Analysis
-
max time kernel
144s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
11-04-2024 20:21
Behavioral task
behavioral1
Sample
3b5310c324f196e3e314d73df0013b3541872da9ade765b66639277bcb8a9cca.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3b5310c324f196e3e314d73df0013b3541872da9ade765b66639277bcb8a9cca.exe
Resource
win10v2004-20240226-en
General
-
Target
3b5310c324f196e3e314d73df0013b3541872da9ade765b66639277bcb8a9cca.exe
-
Size
195KB
-
MD5
dd362d4744eaf82a8fec28eb656fad98
-
SHA1
eb9da2ead66377499ad8ef1a0445d5938622a387
-
SHA256
3b5310c324f196e3e314d73df0013b3541872da9ade765b66639277bcb8a9cca
-
SHA512
77e48139b2ff33ea674ff5a8506b80a1232f1e4cadd4fc8e0208e2e71fd5548a53a028713a8caf54bf0f792ebcdb061ea55381eb7a8ae936117b4026b385df9f
-
SSDEEP
3072:6PPUj3+5FMIn8To94wa7uZwOuz/xS3iGpZMhDEXzkOSUUKeF8a7bXxs:6UC5TUm4wZwBxE1+ijis
Malware Config
Extracted
sakula
www.polarroute.com
Signatures
-
Sakula payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4948-5-0x0000000000400000-0x0000000000424000-memory.dmp family_sakula behavioral2/memory/4780-6-0x0000000000400000-0x0000000000424000-memory.dmp family_sakula behavioral2/memory/4948-11-0x0000000000400000-0x0000000000424000-memory.dmp family_sakula behavioral2/memory/4780-17-0x0000000000400000-0x0000000000424000-memory.dmp family_sakula -
UPX dump on OEP (original entry point) 6 IoCs
Processes:
resource yara_rule behavioral2/memory/4948-0-0x0000000000400000-0x0000000000424000-memory.dmp UPX C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe UPX behavioral2/memory/4948-5-0x0000000000400000-0x0000000000424000-memory.dmp UPX behavioral2/memory/4780-6-0x0000000000400000-0x0000000000424000-memory.dmp UPX behavioral2/memory/4948-11-0x0000000000400000-0x0000000000424000-memory.dmp UPX behavioral2/memory/4780-17-0x0000000000400000-0x0000000000424000-memory.dmp UPX -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
3b5310c324f196e3e314d73df0013b3541872da9ade765b66639277bcb8a9cca.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation 3b5310c324f196e3e314d73df0013b3541872da9ade765b66639277bcb8a9cca.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 4780 MediaCenter.exe -
Processes:
resource yara_rule behavioral2/memory/4948-0-0x0000000000400000-0x0000000000424000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe upx behavioral2/memory/4948-5-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/4780-6-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/4948-11-0x0000000000400000-0x0000000000424000-memory.dmp upx behavioral2/memory/4780-17-0x0000000000400000-0x0000000000424000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
3b5310c324f196e3e314d73df0013b3541872da9ade765b66639277bcb8a9cca.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" 3b5310c324f196e3e314d73df0013b3541872da9ade765b66639277bcb8a9cca.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
3b5310c324f196e3e314d73df0013b3541872da9ade765b66639277bcb8a9cca.exedescription pid process Token: SeIncBasePriorityPrivilege 4948 3b5310c324f196e3e314d73df0013b3541872da9ade765b66639277bcb8a9cca.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
3b5310c324f196e3e314d73df0013b3541872da9ade765b66639277bcb8a9cca.execmd.exedescription pid process target process PID 4948 wrote to memory of 4780 4948 3b5310c324f196e3e314d73df0013b3541872da9ade765b66639277bcb8a9cca.exe MediaCenter.exe PID 4948 wrote to memory of 4780 4948 3b5310c324f196e3e314d73df0013b3541872da9ade765b66639277bcb8a9cca.exe MediaCenter.exe PID 4948 wrote to memory of 4780 4948 3b5310c324f196e3e314d73df0013b3541872da9ade765b66639277bcb8a9cca.exe MediaCenter.exe PID 4948 wrote to memory of 2040 4948 3b5310c324f196e3e314d73df0013b3541872da9ade765b66639277bcb8a9cca.exe cmd.exe PID 4948 wrote to memory of 2040 4948 3b5310c324f196e3e314d73df0013b3541872da9ade765b66639277bcb8a9cca.exe cmd.exe PID 4948 wrote to memory of 2040 4948 3b5310c324f196e3e314d73df0013b3541872da9ade765b66639277bcb8a9cca.exe cmd.exe PID 2040 wrote to memory of 232 2040 cmd.exe PING.EXE PID 2040 wrote to memory of 232 2040 cmd.exe PING.EXE PID 2040 wrote to memory of 232 2040 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b5310c324f196e3e314d73df0013b3541872da9ade765b66639277bcb8a9cca.exe"C:\Users\Admin\AppData\Local\Temp\3b5310c324f196e3e314d73df0013b3541872da9ade765b66639277bcb8a9cca.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\3b5310c324f196e3e314d73df0013b3541872da9ade765b66639277bcb8a9cca.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4072 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
195KB
MD543c4ddf46778a3d366069bb412492bf1
SHA1580b31e9defa4f031c3609086b27b144a7f4ff64
SHA25683143d10d5156af6f40834c1a414ba33ced6270024ecae7bcac2dec749157f09
SHA512ed0d8c8e47763d8fcb7fcaa7415ad6ec6bb3bf68c76c51a513af4023b1428af4e39fe0445ae808cc90ecda1df67577ce2faaa8e0cae23f883a14e8a69b44f582
-
memory/4780-6-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/4780-17-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/4948-0-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/4948-5-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/4948-11-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB