Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
19-12-2023 21:20
Static task
static1
Behavioral task
behavioral1
Sample
a2f82397928cc6bfb602e668dff26470.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
a2f82397928cc6bfb602e668dff26470.exe
Resource
win10v2004-20231215-en
General
-
Target
a2f82397928cc6bfb602e668dff26470.exe
-
Size
35KB
-
MD5
a2f82397928cc6bfb602e668dff26470
-
SHA1
0f0746293c4dac43682ce11219bacb61656a1948
-
SHA256
6d8b64a772ddbe672933e122fb6d9a8960c575b5b66939d60596a80fe7bb1611
-
SHA512
3abe143462fb653fde8443e56df24e48daf1711c6760c70f766d151a315020a1d46659a5b73de4b7e91657d0a9523e818f6fad21aca01204a0d8a1232fdaaac4
-
SSDEEP
768:lwbYGCv4nuEcJpQK4TQbtKvXwXgA9lJJea+yGCJQqeWnAEv2647Dl:lwbYP4nuEApQK4TQbtY2gA9DX+ytBOz
Malware Config
Signatures
-
Sakula payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2172-11-0x0000000000400000-0x000000000041A000-memory.dmp family_sakula behavioral1/memory/688-12-0x0000000000400000-0x000000000041A000-memory.dmp family_sakula behavioral1/memory/688-20-0x0000000000400000-0x000000000041A000-memory.dmp family_sakula behavioral1/memory/2172-25-0x0000000000400000-0x000000000041A000-memory.dmp family_sakula -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 3060 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 2172 MediaCenter.exe -
Loads dropped DLL 2 IoCs
Processes:
a2f82397928cc6bfb602e668dff26470.exepid process 688 a2f82397928cc6bfb602e668dff26470.exe 688 a2f82397928cc6bfb602e668dff26470.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
a2f82397928cc6bfb602e668dff26470.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" a2f82397928cc6bfb602e668dff26470.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
a2f82397928cc6bfb602e668dff26470.exedescription pid process Token: SeIncBasePriorityPrivilege 688 a2f82397928cc6bfb602e668dff26470.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
a2f82397928cc6bfb602e668dff26470.execmd.exedescription pid process target process PID 688 wrote to memory of 2172 688 a2f82397928cc6bfb602e668dff26470.exe MediaCenter.exe PID 688 wrote to memory of 2172 688 a2f82397928cc6bfb602e668dff26470.exe MediaCenter.exe PID 688 wrote to memory of 2172 688 a2f82397928cc6bfb602e668dff26470.exe MediaCenter.exe PID 688 wrote to memory of 2172 688 a2f82397928cc6bfb602e668dff26470.exe MediaCenter.exe PID 688 wrote to memory of 3060 688 a2f82397928cc6bfb602e668dff26470.exe cmd.exe PID 688 wrote to memory of 3060 688 a2f82397928cc6bfb602e668dff26470.exe cmd.exe PID 688 wrote to memory of 3060 688 a2f82397928cc6bfb602e668dff26470.exe cmd.exe PID 688 wrote to memory of 3060 688 a2f82397928cc6bfb602e668dff26470.exe cmd.exe PID 3060 wrote to memory of 2256 3060 cmd.exe PING.EXE PID 3060 wrote to memory of 2256 3060 cmd.exe PING.EXE PID 3060 wrote to memory of 2256 3060 cmd.exe PING.EXE PID 3060 wrote to memory of 2256 3060 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2f82397928cc6bfb602e668dff26470.exe"C:\Users\Admin\AppData\Local\Temp\a2f82397928cc6bfb602e668dff26470.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:688 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:2172 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\a2f82397928cc6bfb602e668dff26470.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:2256
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
35KB
MD577808e9c6d2d88cb2cc3eea8d4f646b4
SHA1de28ff1c5f4508a3ff4bc3b6cfb808a567f14783
SHA2566bdd2e34ce0e7807b92319c9ff53f752d8ff79f846c8bda370283817ca20722c
SHA512f81d64b0314ec3f2d77d3e2d514995155f4989608d7fc4d908d17f44e0989e2fba3bd9941c2dee8a7c04edd63d218729ca38192e8a5bfc578143482b6da6e8bf
-
memory/688-0-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/688-9-0x0000000000220000-0x000000000023A000-memory.dmpFilesize
104KB
-
memory/688-10-0x0000000000220000-0x000000000023A000-memory.dmpFilesize
104KB
-
memory/688-12-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/688-16-0x0000000000220000-0x000000000023A000-memory.dmpFilesize
104KB
-
memory/688-17-0x0000000000220000-0x000000000023A000-memory.dmpFilesize
104KB
-
memory/688-20-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/688-21-0x0000000000220000-0x000000000023A000-memory.dmpFilesize
104KB
-
memory/2172-11-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/2172-25-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB