Analysis
-
max time kernel
132s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
20-12-2023 12:51
Behavioral task
behavioral1
Sample
b4da05f8631e42d6b08baac098bd479a.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
b4da05f8631e42d6b08baac098bd479a.exe
Resource
win10v2004-20231215-en
General
-
Target
b4da05f8631e42d6b08baac098bd479a.exe
-
Size
392KB
-
MD5
b4da05f8631e42d6b08baac098bd479a
-
SHA1
81a0bcfb22667df52f634fe6655a908a39aee63a
-
SHA256
0707d325cb1e155c64da6250105089ba37e867b75109e4e5a59789936a7f39a4
-
SHA512
b899d3ac5df07401760522432ce2e5e951b923c605d0ede77437682870f784dbab540d5fab2431c8491f8c7b0f5570f053edd6fff862ca18e1412e3ec1a718d4
-
SSDEEP
6144:M29qRfVSndj30B3wBxE1+ijiBKk3etdgI2MyzNORQtOfl1qNVo7R+S+N/TU7kn5l:0RfQn+w8EYiBlMkn5f9J105s
Malware Config
Extracted
sakula
www.polarroute.com
Signatures
-
Sakula payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1716-0-0x0000000000400000-0x0000000000420000-memory.dmp family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula behavioral1/memory/1752-7-0x0000000000400000-0x0000000000420000-memory.dmp family_sakula \Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula behavioral1/memory/1716-8-0x0000000000400000-0x0000000000420000-memory.dmp family_sakula -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2788 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 1752 MediaCenter.exe -
Loads dropped DLL 1 IoCs
Processes:
b4da05f8631e42d6b08baac098bd479a.exepid process 1716 b4da05f8631e42d6b08baac098bd479a.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
b4da05f8631e42d6b08baac098bd479a.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" b4da05f8631e42d6b08baac098bd479a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
b4da05f8631e42d6b08baac098bd479a.exedescription pid process Token: SeIncBasePriorityPrivilege 1716 b4da05f8631e42d6b08baac098bd479a.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
b4da05f8631e42d6b08baac098bd479a.execmd.exedescription pid process target process PID 1716 wrote to memory of 1752 1716 b4da05f8631e42d6b08baac098bd479a.exe MediaCenter.exe PID 1716 wrote to memory of 1752 1716 b4da05f8631e42d6b08baac098bd479a.exe MediaCenter.exe PID 1716 wrote to memory of 1752 1716 b4da05f8631e42d6b08baac098bd479a.exe MediaCenter.exe PID 1716 wrote to memory of 1752 1716 b4da05f8631e42d6b08baac098bd479a.exe MediaCenter.exe PID 1716 wrote to memory of 2788 1716 b4da05f8631e42d6b08baac098bd479a.exe cmd.exe PID 1716 wrote to memory of 2788 1716 b4da05f8631e42d6b08baac098bd479a.exe cmd.exe PID 1716 wrote to memory of 2788 1716 b4da05f8631e42d6b08baac098bd479a.exe cmd.exe PID 1716 wrote to memory of 2788 1716 b4da05f8631e42d6b08baac098bd479a.exe cmd.exe PID 2788 wrote to memory of 2816 2788 cmd.exe PING.EXE PID 2788 wrote to memory of 2816 2788 cmd.exe PING.EXE PID 2788 wrote to memory of 2816 2788 cmd.exe PING.EXE PID 2788 wrote to memory of 2816 2788 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\b4da05f8631e42d6b08baac098bd479a.exe"C:\Users\Admin\AppData\Local\Temp\b4da05f8631e42d6b08baac098bd479a.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:1752 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\b4da05f8631e42d6b08baac098bd479a.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:2816
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Cab92DF.tmpFilesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
167KB
MD5bc06c1163c8f8713dbb498f5d7c6a612
SHA1c48e4fe5a3df2f0cee84918e5c4d166488db5b01
SHA2569efc94a1b694c2c189e4104f1e19a0de8af2b48c9dcb0c78c89326412ec34ab8
SHA512eaa1923b3945bd42d2e0a6c9712edc29e50795e984945e8e67bc1c5b321598476354a147b2358bf2bd94da2fadd1f0f8caebe21fcdfcd0191e191468d3915e3a
-
C:\Users\Admin\AppData\Local\Temp\Tar9301.tmpFilesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
201KB
MD56642c7bcbc293e30954d425d2a53bb83
SHA1200af8477d8ba377969fc22e440e6afdcd3b9a73
SHA2565f888496dc4763836f5a3ce4b4691f1535bb046a9df0287572367a4210313bde
SHA5124a400df9d358f957dcb5302e79dd360897f3624df1ddef0d43a9da98e7cd209150704159058ce2951bd9ecd0a70931d57f2c506f5b3ed0125b4d99704a85c0df
-
memory/1716-0-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1716-5-0x0000000000230000-0x0000000000250000-memory.dmpFilesize
128KB
-
memory/1716-8-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1716-9-0x0000000000230000-0x0000000000250000-memory.dmpFilesize
128KB
-
memory/1752-7-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB