Overview

overview

10

Static

static

10

07dbf5e146...f4.exe

windows7_x64

10

07dbf5e146...f4.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    141s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    12-02-2022 10:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    07dbf5e146a03658013bb0e134487e57980a06f454f514656b7db62d0d6554f4.exe

  • Size

    92KB

  • MD5

    3a0d5798c87d3457affbcf8b708eeb22

  • SHA1

    a1811632819582871292fbcb2d014234cd64f863

  • SHA256

    07dbf5e146a03658013bb0e134487e57980a06f454f514656b7db62d0d6554f4

  • SHA512

    eeaa5364c5ceecc8d68fef9181bec3b380371e279a2210c4673066332c761b3c2c9d06d9b87afbe9b4db96c3380bd8d395dbe4928d5f20398ab61d61a317916d

Score
10/10
sakulapersistenceratsuricatatrojan

Malware Config

Signatures

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula
  • Sakula Payload 2 IoCs
  • suricata: ET MALWARE SUSPICIOUS UA (iexplore)

    suricata: ET MALWARE SUSPICIOUS UA (iexplore)

    suricata
  • suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

    suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1

    suricata
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\07dbf5e146a03658013bb0e134487e57980a06f454f514656b7db62d0d6554f4.exe
    "C:\Users\Admin\AppData\Local\Temp\07dbf5e146a03658013bb0e134487e57980a06f454f514656b7db62d0d6554f4.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4656
    • C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
      C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
      2⤵
      • Executes dropped EXE
      PID:4800
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\07dbf5e146a03658013bb0e134487e57980a06f454f514656b7db62d0d6554f4.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2328
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1
        3⤵
        • Runs ping.exe
        PID:1984
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2232
  • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
    C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:1236

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
    MD5

    a037836031a8743bdb8cc77963b48723

    SHA1

    a6d7e5746510aa5571e9d246a9e3112118b28f2c

    SHA256

    f5e4723d2604aecebdad56773aa2fdd0877e34a9e0fbb20b2a42b5210efe0b7a

    SHA512

    7749163ff1f823c9f1822ea30b5d63ad8533472876657b79843230888b9b6165ebe2647e4c40c92acbc6cbf87caf5b9ff3c589565be4e4c1683a5d173dd8787a

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
    MD5

    a037836031a8743bdb8cc77963b48723

    SHA1

    a6d7e5746510aa5571e9d246a9e3112118b28f2c

    SHA256

    f5e4723d2604aecebdad56773aa2fdd0877e34a9e0fbb20b2a42b5210efe0b7a

    SHA512

    7749163ff1f823c9f1822ea30b5d63ad8533472876657b79843230888b9b6165ebe2647e4c40c92acbc6cbf87caf5b9ff3c589565be4e4c1683a5d173dd8787a

    Download Submit
  • memory/2232-132-0x00000243245A0000-0x00000243245B0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2232-133-0x0000024324B20000-0x0000024324B30000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2232-134-0x0000024327220000-0x0000024327224000-memory.dmp
    Filesize

    16KB

    Download