Analysis

  • max time kernel
    160s
  • max time network
    166s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    12-02-2022 11:30

General

  • Target

    04396c7638638da9796f5583867a8bc1dc446e0e33e19eeb5f7a64753adec2e2.exe

  • Size

    99KB

  • MD5

    376550eb42d7c55e1442e12b10f25e36

  • SHA1

    6df93d7db01a59e1adfe5cd2c8f5464389c10c6c

  • SHA256

    04396c7638638da9796f5583867a8bc1dc446e0e33e19eeb5f7a64753adec2e2

  • SHA512

    553d7c228bfbd8b4b384cb5a323b004d3543197b4c5200e1a3d8b4c326a3abcf9de494d02eb8f63952ba59a172f4d2112471bd02bf75ec964920ce0c271fa139

Malware Config

Signatures

  • Sakula

    Sakula is a remote access trojan with various capabilities.

  • Sakula Payload 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\04396c7638638da9796f5583867a8bc1dc446e0e33e19eeb5f7a64753adec2e2.exe
    "C:\Users\Admin\AppData\Local\Temp\04396c7638638da9796f5583867a8bc1dc446e0e33e19eeb5f7a64753adec2e2.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1392
    • C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
      C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
      2⤵
      • Executes dropped EXE
      PID:1980
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\04396c7638638da9796f5583867a8bc1dc446e0e33e19eeb5f7a64753adec2e2.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2284
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1
        3⤵
        • Runs ping.exe
        PID:3108
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:4448
  • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
    C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:1956

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
    MD5

    31ff20bd232a605c2d10922f9a67252f

    SHA1

    48cc4df2abb843693e7439c8cd7a1ed9f19bc7ea

    SHA256

    4ecb61a92eec8afe75b96f9db3c2f1e8e6f2ca2bce633c7a88f188acfd987db6

    SHA512

    85368de16da0b003bca5dd117b07df99fac588e3d8b8890bacf08bd800ee819b874f7fedb87e1600c1a49116cbe7ff75901656d6b9f656b8f79365abdb08d7fd

  • C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
    MD5

    31ff20bd232a605c2d10922f9a67252f

    SHA1

    48cc4df2abb843693e7439c8cd7a1ed9f19bc7ea

    SHA256

    4ecb61a92eec8afe75b96f9db3c2f1e8e6f2ca2bce633c7a88f188acfd987db6

    SHA512

    85368de16da0b003bca5dd117b07df99fac588e3d8b8890bacf08bd800ee819b874f7fedb87e1600c1a49116cbe7ff75901656d6b9f656b8f79365abdb08d7fd

  • memory/4448-132-0x0000022F21160000-0x0000022F21170000-memory.dmp
    Filesize

    64KB

  • memory/4448-133-0x0000022F21720000-0x0000022F21730000-memory.dmp
    Filesize

    64KB

  • memory/4448-134-0x0000022F23D90000-0x0000022F23D94000-memory.dmp
    Filesize

    16KB