Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
19-12-2023 21:21
Static task
static1
Behavioral task
behavioral1
Sample
a32411c9e8f3e101365364554eb2eb62.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
a32411c9e8f3e101365364554eb2eb62.exe
Resource
win10v2004-20231215-en
General
-
Target
a32411c9e8f3e101365364554eb2eb62.exe
-
Size
36KB
-
MD5
a32411c9e8f3e101365364554eb2eb62
-
SHA1
0d8f025bea1d34e21bf6b332dc21b38f6582ed0a
-
SHA256
d75d8a20a6edc5ec261afab70ebb29e941f8d6d0f10e3db7ec77d17da620d381
-
SHA512
f0532cd046a9579de2c43b12fad075efc5d7c9308a7d4a9e851f10b9e2af3952d4ab53156d0f3d35e379c0a65a1c5d9b46058003f3fb809b18136cf15439665a
-
SSDEEP
768:H1xwbYGCv4nuEcJpQK4TQbtKvXwXgA9lJJea+yGCJQqeWnAEv26S7Dg:nwbYP4nuEApQK4TQbtY2gA9DX+ytBO0
Malware Config
Signatures
-
Sakula payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2080-11-0x0000000000400000-0x000000000041A000-memory.dmp family_sakula behavioral1/memory/2268-12-0x0000000000400000-0x000000000041A000-memory.dmp family_sakula behavioral1/memory/2268-20-0x0000000000400000-0x000000000041A000-memory.dmp family_sakula behavioral1/memory/2080-25-0x0000000000400000-0x000000000041A000-memory.dmp family_sakula -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2924 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 2080 MediaCenter.exe -
Loads dropped DLL 2 IoCs
Processes:
a32411c9e8f3e101365364554eb2eb62.exepid process 2268 a32411c9e8f3e101365364554eb2eb62.exe 2268 a32411c9e8f3e101365364554eb2eb62.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
a32411c9e8f3e101365364554eb2eb62.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" a32411c9e8f3e101365364554eb2eb62.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
a32411c9e8f3e101365364554eb2eb62.exedescription pid process Token: SeIncBasePriorityPrivilege 2268 a32411c9e8f3e101365364554eb2eb62.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
a32411c9e8f3e101365364554eb2eb62.execmd.exedescription pid process target process PID 2268 wrote to memory of 2080 2268 a32411c9e8f3e101365364554eb2eb62.exe MediaCenter.exe PID 2268 wrote to memory of 2080 2268 a32411c9e8f3e101365364554eb2eb62.exe MediaCenter.exe PID 2268 wrote to memory of 2080 2268 a32411c9e8f3e101365364554eb2eb62.exe MediaCenter.exe PID 2268 wrote to memory of 2080 2268 a32411c9e8f3e101365364554eb2eb62.exe MediaCenter.exe PID 2268 wrote to memory of 2924 2268 a32411c9e8f3e101365364554eb2eb62.exe cmd.exe PID 2268 wrote to memory of 2924 2268 a32411c9e8f3e101365364554eb2eb62.exe cmd.exe PID 2268 wrote to memory of 2924 2268 a32411c9e8f3e101365364554eb2eb62.exe cmd.exe PID 2268 wrote to memory of 2924 2268 a32411c9e8f3e101365364554eb2eb62.exe cmd.exe PID 2924 wrote to memory of 2612 2924 cmd.exe PING.EXE PID 2924 wrote to memory of 2612 2924 cmd.exe PING.EXE PID 2924 wrote to memory of 2612 2924 cmd.exe PING.EXE PID 2924 wrote to memory of 2612 2924 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\a32411c9e8f3e101365364554eb2eb62.exe"C:\Users\Admin\AppData\Local\Temp\a32411c9e8f3e101365364554eb2eb62.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:2080 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\a32411c9e8f3e101365364554eb2eb62.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:2612
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
36KB
MD5a5a151f8d1eb81079a0ced7916dbe3f3
SHA17f3835546fef529ea12b580e9562a06446d2d5a1
SHA25643fafcc19c920776a446f043e464d4e7ec56062d99c18713fe9e2e5e832af174
SHA5122a54a6f7cdc18aac481165159dedfff7c4f6a9e1cde99682ea0ecbbe471605892ae22d5fa32e6b587fdbf75f22109b1290cb58fde0ffc9ae3849801371fcd803
-
memory/2080-11-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/2080-25-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/2268-0-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/2268-4-0x0000000000220000-0x000000000023A000-memory.dmpFilesize
104KB
-
memory/2268-10-0x0000000000220000-0x000000000023A000-memory.dmpFilesize
104KB
-
memory/2268-12-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/2268-14-0x0000000000220000-0x000000000023A000-memory.dmpFilesize
104KB
-
memory/2268-15-0x0000000000220000-0x000000000023A000-memory.dmpFilesize
104KB
-
memory/2268-20-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB