Analysis
-
max time kernel
115s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system -
submitted
01/02/2025, 12:34
Behavioral task
behavioral1
Sample
7cdb15b4ed3ac8a3c20a67a12b320e7551a101b7c42054fe77b5521238681d3e.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
7cdb15b4ed3ac8a3c20a67a12b320e7551a101b7c42054fe77b5521238681d3e.exe
Resource
win10v2004-20250129-en
General
-
Target
7cdb15b4ed3ac8a3c20a67a12b320e7551a101b7c42054fe77b5521238681d3e.exe
-
Size
92KB
-
MD5
af9c2ef84126a4db946fab35fc7d38b1
-
SHA1
30e07ab93c52099ed5273f45c7ecf26c3d51ed5e
-
SHA256
7cdb15b4ed3ac8a3c20a67a12b320e7551a101b7c42054fe77b5521238681d3e
-
SHA512
4988952148675816663191fe9fc9cefbb6539a214bdcafcb865464cfcce80820c5db34a3e4a83ce792d43040913ad6d626c7b90f8c1b6a54a27feede2d82aa2d
-
SSDEEP
1536:TJbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtrC:9bfVk29te2jqxCEtg30BO
Malware Config
Extracted
sakula
www.savmpet.com
Signatures
-
Sakula family
-
Sakula payload 1 IoCs
resource yara_rule behavioral2/files/0x0008000000023c61-2.dat family_sakula -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4174397412-4125106315-2776226590-1000\Control Panel\International\Geo\Nation 7cdb15b4ed3ac8a3c20a67a12b320e7551a101b7c42054fe77b5521238681d3e.exe -
Executes dropped EXE 1 IoCs
pid Process 4656 AdobeUpdate.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AdobeUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\AdobeUpdate.exe" 7cdb15b4ed3ac8a3c20a67a12b320e7551a101b7c42054fe77b5521238681d3e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7cdb15b4ed3ac8a3c20a67a12b320e7551a101b7c42054fe77b5521238681d3e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AdobeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 4116 cmd.exe 3960 PING.EXE -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3960 PING.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 636 7cdb15b4ed3ac8a3c20a67a12b320e7551a101b7c42054fe77b5521238681d3e.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 636 wrote to memory of 4656 636 7cdb15b4ed3ac8a3c20a67a12b320e7551a101b7c42054fe77b5521238681d3e.exe 83 PID 636 wrote to memory of 4656 636 7cdb15b4ed3ac8a3c20a67a12b320e7551a101b7c42054fe77b5521238681d3e.exe 83 PID 636 wrote to memory of 4656 636 7cdb15b4ed3ac8a3c20a67a12b320e7551a101b7c42054fe77b5521238681d3e.exe 83 PID 636 wrote to memory of 4116 636 7cdb15b4ed3ac8a3c20a67a12b320e7551a101b7c42054fe77b5521238681d3e.exe 91 PID 636 wrote to memory of 4116 636 7cdb15b4ed3ac8a3c20a67a12b320e7551a101b7c42054fe77b5521238681d3e.exe 91 PID 636 wrote to memory of 4116 636 7cdb15b4ed3ac8a3c20a67a12b320e7551a101b7c42054fe77b5521238681d3e.exe 91 PID 4116 wrote to memory of 3960 4116 cmd.exe 93 PID 4116 wrote to memory of 3960 4116 cmd.exe 93 PID 4116 wrote to memory of 3960 4116 cmd.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\7cdb15b4ed3ac8a3c20a67a12b320e7551a101b7c42054fe77b5521238681d3e.exe"C:\Users\Admin\AppData\Local\Temp\7cdb15b4ed3ac8a3c20a67a12b320e7551a101b7c42054fe77b5521238681d3e.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4656
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\7cdb15b4ed3ac8a3c20a67a12b320e7551a101b7c42054fe77b5521238681d3e.exe"2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3960
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD5a7e0ede768baa3958a3ad0252d7b98f6
SHA1399041a68610f1b5e36fb8525f5d64fb10a3ed57
SHA2566f28f3e3f04d4cc18ca7b8bd4df7eb9ce0a1cdb935c0e4a8754fc61d738a53e0
SHA51207fec673a2679196c539fa93b652bc04f1c291279f207dfc044c954a90726751d427bafcb80d7a557a9b4e167d348ddfe7502cb08eb7df3f6149e20aeb0779b8