.exe cmd.exe PID 2148 wrote to memory of 720 2148 7202973e034fa97cee62bc034fb13a15.exe cmd.exe PID 2148 wrote to memory of 720 2148 7202973e034fa97cee62bc034fb13a15.exe cmd.exe PID 720 wrote to memory of 2508 720 cmd.exe PING.EXE PID 720 wrote to memory of 2508 720 cmd.exe PING.EXE PID 720 wrote to memory of 2508 720 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\7202973e034fa97cee62bc034fb13a15.exe"C:\Users\Admin\AppData\Local\Temp\7202973e034fa97cee62bc034fb13a15.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:4908 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\7202973e034fa97cee62bc034fb13a15.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:720 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:2508
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PG47MANB\rlueqcgt683859143[1].htmFilesize
1KB
MD58d4c07efda188f4ca3290b68b7b5c2b4
SHA1ba392480e4f36eaf02ce8df0e7b3ca86aebbd3ea
SHA256e27b64c9737988f9d6a1bff653e7de7b46c8150133d6b4e9061b70d70dbde8b4
SHA512fbbd1b4596151b13a9de1ed87c37783f2e7519c1e0b7f90fe00cba33a848b538fcb8474d0975fb18568085e81e84053d4ec2f18021fcc76cda68e0b808ed2ef2
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
89KB
MD50be6d70b10eb3d08a3c51f1c7a338fab
SHA11097589a894f3d3c669aa0bdb602e88dafe62565
SHA25628503e3bfa9426bb354d3bb01f8244d6b6b1e6f6e3f706bbfb167cdde33c2c27
SHA512819ec19c3119f8ddd26f02831dcd1d92145cb88fc4a5c7112b3f849fe4c877bef163f51383d39ce8755c3f3fc76695b6f91125202ef8818a79941276766df342