Analysis
-
max time kernel
147s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
03-11-2024 21:30
Behavioral task
behavioral1
Sample
7a329ca71bf6e1b67e4a525429d5176b3dbc6b1709f02e1f643220c036017cbfN.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
7a329ca71bf6e1b67e4a525429d5176b3dbc6b1709f02e1f643220c036017cbfN.exe
Resource
win10v2004-20241007-en
General
-
Target
7a329ca71bf6e1b67e4a525429d5176b3dbc6b1709f02e1f643220c036017cbfN.exe
-
Size
89KB
-
MD5
d428c6faf1aa8e4948d52da342014e80
-
SHA1
c6a3780dfb87552b655ff0ad2d214576780d71ed
-
SHA256
7a329ca71bf6e1b67e4a525429d5176b3dbc6b1709f02e1f643220c036017cbf
-
SHA512
53987c1438437f48ba426cf93a50659e9f009fda3fbbbc151084b3e222689cb9bfd449c7a59bca6433f91611967fe69b13a779d21ab61b178f363a64574e6762
-
SSDEEP
1536:PQFl29mEkE0L1rDEKrxZKF2zf9g2Pl7W/MwbxMX+ees52z30rtrF:w29DkEGRQixVSjLaes5G30Bp
Malware Config
Extracted
sakula
www.polarroute.com
Signatures
-
Sakula family
-
Sakula payload 1 IoCs
resource yara_rule behavioral1/files/0x000900000001756b-1.dat family_sakula -
Deletes itself 1 IoCs
pid Process 2636 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2748 MediaCenter.exe -
Loads dropped DLL 1 IoCs
pid Process 2484 7a329ca71bf6e1b67e4a525429d5176b3dbc6b1709f02e1f643220c036017cbfN.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" 7a329ca71bf6e1b67e4a525429d5176b3dbc6b1709f02e1f643220c036017cbfN.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7a329ca71bf6e1b67e4a525429d5176b3dbc6b1709f02e1f643220c036017cbfN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MediaCenter.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2636 cmd.exe 2372 PING.EXE -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2372 PING.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2484 7a329ca71bf6e1b67e4a525429d5176b3dbc6b1709f02e1f643220c036017cbfN.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2484 wrote to memory of 2748 2484 7a329ca71bf6e1b67e4a525429d5176b3dbc6b1709f02e1f643220c036017cbfN.exe 30 PID 2484 wrote to memory of 2748 2484 7a329ca71bf6e1b67e4a525429d5176b3dbc6b1709f02e1f643220c036017cbfN.exe 30 PID 2484 wrote to memory of 2748 2484 7a329ca71bf6e1b67e4a525429d5176b3dbc6b1709f02e1f643220c036017cbfN.exe 30 PID 2484 wrote to memory of 2748 2484 7a329ca71bf6e1b67e4a525429d5176b3dbc6b1709f02e1f643220c036017cbfN.exe 30 PID 2484 wrote to memory of 2636 2484 7a329ca71bf6e1b67e4a525429d5176b3dbc6b1709f02e1f643220c036017cbfN.exe 32 PID 2484 wrote to memory of 2636 2484 7a329ca71bf6e1b67e4a525429d5176b3dbc6b1709f02e1f643220c036017cbfN.exe 32 PID 2484 wrote to memory of 2636 2484 7a329ca71bf6e1b67e4a525429d5176b3dbc6b1709f02e1f643220c036017cbfN.exe 32 PID 2484 wrote to memory of 2636 2484 7a329ca71bf6e1b67e4a525429d5176b3dbc6b1709f02e1f643220c036017cbfN.exe 32 PID 2636 wrote to memory of 2372 2636 cmd.exe 34 PID 2636 wrote to memory of 2372 2636 cmd.exe 34 PID 2636 wrote to memory of 2372 2636 cmd.exe 34 PID 2636 wrote to memory of 2372 2636 cmd.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a329ca71bf6e1b67e4a525429d5176b3dbc6b1709f02e1f643220c036017cbfN.exe"C:\Users\Admin\AppData\Local\Temp\7a329ca71bf6e1b67e4a525429d5176b3dbc6b1709f02e1f643220c036017cbfN.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2748
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\7a329ca71bf6e1b67e4a525429d5176b3dbc6b1709f02e1f643220c036017cbfN.exe"2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2372
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
89KB
MD5181bb0afbc003f740cca6481089631d5
SHA1c7ecf05d995391a764552904cd07853a283fb44b
SHA256e87716240bef95dad7febdea3807810559784c1755224552760e17879ce00d2d
SHA512eb3b0c19f02781901293a283f8691fe1f47817aae6b4ebeeb8cd8c2173a579141119ce241a0975a2e39e73f34719f705c3881f7ce6b0039c245b6a8952636843