Analysis
-
max time kernel
138s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-06-2024 20:37
Behavioral task
behavioral1
Sample
37973dfd239f46d994cfa4c6ec07e08c77859638db5325992cec7bd24612466c.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
37973dfd239f46d994cfa4c6ec07e08c77859638db5325992cec7bd24612466c.exe
Resource
win10v2004-20240508-en
General
-
Target
37973dfd239f46d994cfa4c6ec07e08c77859638db5325992cec7bd24612466c.exe
-
Size
108KB
-
MD5
3d5091b4c0e4ee6d408521a8a021770c
-
SHA1
c272dad21f055a44946cde9c2017a45511f59d28
-
SHA256
37973dfd239f46d994cfa4c6ec07e08c77859638db5325992cec7bd24612466c
-
SHA512
2a723ac9623887f745b56022f43715e1e3d9ece96ad709674f18107df3ffebfcece0e9f3e164f4997d8542426830d336a82ce66799ff195476317e36ed614ad0
-
SSDEEP
1536:oQFl29mEkE0L1rDEKrxZKF2zf9g2Pl7W/MwbxMX+8es52z30rtr0izbR9Xwz9:329DkEGRQixVSjLwes5G30BfPvwh
Malware Config
Extracted
sakula
www.polarroute.com
Signatures
-
Sakula payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/2600-1-0x0000000000400000-0x0000000000420000-memory.dmp family_sakula C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe family_sakula behavioral2/memory/3096-5-0x0000000000400000-0x0000000000420000-memory.dmp family_sakula behavioral2/memory/2600-6-0x0000000000400000-0x0000000000420000-memory.dmp family_sakula -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
37973dfd239f46d994cfa4c6ec07e08c77859638db5325992cec7bd24612466c.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 37973dfd239f46d994cfa4c6ec07e08c77859638db5325992cec7bd24612466c.exe -
Executes dropped EXE 1 IoCs
Processes:
MediaCenter.exepid process 3096 MediaCenter.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
37973dfd239f46d994cfa4c6ec07e08c77859638db5325992cec7bd24612466c.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" 37973dfd239f46d994cfa4c6ec07e08c77859638db5325992cec7bd24612466c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
37973dfd239f46d994cfa4c6ec07e08c77859638db5325992cec7bd24612466c.exedescription pid process Token: SeIncBasePriorityPrivilege 2600 37973dfd239f46d994cfa4c6ec07e08c77859638db5325992cec7bd24612466c.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
37973dfd239f46d994cfa4c6ec07e08c77859638db5325992cec7bd24612466c.execmd.exedescription pid process target process PID 2600 wrote to memory of 3096 2600 37973dfd239f46d994cfa4c6ec07e08c77859638db5325992cec7bd24612466c.exe MediaCenter.exe PID 2600 wrote to memory of 3096 2600 37973dfd239f46d994cfa4c6ec07e08c77859638db5325992cec7bd24612466c.exe MediaCenter.exe PID 2600 wrote to memory of 3096 2600 37973dfd239f46d994cfa4c6ec07e08c77859638db5325992cec7bd24612466c.exe MediaCenter.exe PID 2600 wrote to memory of 4900 2600 37973dfd239f46d994cfa4c6ec07e08c77859638db5325992cec7bd24612466c.exe cmd.exe PID 2600 wrote to memory of 4900 2600 37973dfd239f46d994cfa4c6ec07e08c77859638db5325992cec7bd24612466c.exe cmd.exe PID 2600 wrote to memory of 4900 2600 37973dfd239f46d994cfa4c6ec07e08c77859638db5325992cec7bd24612466c.exe cmd.exe PID 4900 wrote to memory of 2096 4900 cmd.exe PING.EXE PID 4900 wrote to memory of 2096 4900 cmd.exe PING.EXE PID 4900 wrote to memory of 2096 4900 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\37973dfd239f46d994cfa4c6ec07e08c77859638db5325992cec7bd24612466c.exe"C:\Users\Admin\AppData\Local\Temp\37973dfd239f46d994cfa4c6ec07e08c77859638db5325992cec7bd24612466c.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeC:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\37973dfd239f46d994cfa4c6ec07e08c77859638db5325992cec7bd24612466c.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exeFilesize
108KB
MD5dfaea58b34f89fcd6dbf76df1fb05376
SHA1853632f086e1d109e06bf8463353e9596a20be43
SHA256d10bd251fd4ef3d007bd06f1c27c227e91ef58c8aa475f61372c12adb86137f0
SHA512d2f58b90305e9b8bf33adde760b281c016f193a4cdbb9a9f98a474b9ba5c0ec33c2d10a0c34e7f3126683caf50bf642f163f8375c1c2691f0052d144f1ac1997
-
memory/2600-1-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2600-6-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3096-5-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB