sakula | dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c

Resubmissions

22/02/2022, 12:38

220222-pt2afaaabn10

06/07/2020, 07:26

200706-je7e9l28s21

Analysis

max time kernel
246s
max time network
254s
platform
windows10_x64
resource
win10-en-20211208
submitted
22/02/2022, 12:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe
Size 77KB
Sample220222-pt2afaaabn
SHA256 dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c
MD5 cce983f04093a936e29dbf1d7078bc53
SHA1 619637bdcb8ed1a59e36e6badd1a189bdb35bc2f
SHA512 2d84b360e7d5c636b5a893de51a2bc49392731660562be5a1117f9924d6e3f872d74af6a279b71fbb4cb4b1430ca02395d5e160a945d125cf1d3fef9b615d0a5
MD5 SHA1 SHA512

Score

10^/10

sakula persistence rat suricata trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
suricata: ET MALWARE Possible DEEP PANDA C2 Activity
suricata: ET MALWARE Possible DEEP PANDA C2 Activity
suricata
suricata: ET MALWARE Possible Deep Panda - Sakula/Mivast RAT CnC Beacon 5
suricata: ET MALWARE Possible Deep Panda - Sakula/Mivast RAT CnC Beacon 5
suricata
suricata: ET MALWARE Sakula/Mivast C2 Activity
suricata: ET MALWARE Sakula/Mivast C2 Activity
suricata

Executes dropped EXE 1 IoCs

pid	Process
3724	MediaCenter.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	reg.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
3588	reg.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3604	PING.EXE

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 4128	4116	dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe	69
PID 4116 wrote to memory of 4128	4116	dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe	69
PID 4116 wrote to memory of 4128	4116	dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe	69
PID 4116 wrote to memory of 3480	4116	dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe	71
PID 4116 wrote to memory of 3480	4116	dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe	71
PID 4116 wrote to memory of 3480	4116	dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe	71
PID 4116 wrote to memory of 3420	4116	dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe	70
PID 4116 wrote to memory of 3420	4116	dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe	70
PID 4116 wrote to memory of 3420	4116	dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe	70
PID 3420 wrote to memory of 3604	3420	cmd.exe	76
PID 3420 wrote to memory of 3604	3420	cmd.exe	76
PID 3420 wrote to memory of 3604	3420	cmd.exe	76
PID 4128 wrote to memory of 3588	4128	cmd.exe	75
PID 4128 wrote to memory of 3588	4128	cmd.exe	75
PID 4128 wrote to memory of 3588	4128	cmd.exe	75
PID 3480 wrote to memory of 3724	3480	cmd.exe	77
PID 3480 wrote to memory of 3724	3480	cmd.exe	77
PID 3480 wrote to memory of 3724	3480	cmd.exe	77

C:\Users\Admin\AppData\Local\Temp\dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe
"C:\Users\Admin\AppData\Local\Temp\dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4128
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:3588
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3420
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:3604
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3480
- - C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
    C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
    3⤵
    - Executes dropped EXE
    PID:3724

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4116-114-0x0000000000401000-0x0000000000404000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads