Analysis
-
max time kernel
107s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 20:02
Behavioral task
behavioral1
Sample
15e6099dffcffe39a6311b3f00d1462614efb714621392f2350c21b2efc4d71cN.exe
Resource
win7-20240729-en
General
-
Target
15e6099dffcffe39a6311b3f00d1462614efb714621392f2350c21b2efc4d71cN.exe
-
Size
140KB
-
MD5
1641e822ff2521dbf344db79f0267b90
-
SHA1
c25e28ba0dd376ceeab2cb2b959be8babc645190
-
SHA256
15e6099dffcffe39a6311b3f00d1462614efb714621392f2350c21b2efc4d71c
-
SHA512
0347b1cf5ebcf64bb7ca81c249c026219541669a25aa6f5a1f876f49185237460b14a820dd482be24ead26b6243d0ed4f74b6273ddffe0ee7d523a3115e6803b
-
SSDEEP
1536:6QFl29mEkE0L1rDEKrxZKF2zf9g2Pl7W/MwbxMX+mdz30rtr8gjmy9xNDCkrP:x29DkEGRQixVSjLa130BYgjmy9T7P
Malware Config
Extracted
sakula
www.polarroute.com
Signatures
-
Sakula family
-
Sakula payload 5 IoCs
resource yara_rule behavioral1/memory/2440-0-0x0000000000400000-0x0000000000425000-memory.dmp family_sakula behavioral1/files/0x00070000000186d9-2.dat family_sakula behavioral1/memory/2440-11-0x0000000000400000-0x0000000000425000-memory.dmp family_sakula behavioral1/memory/2216-13-0x0000000000400000-0x0000000000425000-memory.dmp family_sakula behavioral1/memory/2440-14-0x0000000000400000-0x0000000000425000-memory.dmp family_sakula -
Deletes itself 1 IoCs
pid Process 2836 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2216 MediaCenter.exe -
Loads dropped DLL 1 IoCs
pid Process 2440 15e6099dffcffe39a6311b3f00d1462614efb714621392f2350c21b2efc4d71cN.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" 15e6099dffcffe39a6311b3f00d1462614efb714621392f2350c21b2efc4d71cN.exe -
resource yara_rule behavioral1/memory/2440-0-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral1/files/0x00070000000186d9-2.dat upx behavioral1/memory/2440-11-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral1/memory/2216-13-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral1/memory/2440-14-0x0000000000400000-0x0000000000425000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15e6099dffcffe39a6311b3f00d1462614efb714621392f2350c21b2efc4d71cN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MediaCenter.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2836 cmd.exe 2652 PING.EXE -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2652 PING.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2440 15e6099dffcffe39a6311b3f00d1462614efb714621392f2350c21b2efc4d71cN.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2440 wrote to memory of 2216 2440 15e6099dffcffe39a6311b3f00d1462614efb714621392f2350c21b2efc4d71cN.exe 30 PID 2440 wrote to memory of 2216 2440 15e6099dffcffe39a6311b3f00d1462614efb714621392f2350c21b2efc4d71cN.exe 30 PID 2440 wrote to memory of 2216 2440 15e6099dffcffe39a6311b3f00d1462614efb714621392f2350c21b2efc4d71cN.exe 30 PID 2440 wrote to memory of 2216 2440 15e6099dffcffe39a6311b3f00d1462614efb714621392f2350c21b2efc4d71cN.exe 30 PID 2440 wrote to memory of 2836 2440 15e6099dffcffe39a6311b3f00d1462614efb714621392f2350c21b2efc4d71cN.exe 32 PID 2440 wrote to memory of 2836 2440 15e6099dffcffe39a6311b3f00d1462614efb714621392f2350c21b2efc4d71cN.exe 32 PID 2440 wrote to memory of 2836 2440 15e6099dffcffe39a6311b3f00d1462614efb714621392f2350c21b2efc4d71cN.exe 32 PID 2440 wrote to memory of 2836 2440 15e6099dffcffe39a6311b3f00d1462614efb714621392f2350c21b2efc4d71cN.exe 32 PID 2836 wrote to memory of 2652 2836 cmd.exe 34 PID 2836 wrote to memory of 2652 2836 cmd.exe 34 PID 2836 wrote to memory of 2652 2836 cmd.exe 34 PID 2836 wrote to memory of 2652 2836 cmd.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\15e6099dffcffe39a6311b3f00d1462614efb714621392f2350c21b2efc4d71cN.exe"C:\Users\Admin\AppData\Local\Temp\15e6099dffcffe39a6311b3f00d1462614efb714621392f2350c21b2efc4d71cN.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2216
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\15e6099dffcffe39a6311b3f00d1462614efb714621392f2350c21b2efc4d71cN.exe"2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2652
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
140KB
MD5776821aca820c3b7ccd9ca0da109b484
SHA159aa5331d22c777a50bba881e89d3d1d941069bc
SHA256e3ddc83a87caa469b5c15f2c3019b34d05472cd51a97940bf756cfd8449016ad
SHA512748dafdda041f639c0d1d0c177c871c45dbde393ae9667611dae565743fef608a4189a0e01a134c5c0d29b366eb0e6b605a76c3b75206beacbe4e71549a74e84