Analysis
-
max time kernel
96s -
max time network
101s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
10-10-2024 13:08
Behavioral task
behavioral1
Sample
451326adfc4d824ced6cb1171080aca672f1338525475a37d4f91df19de39688N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
451326adfc4d824ced6cb1171080aca672f1338525475a37d4f91df19de39688N.exe
Resource
win10v2004-20241007-en
General
-
Target
451326adfc4d824ced6cb1171080aca672f1338525475a37d4f91df19de39688N.exe
-
Size
92KB
-
MD5
dcab3163d20350622f32bf4c421abb20
-
SHA1
a6369b2c22fc1d6f1298ab7ed439a7194c660617
-
SHA256
451326adfc4d824ced6cb1171080aca672f1338525475a37d4f91df19de39688
-
SHA512
fcb2b0ae3d9c392da840528458bc38112f9ba8d86e6929aef3d335c7f006d5a35c39e7d2d6c98d6334c4b351e27453a462f02c5183802a3e474d61bb6802b1f9
-
SSDEEP
1536:TJbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtr6:9bfVk29te2jqxCEtg30BG
Malware Config
Extracted
sakula
www.savmpet.com
Signatures
-
Sakula payload 1 IoCs
resource yara_rule behavioral1/files/0x000f000000018683-1.dat family_sakula -
Deletes itself 1 IoCs
pid Process 2796 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 1792 AdobeUpdate.exe -
Loads dropped DLL 4 IoCs
pid Process 2248 451326adfc4d824ced6cb1171080aca672f1338525475a37d4f91df19de39688N.exe 1792 AdobeUpdate.exe 1792 AdobeUpdate.exe 1792 AdobeUpdate.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AdobeUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\AdobeUpdate.exe" 451326adfc4d824ced6cb1171080aca672f1338525475a37d4f91df19de39688N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 451326adfc4d824ced6cb1171080aca672f1338525475a37d4f91df19de39688N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AdobeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2948 PING.EXE 2796 cmd.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2948 PING.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2248 451326adfc4d824ced6cb1171080aca672f1338525475a37d4f91df19de39688N.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2248 wrote to memory of 1792 2248 451326adfc4d824ced6cb1171080aca672f1338525475a37d4f91df19de39688N.exe 30 PID 2248 wrote to memory of 1792 2248 451326adfc4d824ced6cb1171080aca672f1338525475a37d4f91df19de39688N.exe 30 PID 2248 wrote to memory of 1792 2248 451326adfc4d824ced6cb1171080aca672f1338525475a37d4f91df19de39688N.exe 30 PID 2248 wrote to memory of 1792 2248 451326adfc4d824ced6cb1171080aca672f1338525475a37d4f91df19de39688N.exe 30 PID 2248 wrote to memory of 1792 2248 451326adfc4d824ced6cb1171080aca672f1338525475a37d4f91df19de39688N.exe 30 PID 2248 wrote to memory of 1792 2248 451326adfc4d824ced6cb1171080aca672f1338525475a37d4f91df19de39688N.exe 30 PID 2248 wrote to memory of 1792 2248 451326adfc4d824ced6cb1171080aca672f1338525475a37d4f91df19de39688N.exe 30 PID 2248 wrote to memory of 2796 2248 451326adfc4d824ced6cb1171080aca672f1338525475a37d4f91df19de39688N.exe 33 PID 2248 wrote to memory of 2796 2248 451326adfc4d824ced6cb1171080aca672f1338525475a37d4f91df19de39688N.exe 33 PID 2248 wrote to memory of 2796 2248 451326adfc4d824ced6cb1171080aca672f1338525475a37d4f91df19de39688N.exe 33 PID 2248 wrote to memory of 2796 2248 451326adfc4d824ced6cb1171080aca672f1338525475a37d4f91df19de39688N.exe 33 PID 2796 wrote to memory of 2948 2796 cmd.exe 35 PID 2796 wrote to memory of 2948 2796 cmd.exe 35 PID 2796 wrote to memory of 2948 2796 cmd.exe 35 PID 2796 wrote to memory of 2948 2796 cmd.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\451326adfc4d824ced6cb1171080aca672f1338525475a37d4f91df19de39688N.exe"C:\Users\Admin\AppData\Local\Temp\451326adfc4d824ced6cb1171080aca672f1338525475a37d4f91df19de39688N.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1792
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\451326adfc4d824ced6cb1171080aca672f1338525475a37d4f91df19de39688N.exe"2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2948
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD50494db927e446cd49b14377ce799908b
SHA155f4248b5e657cc5ff6a02b70fbef2d339a2faf1
SHA25663d8f4c2075016fcc204b92f6c8a29cd7c9561b2fd7e1e69329f7ec4e3161d91
SHA512c6f87a8d3b295cf02cfabd647df4835f6c672c5094ba1477c3be767c77e06d4e092c70435eb4de30dabebda514bdfb2f4217905be7603f28addf68a8b3ab9a7d