Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
20-12-2023 12:51
Behavioral task
behavioral1
Sample
b4da05f8631e42d6b08baac098bd479a.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
b4da05f8631e42d6b08baac098bd479a.exe
Resource
win10v2004-20231215-en
General
-
Target
b4da05f8631e42d6b08baac098bd479a.exe
-
Size
392KB
-
MD5
b4da05f8631e42d6b08baac098bd479a
-
SHA1
81a0bcfb22667df52f634fe6655a908a39aee63a
-
SHA256
0707d325cb1e155c64da6250105089ba37e867b75109e4e5a59789936a7f39a4
-
SHA512
b899d3ac5df07401760522432ce2e5e951b923c605d0ede77437682870f784dbab540d5fab2431c8491f8c7b0f5570f053edd6fff862ca18e1412e3ec1a718d4
-
SSDEEP
6144:M29qRfVSndj30B3wBxE1+ijiBKk3etdgI2MyzNORQtOfl1qNVo7R+S+N/TU7kn5l:0RfQn+w8EYiBlMkn5f9J105s
Malware Config
Extracted
sakula
www.polarroute.com
Signatures
-
Sakula payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/5052-0-0x0000000000400000-0x0000000000420000-memory.dmp family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula behavioral2/memory/4508-5-0x0000000000400000-0x0000000000420000-memory.dmp family_sakula behavioral2/memory/5052-6-0x0000000000400000-0x0000000000420000-memory.dmp family_sakula -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
b4da05f8631e42d6b08baac098bd479a.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation b4da05f8631e42d6b08baac098bd479a.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 4508 MediaCenter.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
b4da05f8631e42d6b08baac098bd479a.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" b4da05f8631e42d6b08baac098bd479a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
b4da05f8631e42d6b08baac098bd479a.exedescription pid process Token: SeIncBasePriorityPrivilege 5052 b4da05f8631e42d6b08baac098bd479a.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
b4da05f8631e42d6b08baac098bd479a.execmd.exedescription pid process target process PID 5052 wrote to memory of 4508 5052 b4da05f8631e42d6b08baac098bd479a.exe MediaCenter.exe PID 5052 wrote to memory of 4508 5052 b4da05f8631e42d6b08baac098bd479a.exe MediaCenter.exe PID 5052 wrote to memory of 4508 5052 b4da05f8631e42d6b08baac098bd479a.exe MediaCenter.exe PID 5052 wrote to memory of 880 5052 b4da05f8631e42d6b08baac098bd479a.exe cmd.exe PID 5052 wrote to memory of 880 5052 b4da05f8631e42d6b08baac098bd479a.exe cmd.exe PID 5052 wrote to memory of 880 5052 b4da05f8631e42d6b08baac098bd479a.exe cmd.exe PID 880 wrote to memory of 2972 880 cmd.exe PING.EXE PID 880 wrote to memory of 2972 880 cmd.exe PING.EXE PID 880 wrote to memory of 2972 880 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\b4da05f8631e42d6b08baac098bd479a.exe"C:\Users\Admin\AppData\Local\Temp\b4da05f8631e42d6b08baac098bd479a.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
PID:4508 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\b4da05f8631e42d6b08baac098bd479a.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:2972
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BP0ZYM9B\vzkfqalw-388333569[1].htmFilesize
1KB
MD58d4c07efda188f4ca3290b68b7b5c2b4
SHA1ba392480e4f36eaf02ce8df0e7b3ca86aebbd3ea
SHA256e27b64c9737988f9d6a1bff653e7de7b46c8150133d6b4e9061b70d70dbde8b4
SHA512fbbd1b4596151b13a9de1ed87c37783f2e7519c1e0b7f90fe00cba33a848b538fcb8474d0975fb18568085e81e84053d4ec2f18021fcc76cda68e0b808ed2ef2
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
392KB
MD50d452728c7ab90512b461923e08792f5
SHA12e1b47212187839724ef8ec365226ddee53c1dd4
SHA256d180e8ceeada4a4e07c7b48e5e7ec82ea43166cdd760fce9f6f8bae6fe55d143
SHA5124b8a0c00746821e2161036a5be9a4973a40a6bea53407e76dcaaadeb084079675d2a9092efc0886b8f7b7ee432a80f3f52196d1c4cc794dce518ece8ca875df9
-
memory/4508-5-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/5052-0-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/5052-6-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB