Overview

overview

10

Static

static

10

72cf8d30db...77.exe

windows7_x64

10

72cf8d30db...77.exe

windows10_x64

10

Analysis

  • max time kernel
    142s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    22-01-2022 01:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    72cf8d30db4d3625c158fa8d9c57187cd50fdbe31c41592fde5126f3170bd277.exe

  • Size

    89KB

  • MD5

    a33c6daba951f7c9a30d69b5e1e58af9

  • SHA1

    1513023202ef672c565f14b98c48ea79bb57e881

  • SHA256

    72cf8d30db4d3625c158fa8d9c57187cd50fdbe31c41592fde5126f3170bd277

  • SHA512

    20458f88c5735f76aa0ed95de6753acd41d7630e62cd89d0f9c9c9ea7e3e9f15d1e0dad642ff15d6ac0969ccc6393f1c6f9409d0c272de4b114a3b7c5aabf985

Score
10/10
sakulapersistenceratsuricatatrojan

Malware Config

Signatures

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula
  • Sakula Payload 2 IoCs
  • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

    suricata: ET MALWARE SUSPICIOUS UA (iexplore)

    suricata
  • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

    suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

    suricata
  • Executes dropped EXE 1 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\72cf8d30db4d3625c158fa8d9c57187cd50fdbe31c41592fde5126f3170bd277.exe
    "C:\Users\Admin\AppData\Local\Temp\72cf8d30db4d3625c158fa8d9c57187cd50fdbe31c41592fde5126f3170bd277.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1692
    • C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
      C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
      2⤵
      • Executes dropped EXE
      PID:1488
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\72cf8d30db4d3625c158fa8d9c57187cd50fdbe31c41592fde5126f3170bd277.exe"
      2⤵
      • Deletes itself
      • Suspicious use of WriteProcessMemory
      PID:1768
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1
        3⤵
        • Runs ping.exe
        PID:1928

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
    MD5

    8b1265f8c7f0065dcd21683d060d0789

    SHA1

    297e530aabc89e369c6e2009192670e8dfd3ec2b

    SHA256

    0c7bcb6d62b2234de69c37457330fb27e96152178c3b187ee5a53ef3b0cfa4b9

    SHA512

    885d1150b31da617b2cf9e40ae8a7466064699169e0d5b8b8fd4518dddfcce9a397beba3cffd8ed554a7192c643b630b1deb64da9f61b6613f968d09399590a5

    Download Submit

  • \Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
    MD5

    8b1265f8c7f0065dcd21683d060d0789

    SHA1

    297e530aabc89e369c6e2009192670e8dfd3ec2b

    SHA256

    0c7bcb6d62b2234de69c37457330fb27e96152178c3b187ee5a53ef3b0cfa4b9

    SHA512

    885d1150b31da617b2cf9e40ae8a7466064699169e0d5b8b8fd4518dddfcce9a397beba3cffd8ed554a7192c643b630b1deb64da9f61b6613f968d09399590a5

    Download Submit

  • memory/1692-53-0x0000000075D51000-0x0000000075D53000-memory.dmp

    Filesize

    8KB

    Download