Analysis

  • max time kernel
    131s
  • max time network
    169s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    12/02/2022, 06:40

General

  • Target

    0f54e81744a3d35d502d938afd9aab5823f0d46a9ca21a8c5362e9d394f3a631.exe

  • Size

    216KB

  • MD5

    f9bda4ecb85391683fddd9a5190dec4e

  • SHA1

    3841f8470fff474150bbf7254b182461d3eb8e29

  • SHA256

    0f54e81744a3d35d502d938afd9aab5823f0d46a9ca21a8c5362e9d394f3a631

  • SHA512

    094008ae5ce23b487d445bb664dfbdb56c095cc500dcc8aec4f67268520227c67d5924bf2a58ec479c18e5c9caff7198b2a098de47df3adc2f4859abfb28a4c8

Malware Config

Signatures

  • Sakula

    Sakula is a remote access trojan with various capabilities.

  • Sakula Payload 4 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0f54e81744a3d35d502d938afd9aab5823f0d46a9ca21a8c5362e9d394f3a631.exe
    "C:\Users\Admin\AppData\Local\Temp\0f54e81744a3d35d502d938afd9aab5823f0d46a9ca21a8c5362e9d394f3a631.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4868
    • C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
      C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
      2⤵
      • Executes dropped EXE
      PID:4944
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\0f54e81744a3d35d502d938afd9aab5823f0d46a9ca21a8c5362e9d394f3a631.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2340
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1
        3⤵
        • Runs ping.exe
        PID:3240
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:4276
  • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
    C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:3628

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/4276-132-0x000002965B920000-0x000002965B930000-memory.dmp

          Filesize

          64KB

        • memory/4276-133-0x000002965B980000-0x000002965B990000-memory.dmp

          Filesize

          64KB

        • memory/4276-134-0x000002965E030000-0x000002965E034000-memory.dmp

          Filesize

          16KB

        • memory/4868-135-0x0000000000400000-0x0000000000420000-memory.dmp

          Filesize

          128KB

        • memory/4944-136-0x0000000000400000-0x0000000000420000-memory.dmp

          Filesize

          128KB