Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
22/12/2024, 10:32
Behavioral task
behavioral1
Sample
651914d24649c40f8459d5af74ea2c829438f0bbc937da3687085fb56a964b31.exe
Resource
win7-20240729-en
General
-
Target
651914d24649c40f8459d5af74ea2c829438f0bbc937da3687085fb56a964b31.exe
-
Size
43KB
-
MD5
4e30d88b2a30edbead66b794a0b5a5f5
-
SHA1
5c8279c0166194bcadcb5c0694c22b4f0f703cfe
-
SHA256
651914d24649c40f8459d5af74ea2c829438f0bbc937da3687085fb56a964b31
-
SHA512
f49527b87799346d5aa967b37eff5d6849ba05a729c108f8f5a47dc4985a239d2868d2cd75566694bc4fa946c46658a5fbaa079713712cc9b2157a3d6311975b
-
SSDEEP
768:+U9XnKJv8KrtPNxT4oreP7cIK3yQpdk6x8pf9m4P/S0hVvIZiGDZ6RO8nHE8taqY:+U9abrtX4oocIK3yQkaY9z/S0hhy6k8y
Malware Config
Signatures
-
Sakula family
-
Sakula payload 5 IoCs
resource yara_rule behavioral1/memory/2732-11-0x0000000000C70000-0x0000000000C8F000-memory.dmp family_sakula behavioral1/memory/2184-12-0x0000000000E80000-0x0000000000E9F000-memory.dmp family_sakula behavioral1/memory/2732-16-0x0000000000C70000-0x0000000000C8F000-memory.dmp family_sakula behavioral1/memory/2184-22-0x0000000000E80000-0x0000000000E9F000-memory.dmp family_sakula behavioral1/memory/2732-27-0x0000000000C70000-0x0000000000C8F000-memory.dmp family_sakula -
Deletes itself 1 IoCs
pid Process 3020 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2732 MediaCenter.exe -
Loads dropped DLL 2 IoCs
pid Process 2184 651914d24649c40f8459d5af74ea2c829438f0bbc937da3687085fb56a964b31.exe 2184 651914d24649c40f8459d5af74ea2c829438f0bbc937da3687085fb56a964b31.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" 651914d24649c40f8459d5af74ea2c829438f0bbc937da3687085fb56a964b31.exe -
resource yara_rule behavioral1/memory/2184-0-0x0000000000E80000-0x0000000000E9F000-memory.dmp upx behavioral1/files/0x000700000001956c-2.dat upx behavioral1/memory/2732-11-0x0000000000C70000-0x0000000000C8F000-memory.dmp upx behavioral1/memory/2184-12-0x0000000000E80000-0x0000000000E9F000-memory.dmp upx behavioral1/memory/2732-16-0x0000000000C70000-0x0000000000C8F000-memory.dmp upx behavioral1/memory/2184-22-0x0000000000E80000-0x0000000000E9F000-memory.dmp upx behavioral1/memory/2732-27-0x0000000000C70000-0x0000000000C8F000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MediaCenter.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 651914d24649c40f8459d5af74ea2c829438f0bbc937da3687085fb56a964b31.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 3020 cmd.exe 856 PING.EXE -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 856 PING.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2184 651914d24649c40f8459d5af74ea2c829438f0bbc937da3687085fb56a964b31.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2184 wrote to memory of 2732 2184 651914d24649c40f8459d5af74ea2c829438f0bbc937da3687085fb56a964b31.exe 30 PID 2184 wrote to memory of 2732 2184 651914d24649c40f8459d5af74ea2c829438f0bbc937da3687085fb56a964b31.exe 30 PID 2184 wrote to memory of 2732 2184 651914d24649c40f8459d5af74ea2c829438f0bbc937da3687085fb56a964b31.exe 30 PID 2184 wrote to memory of 2732 2184 651914d24649c40f8459d5af74ea2c829438f0bbc937da3687085fb56a964b31.exe 30 PID 2184 wrote to memory of 3020 2184 651914d24649c40f8459d5af74ea2c829438f0bbc937da3687085fb56a964b31.exe 32 PID 2184 wrote to memory of 3020 2184 651914d24649c40f8459d5af74ea2c829438f0bbc937da3687085fb56a964b31.exe 32 PID 2184 wrote to memory of 3020 2184 651914d24649c40f8459d5af74ea2c829438f0bbc937da3687085fb56a964b31.exe 32 PID 2184 wrote to memory of 3020 2184 651914d24649c40f8459d5af74ea2c829438f0bbc937da3687085fb56a964b31.exe 32 PID 3020 wrote to memory of 856 3020 cmd.exe 34 PID 3020 wrote to memory of 856 3020 cmd.exe 34 PID 3020 wrote to memory of 856 3020 cmd.exe 34 PID 3020 wrote to memory of 856 3020 cmd.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\651914d24649c40f8459d5af74ea2c829438f0bbc937da3687085fb56a964b31.exe"C:\Users\Admin\AppData\Local\Temp\651914d24649c40f8459d5af74ea2c829438f0bbc937da3687085fb56a964b31.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2732
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\651914d24649c40f8459d5af74ea2c829438f0bbc937da3687085fb56a964b31.exe"2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:856
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
43KB
MD5abe6dc902dcbf0cbe575ae6377521572
SHA198c7a1c1870b04047b2020f43dc9848f6062b47b
SHA2562d9b907a1c28e1234dbfcc37415af7a984a74746785d4dd2ba36c507a7b600d4
SHA5128dca6328c725fb82e80d4a5ef17ae42bb0b199caccde64f1ed55d040d12ddcfb03e1559fa082cebc5d65450987dff8c4706dd867ae3849ff9960b7e9855d93a1