Overview

overview

10

Static

static

8d168092d5...e9.exe

windows7_x64

10

8d168092d5...e9.exe

windows10_x64

10

Analysis

  • max time kernel
    158s
  • max time network
    158s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    22-01-2022 01:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8d168092d5601ebbaed24ec3caeef7454c48cf21366cd76560755eb33aff89e9.exe

  • Size

    496KB

  • MD5

    98721c78dfbf8a45d152a888c804427c

  • SHA1

    e8d06bd24e600f95b67786db6ff37da1c8995854

  • SHA256

    8d168092d5601ebbaed24ec3caeef7454c48cf21366cd76560755eb33aff89e9

  • SHA512

    5f5bf474744c715965a3fff72d5091cec45196b4c2afe44c3ae0e54e08a5a5b8c34494501961b6f2bdfa1a74f9d0b8990b09547beb34e8604ab735b944c15296

Score
10/10
sakulapersistencerattrojan

Malware Config

Signatures

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula
  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Windows directory 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8d168092d5601ebbaed24ec3caeef7454c48cf21366cd76560755eb33aff89e9.exe
    "C:\Users\Admin\AppData\Local\Temp\8d168092d5601ebbaed24ec3caeef7454c48cf21366cd76560755eb33aff89e9.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3724
    • C:\Users\Admin\AppData\Local\Temp\Center259383921.dat
      "C:\Users\Admin\AppData\Local\Temp\Center259383921.dat"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3836
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:416
        • C:\Windows\SysWOW64\reg.exe
          reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"
          4⤵
          • Adds Run key to start application
          • Modifies registry key
          PID:1528
      • C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
        C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
        3⤵
        • Executes dropped EXE
        PID:1816
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\Center259383921.dat"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3060
        • C:\Windows\SysWOW64\PING.EXE
          ping 127.0.0.1
          4⤵
          • Runs ping.exe
          PID:4080
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:3944
  • C:\Windows\system32\browser_broker.exe
    C:\Windows\system32\browser_broker.exe -Embedding
    1⤵
    • Modifies Internet Explorer settings
    PID:700
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies registry class
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2984
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:3592
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies registry class
    PID:2096
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies registry class
    PID:4012
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:2084

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Center259383921.dat
    MD5

    cb56b1fc08451d1f56481a29bd1047e9

    SHA1

    c01fbb52a7a188c4f7441a808b153a34ec753a2d

    SHA256

    3e2805c14a8ec785a36022218a37a235abe4548baf1bde50aa05dc5692f01ed1

    SHA512

    b088e9d5b28727c23f54e84cffc5f249ddeb00cb0ce97c3776c3195d2a46e000b90690b17882110ed5d60b8184b0d77f8659b72608dc78899a1dcab582f55eb8

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Center259383921.dat
    MD5

    cb56b1fc08451d1f56481a29bd1047e9

    SHA1

    c01fbb52a7a188c4f7441a808b153a34ec753a2d

    SHA256

    3e2805c14a8ec785a36022218a37a235abe4548baf1bde50aa05dc5692f01ed1

    SHA512

    b088e9d5b28727c23f54e84cffc5f249ddeb00cb0ce97c3776c3195d2a46e000b90690b17882110ed5d60b8184b0d77f8659b72608dc78899a1dcab582f55eb8

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
    MD5

    7181ee2cee01f1eb5a2894d78780fc61

    SHA1

    7df2723b625dea3b69b0b377bcddf53ef797d25e

    SHA256

    f6b03c787755583375e460a18c3e41c8cbc96d4c1114a281e3fcd4292a0c7e40

    SHA512

    0c8e1c7f4cb76dc503833505cfd0beeb87a061d99b8c98cdd17923c86c2e8c4b2ae34663c77c04dd63230fdeb435b4da0316545814c9c1ba9a75191a0e99605e

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
    MD5

    7181ee2cee01f1eb5a2894d78780fc61

    SHA1

    7df2723b625dea3b69b0b377bcddf53ef797d25e

    SHA256

    f6b03c787755583375e460a18c3e41c8cbc96d4c1114a281e3fcd4292a0c7e40

    SHA512

    0c8e1c7f4cb76dc503833505cfd0beeb87a061d99b8c98cdd17923c86c2e8c4b2ae34663c77c04dd63230fdeb435b4da0316545814c9c1ba9a75191a0e99605e

    Download Submit