Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
20-12-2023 15:17
Behavioral task
behavioral1
Sample
d4c5737c0af19dce355a6cea4b155d83.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
d4c5737c0af19dce355a6cea4b155d83.exe
Resource
win10v2004-20231215-en
General
-
Target
d4c5737c0af19dce355a6cea4b155d83.exe
-
Size
92KB
-
MD5
d4c5737c0af19dce355a6cea4b155d83
-
SHA1
7dbaabc81908474c6d2b7344066a52c17d782de1
-
SHA256
dbaf2510b30e72e842f27bc9e5d132ac49adfe20053dc8baee2c2ee6c929631e
-
SHA512
bed5c7f31dd58c19b5942f1b134427f0ae320bb272dcc3e35f6a1dd32ee4cba3b3d38fa06cf7e5b5e37d97cad6a9a5e72f690cdefa224e5b97ad56e85549c422
-
SSDEEP
1536:TJbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtrzv:9bfVk29te2jqxCEtg30BX
Malware Config
Extracted
sakula
www.savmpet.com
Signatures
-
Sakula payload 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe family_sakula -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
d4c5737c0af19dce355a6cea4b155d83.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation d4c5737c0af19dce355a6cea4b155d83.exe -
Executes dropped EXE 1 IoCs
Processes:
AdobeUpdate.exepid process 2264 AdobeUpdate.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
d4c5737c0af19dce355a6cea4b155d83.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AdobeUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\AdobeUpdate.exe" d4c5737c0af19dce355a6cea4b155d83.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
d4c5737c0af19dce355a6cea4b155d83.exedescription pid process Token: SeIncBasePriorityPrivilege 1788 d4c5737c0af19dce355a6cea4b155d83.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
d4c5737c0af19dce355a6cea4b155d83.execmd.exedescription pid process target process PID 1788 wrote to memory of 2264 1788 d4c5737c0af19dce355a6cea4b155d83.exe AdobeUpdate.exe PID 1788 wrote to memory of 2264 1788 d4c5737c0af19dce355a6cea4b155d83.exe AdobeUpdate.exe PID 1788 wrote to memory of 2264 1788 d4c5737c0af19dce355a6cea4b155d83.exe AdobeUpdate.exe PID 1788 wrote to memory of 4396 1788 d4c5737c0af19dce355a6cea4b155d83.exe cmd.exe PID 1788 wrote to memory of 4396 1788 d4c5737c0af19dce355a6cea4b155d83.exe cmd.exe PID 1788 wrote to memory of 4396 1788 d4c5737c0af19dce355a6cea4b155d83.exe cmd.exe PID 4396 wrote to memory of 4928 4396 cmd.exe PING.EXE PID 4396 wrote to memory of 4928 4396 cmd.exe PING.EXE PID 4396 wrote to memory of 4928 4396 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4c5737c0af19dce355a6cea4b155d83.exe"C:\Users\Admin\AppData\Local\Temp\d4c5737c0af19dce355a6cea4b155d83.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe2⤵
- Executes dropped EXE
PID:2264 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\d4c5737c0af19dce355a6cea4b155d83.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:4928
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD5dc2e7b9c7cfd32e03b44fea2932a8175
SHA17829d60e089e146886802e899f725072b33b23b2
SHA256e0c315559fafe6ab256248cf218741d6b87a9d064f0d70379a904eea2f3f9497
SHA51235e68667c5047b2f0de5e72362fcb6cf3b5229d0540c991f1cede44e74eb71b1e3eb0f7bbe5ae6433ec0879da79a2bc497f80b5e5e9944eaf29d9dd016a57a43