Overview

overview

10

Static

static

10

07d68067fa...ff.exe

windows7_x64

10

07d68067fa...ff.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    164s
  • max time network
    183s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    12-02-2022 10:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    07d68067fa546a4d5e39bede49e0a0d3c67020f00536e7cfb77111c55bc3d3ff.exe

  • Size

    92KB

  • MD5

    cbbaeafbd00c14a5a59dd3f605fbeb10

  • SHA1

    b7cabd76d3ff3204606bd42386412c035bb792ba

  • SHA256

    07d68067fa546a4d5e39bede49e0a0d3c67020f00536e7cfb77111c55bc3d3ff

  • SHA512

    d20e6fdcd804425fa427cad676312b80b57db735a1c905de87a78a4726a2fe4ec5e2006cdc9243ed907d10a4b522a8d2c39b65b372c98f77196368a3f3c50b42

Score
10/10
sakulapersistenceratsuricatatrojan

Malware Config

Signatures

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula
  • Sakula Payload 2 IoCs
  • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

    suricata: ET MALWARE SUSPICIOUS UA (iexplore)

    suricata
  • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

    suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

    suricata
  • Executes dropped EXE 1 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\07d68067fa546a4d5e39bede49e0a0d3c67020f00536e7cfb77111c55bc3d3ff.exe
    "C:\Users\Admin\AppData\Local\Temp\07d68067fa546a4d5e39bede49e0a0d3c67020f00536e7cfb77111c55bc3d3ff.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1600
    • C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
      C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
      2⤵
      • Executes dropped EXE
      PID:1316
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\07d68067fa546a4d5e39bede49e0a0d3c67020f00536e7cfb77111c55bc3d3ff.exe"
      2⤵
      • Deletes itself
      • Suspicious use of WriteProcessMemory
      PID:744
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1
        3⤵
        • Runs ping.exe
        PID:1172

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
    MD5

    93f73d36b234fae9dd3b977810152256

    SHA1

    4094ced11f4f6d96e08f2f51d8e67200092f9db2

    SHA256

    9c6786ce4e9f9b4b0ce447011c2e3a7ab2133585736260cb7d3582e4fa27f17b

    SHA512

    cee58403abf2bbc3692ebca610c3655f1915696aeb7debbfb430108348bb13a43c43510c923e26d6ffba98e0dabe96d979ac72a489ff3f02b1b1b51f9ca10798

    Download Submit
  • \Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
    MD5

    93f73d36b234fae9dd3b977810152256

    SHA1

    4094ced11f4f6d96e08f2f51d8e67200092f9db2

    SHA256

    9c6786ce4e9f9b4b0ce447011c2e3a7ab2133585736260cb7d3582e4fa27f17b

    SHA512

    cee58403abf2bbc3692ebca610c3655f1915696aeb7debbfb430108348bb13a43c43510c923e26d6ffba98e0dabe96d979ac72a489ff3f02b1b1b51f9ca10798

    Download Submit
  • memory/1600-55-0x0000000075801000-0x0000000075803000-memory.dmp
    Filesize

    8KB

    Download