Overview

overview

10

Static

static

10

0db4fb2bad...81.exe

windows7_x64

10

0db4fb2bad...81.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    145s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    12-02-2022 07:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0db4fb2bad1f1785c8fb6fa0e13f897d050ae7145de5e92ea61a216b34eb8b81.exe

  • Size

    92KB

  • MD5

    02a850e83c682ddcf704984205a829e4

  • SHA1

    a9e87fbfd449db177587f5026ec5488785dd9d3c

  • SHA256

    0db4fb2bad1f1785c8fb6fa0e13f897d050ae7145de5e92ea61a216b34eb8b81

  • SHA512

    50d5c29251d686ca535ecd6613e19f249ff961a4ae1b3111df4351a9d2265437bf769644addc7bb11ef98ad75f8ac097055c55730c990ce0f32125ba305ec949

Score
10/10
sakulapersistenceratsuricatatrojan

Malware Config

Signatures

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula
  • Sakula Payload 2 IoCs
  • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

    suricata: ET MALWARE SUSPICIOUS UA (iexplore)

    suricata
  • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

    suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

    suricata
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0db4fb2bad1f1785c8fb6fa0e13f897d050ae7145de5e92ea61a216b34eb8b81.exe
    "C:\Users\Admin\AppData\Local\Temp\0db4fb2bad1f1785c8fb6fa0e13f897d050ae7145de5e92ea61a216b34eb8b81.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3928
    • C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
      C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
      2⤵
      • Executes dropped EXE
      PID:4280
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\0db4fb2bad1f1785c8fb6fa0e13f897d050ae7145de5e92ea61a216b34eb8b81.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4692
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1
        3⤵
        • Runs ping.exe
        PID:1172
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2400
  • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
    C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:1068

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
    MD5

    3a85f7b216b781d8c87b19693cf21997

    SHA1

    a98e39e776449bad56e12f6f5a4dd214f2d297d7

    SHA256

    7ec9243778764de61e10b53afa59538cf1cdf97af2bee896d3c08a73f9f49e6a

    SHA512

    077b08bfa95876072a07b7ad8fa8bbe430dd6f00e7dfb37e4ce5b3ff66cb59d8b33aaa008d0ae642a27180fde0c6067e9d03411feb78b76f30b77b02c41d64b5

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
    MD5

    3a85f7b216b781d8c87b19693cf21997

    SHA1

    a98e39e776449bad56e12f6f5a4dd214f2d297d7

    SHA256

    7ec9243778764de61e10b53afa59538cf1cdf97af2bee896d3c08a73f9f49e6a

    SHA512

    077b08bfa95876072a07b7ad8fa8bbe430dd6f00e7dfb37e4ce5b3ff66cb59d8b33aaa008d0ae642a27180fde0c6067e9d03411feb78b76f30b77b02c41d64b5

    Download Submit

  • memory/2400-132-0x000001C5045A0000-0x000001C5045B0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2400-133-0x000001C504C20000-0x000001C504C30000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2400-134-0x000001C507320000-0x000001C507324000-memory.dmp

    Filesize

    16KB

    Download