Overview

overview

10

Static

static

000e744a91...37.exe

windows7_x64

10

000e744a91...37.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    148s
  • max time network
    168s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    12-02-2022 12:53

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    000e744a91c2dc186a70090cb2617873085d6002adc6ce46ad9caf3172623e37.exe

  • Size

    36KB

  • MD5

    74360304c260b9ae92e50f992d5f453b

  • SHA1

    e4c2a387cd282fad09abc46094b90d52516de09b

  • SHA256

    000e744a91c2dc186a70090cb2617873085d6002adc6ce46ad9caf3172623e37

  • SHA512

    fa309d6917f4b62a554e56afa15f163f841c1b9911f4ef8ea2f4c4dab884e4b56327b2632686c5ea1b71d6def2f0e94c4a158ed0e1387f82aaba133ff3b8797d

Score
10/10
sakulapersistencerattrojan

Malware Config

Signatures

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\000e744a91c2dc186a70090cb2617873085d6002adc6ce46ad9caf3172623e37.exe
    "C:\Users\Admin\AppData\Local\Temp\000e744a91c2dc186a70090cb2617873085d6002adc6ce46ad9caf3172623e37.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3644
    • C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
      C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
      2⤵
      • Executes dropped EXE
      PID:4056
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\000e744a91c2dc186a70090cb2617873085d6002adc6ce46ad9caf3172623e37.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4060
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1
        3⤵
        • Runs ping.exe
        PID:2996
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:3536
  • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
    C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:1352

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
    MD5

    fa39c214c89b3272854da0ab66414cf1

    SHA1

    b32fb3351ba926f713601c65a37f077431d8e9df

    SHA256

    1b3f7159db2553d26037d59fad20544347b145d16d27552a428b189ab2a94eff

    SHA512

    3755bd6dc7e5e64074121d94a4ceae7e90d4fa27ec9be0498c4d5fff78b4dd236a1749106a2b2d6f17df57b4ef923b43844052f3decb0b59dee8b34ad317fd94

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
    MD5

    fa39c214c89b3272854da0ab66414cf1

    SHA1

    b32fb3351ba926f713601c65a37f077431d8e9df

    SHA256

    1b3f7159db2553d26037d59fad20544347b145d16d27552a428b189ab2a94eff

    SHA512

    3755bd6dc7e5e64074121d94a4ceae7e90d4fa27ec9be0498c4d5fff78b4dd236a1749106a2b2d6f17df57b4ef923b43844052f3decb0b59dee8b34ad317fd94

    Download Submit
  • memory/3536-132-0x000001BDA0F40000-0x000001BDA0F50000-memory.dmp
    Filesize

    64KB

    Download
  • memory/3536-133-0x000001BDA0FA0000-0x000001BDA0FB0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/3536-134-0x000001BDA3CC0000-0x000001BDA3CC4000-memory.dmp
    Filesize

    16KB

    Download