Analysis
-
max time kernel
140s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
19-12-2023 20:45
Behavioral task
behavioral1
Sample
99583c439fc950e425f3dc8c06cba936.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
99583c439fc950e425f3dc8c06cba936.exe
Resource
win10v2004-20231215-en
General
-
Target
99583c439fc950e425f3dc8c06cba936.exe
-
Size
392KB
-
MD5
99583c439fc950e425f3dc8c06cba936
-
SHA1
07021f9f46fb44e784da837aeeecec9ee6597f7c
-
SHA256
17f53b9d55848d903786c987157816c97bcb3304cc06b4b98bed561159245f34
-
SHA512
75ec2d697a49e4eabe13671f5b826c30017d5056be7ceeb2f6c1d7ffc2dd293cc3a7fd918a7045241d47e95b89f006eb3f060222c621384dae3ca8692a9cd84f
-
SSDEEP
6144:M29qRfVSndj30B3wBxE1+ijiBKk3etdgI2MyzNORQtOfl1qNVo7R+S+N/TU7kn5e:0RfQn+w8EYiBlMkn5f9J105r
Malware Config
Extracted
sakula
www.polarroute.com
Signatures
-
Sakula payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2208-1-0x0000000000400000-0x0000000000420000-memory.dmp family_sakula \Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula behavioral1/memory/2196-7-0x0000000000400000-0x0000000000420000-memory.dmp family_sakula behavioral1/memory/2208-8-0x0000000000400000-0x0000000000420000-memory.dmp family_sakula -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2628 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 2196 MediaCenter.exe -
Loads dropped DLL 1 IoCs
Processes:
99583c439fc950e425f3dc8c06cba936.exepid process 2208 99583c439fc950e425f3dc8c06cba936.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
99583c439fc950e425f3dc8c06cba936.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" 99583c439fc950e425f3dc8c06cba936.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
99583c439fc950e425f3dc8c06cba936.exedescription pid process Token: SeIncBasePriorityPrivilege 2208 99583c439fc950e425f3dc8c06cba936.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
99583c439fc950e425f3dc8c06cba936.execmd.exedescription pid process target process PID 2208 wrote to memory of 2196 2208 99583c439fc950e425f3dc8c06cba936.exe MediaCenter.exe PID 2208 wrote to memory of 2196 2208 99583c439fc950e425f3dc8c06cba936.exe MediaCenter.exe PID 2208 wrote to memory of 2196 2208 99583c439fc950e425f3dc8c06cba936.exe MediaCenter.exe PID 2208 wrote to memory of 2196 2208 99583c439fc950e425f3dc8c06cba936.exe MediaCenter.exe PID 2208 wrote to memory of 2628 2208 99583c439fc950e425f3dc8c06cba936.exe cmd.exe PID 2208 wrote to memory of 2628 2208 99583c439fc950e425f3dc8c06cba936.exe cmd.exe PID 2208 wrote to memory of 2628 2208 99583c439fc950e425f3dc8c06cba936.exe cmd.exe PID 2208 wrote to memory of 2628 2208 99583c439fc950e425f3dc8c06cba936.exe cmd.exe PID 2628 wrote to memory of 3052 2628 cmd.exe PING.EXE PID 2628 wrote to memory of 3052 2628 cmd.exe PING.EXE PID 2628 wrote to memory of 3052 2628 cmd.exe PING.EXE PID 2628 wrote to memory of 3052 2628 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\99583c439fc950e425f3dc8c06cba936.exe"C:\Users\Admin\AppData\Local\Temp\99583c439fc950e425f3dc8c06cba936.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:2196 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\99583c439fc950e425f3dc8c06cba936.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:3052
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\CabAE0D.tmpFilesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\Local\Temp\TarAE5E.tmpFilesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
392KB
MD576787ef61cd4ac94e1fb7d77843fc6eb
SHA1cde08542ecbcfe6fbfafa1bd1c5f5aa0c697a066
SHA25643f2dd353ac84ce18231467551cdeeca5fc57d9bd8a16f09b43f1362006240ca
SHA51260c2f5b99cc164ae94ce611ef250fa9537fb759ea6ad78f4b197796995ca267f4d8ad54c26ddfcaf4c34ece0654d56189f354f10a84a0f39745c421aa353a284
-
memory/2196-7-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2208-1-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2208-5-0x0000000000230000-0x0000000000250000-memory.dmpFilesize
128KB
-
memory/2208-8-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB