Analysis
-
max time kernel
178s -
max time network
190s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2023 19:54
Static task
static1
Behavioral task
behavioral1
Sample
8a4e06e2d9c477fffe49c6d848764a09.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
8a4e06e2d9c477fffe49c6d848764a09.exe
Resource
win10v2004-20231215-en
General
-
Target
8a4e06e2d9c477fffe49c6d848764a09.exe
-
Size
35KB
-
MD5
8a4e06e2d9c477fffe49c6d848764a09
-
SHA1
f671cd9f959a935c1b4a82767e5eff32c706aa42
-
SHA256
e6158e92c57a088d5acfead44571787a2e20ce77b00ec32c9f64aa2608760eeb
-
SHA512
9450266d91637a08c4bb38671dcddda3728747a13dadea1842577fc7863575d4fa4097bf11f8cdfe563617c5a0ade7ba16b9b276e1e18328d8c07cd7f2687d75
-
SSDEEP
768:lwbYGCv4nuEcJpQK4TQbtKvXwXgA9lJJea+yGCJQqeWnAEv2647Dr:lwbYP4nuEApQK4TQbtY2gA9DX+ytBOR
Malware Config
Signatures
-
Sakula payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/1120-5-0x0000000000400000-0x000000000041A000-memory.dmp family_sakula behavioral2/memory/1892-8-0x0000000000400000-0x000000000041A000-memory.dmp family_sakula behavioral2/memory/1120-15-0x0000000000400000-0x000000000041A000-memory.dmp family_sakula behavioral2/memory/1892-19-0x0000000000400000-0x000000000041A000-memory.dmp family_sakula -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
8a4e06e2d9c477fffe49c6d848764a09.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation 8a4e06e2d9c477fffe49c6d848764a09.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 1892 MediaCenter.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
8a4e06e2d9c477fffe49c6d848764a09.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" 8a4e06e2d9c477fffe49c6d848764a09.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
8a4e06e2d9c477fffe49c6d848764a09.exedescription pid process Token: SeIncBasePriorityPrivilege 1120 8a4e06e2d9c477fffe49c6d848764a09.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
8a4e06e2d9c477fffe49c6d848764a09.execmd.exedescription pid process target process PID 1120 wrote to memory of 1892 1120 8a4e06e2d9c477fffe49c6d848764a09.exe MediaCenter.exe PID 1120 wrote to memory of 1892 1120 8a4e06e2d9c477fffe49c6d848764a09.exe MediaCenter.exe PID 1120 wrote to memory of 1892 1120 8a4e06e2d9c477fffe49c6d848764a09.exe MediaCenter.exe PID 1120 wrote to memory of 1268 1120 8a4e06e2d9c477fffe49c6d848764a09.exe cmd.exe PID 1120 wrote to memory of 1268 1120 8a4e06e2d9c477fffe49c6d848764a09.exe cmd.exe PID 1120 wrote to memory of 1268 1120 8a4e06e2d9c477fffe49c6d848764a09.exe cmd.exe PID 1268 wrote to memory of 4592 1268 cmd.exe PING.EXE PID 1268 wrote to memory of 4592 1268 cmd.exe PING.EXE PID 1268 wrote to memory of 4592 1268 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a4e06e2d9c477fffe49c6d848764a09.exe"C:\Users\Admin\AppData\Local\Temp\8a4e06e2d9c477fffe49c6d848764a09.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:1892 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\8a4e06e2d9c477fffe49c6d848764a09.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:4592
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
35KB
MD59e749231ee96f1bcf30837a1fe17a9e8
SHA14f825fd11ad41ea015dd488be0a8962adff99516
SHA25606cb4b86cfd272b7aaa6620330920ba5b225e145dfc665a43f3f9a25eefcc3fd
SHA51274eee6120d3a267835d0cd6c07aa1f8d4891724da54d23809e62b685e3bb76d2bae670f39b6aece9a027fa7003905f945d0e414aa9abcba4cffd7ff7c514585f
-
memory/1120-0-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1120-5-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1120-15-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1892-6-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1892-8-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1892-19-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB