Analysis
-
max time kernel
96s -
max time network
78s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-11-2024 19:48
Behavioral task
behavioral1
Sample
b1e7be2bb326144fb528f105795e4c3b602b3c28db7a3a0fd8cf5487938ec137.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
b1e7be2bb326144fb528f105795e4c3b602b3c28db7a3a0fd8cf5487938ec137.exe
Resource
win10v2004-20241007-en
General
-
Target
b1e7be2bb326144fb528f105795e4c3b602b3c28db7a3a0fd8cf5487938ec137.exe
-
Size
3.6MB
-
MD5
1cc7c63af4eb7e2c5463c1f7f6dc8e40
-
SHA1
197ef0e34d392ebd7b3aa7cc38836064be833d4c
-
SHA256
b1e7be2bb326144fb528f105795e4c3b602b3c28db7a3a0fd8cf5487938ec137
-
SHA512
97635987be402ed195a9d790fcc0b59b3b7c41a45dfd2448e0d03394b817e98daff41a0da6ccd5031d4ea8501648f0a74e4f9863eab66d528b322460aa0f6273
-
SSDEEP
49152:o852ZjeUNZZH46HsnHVT5ZA+acdD6xXTI8:oU6eUNZZJHsHu
Malware Config
Extracted
sakula
www.polarroute.com
Signatures
-
Sakula family
-
Sakula payload 1 IoCs
Processes:
resource yara_rule behavioral1/files/0x00080000000174cc-1.dat family_sakula -
Deletes itself 1 IoCs
Processes:
cmd.exepid Process 2588 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid Process 352 MediaCenter.exe -
Loads dropped DLL 1 IoCs
Processes:
b1e7be2bb326144fb528f105795e4c3b602b3c28db7a3a0fd8cf5487938ec137.exepid Process 1444 b1e7be2bb326144fb528f105795e4c3b602b3c28db7a3a0fd8cf5487938ec137.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
b1e7be2bb326144fb528f105795e4c3b602b3c28db7a3a0fd8cf5487938ec137.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" b1e7be2bb326144fb528f105795e4c3b602b3c28db7a3a0fd8cf5487938ec137.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
PING.EXEb1e7be2bb326144fb528f105795e4c3b602b3c28db7a3a0fd8cf5487938ec137.exeMediaCenter.execmd.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b1e7be2bb326144fb528f105795e4c3b602b3c28db7a3a0fd8cf5487938ec137.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MediaCenter.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
Processes:
cmd.exePING.EXEpid Process 2588 cmd.exe 2700 PING.EXE -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
b1e7be2bb326144fb528f105795e4c3b602b3c28db7a3a0fd8cf5487938ec137.exedescription pid Process Token: SeIncBasePriorityPrivilege 1444 b1e7be2bb326144fb528f105795e4c3b602b3c28db7a3a0fd8cf5487938ec137.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
b1e7be2bb326144fb528f105795e4c3b602b3c28db7a3a0fd8cf5487938ec137.execmd.exedescription pid Process procid_target PID 1444 wrote to memory of 352 1444 b1e7be2bb326144fb528f105795e4c3b602b3c28db7a3a0fd8cf5487938ec137.exe 30 PID 1444 wrote to memory of 352 1444 b1e7be2bb326144fb528f105795e4c3b602b3c28db7a3a0fd8cf5487938ec137.exe 30 PID 1444 wrote to memory of 352 1444 b1e7be2bb326144fb528f105795e4c3b602b3c28db7a3a0fd8cf5487938ec137.exe 30 PID 1444 wrote to memory of 352 1444 b1e7be2bb326144fb528f105795e4c3b602b3c28db7a3a0fd8cf5487938ec137.exe 30 PID 1444 wrote to memory of 2588 1444 b1e7be2bb326144fb528f105795e4c3b602b3c28db7a3a0fd8cf5487938ec137.exe 32 PID 1444 wrote to memory of 2588 1444 b1e7be2bb326144fb528f105795e4c3b602b3c28db7a3a0fd8cf5487938ec137.exe 32 PID 1444 wrote to memory of 2588 1444 b1e7be2bb326144fb528f105795e4c3b602b3c28db7a3a0fd8cf5487938ec137.exe 32 PID 1444 wrote to memory of 2588 1444 b1e7be2bb326144fb528f105795e4c3b602b3c28db7a3a0fd8cf5487938ec137.exe 32 PID 2588 wrote to memory of 2700 2588 cmd.exe 34 PID 2588 wrote to memory of 2700 2588 cmd.exe 34 PID 2588 wrote to memory of 2700 2588 cmd.exe 34 PID 2588 wrote to memory of 2700 2588 cmd.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\b1e7be2bb326144fb528f105795e4c3b602b3c28db7a3a0fd8cf5487938ec137.exe"C:\Users\Admin\AppData\Local\Temp\b1e7be2bb326144fb528f105795e4c3b602b3c28db7a3a0fd8cf5487938ec137.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:352
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\b1e7be2bb326144fb528f105795e4c3b602b3c28db7a3a0fd8cf5487938ec137.exe"2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2700
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.6MB
MD5e4eab529c2ab1b871193a3eec8b108e6
SHA19dce3106eab32050645d628c13859cd6d0fc2c65
SHA256dea52b393db07efce06cf6428963157ad332dcacf8a73b0b3cab992ecfed5aff
SHA5123a0f4866b85b6b03c241a1157a31201aaf5d37f89374426898314792572f4a06f4042a032eaa891c663007629df11cccc9b656e39cf12e80746a45470ab6a8aa