sakula | b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e

Resubmissions

28/02/2022, 15:53

220228-tbwpfseeh410

06/07/2020, 07:27

200706-mjgfzjqjta1

Analysis

max time kernel
281s
max time network
284s
platform
windows10_x64
resource
win10-en-20211208
submitted
28/02/2022, 15:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe
Size 76KB
Sample220228-tbwpfseeh4
SHA256 b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e
MD5 f032614326676138de5a4dc97ddc87e5
SHA1 a55a86bdd0f40b8a8801cacbbc025a8f58a5aeec
SHA512 3fd27b90ebfd2c94369bc432d082baa88c8c53b1aa83fae2e5c03f9e59f53c7520071a79e968abd232e2998c27176a011e038c7900ddea3dba6b97812ef13456
MD5 SHA1 SHA512

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Executes dropped EXE 1 IoCs

pid	Process
1992	MediaCenter.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	reg.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
3052	reg.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2744	PING.EXE

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3540 wrote to memory of 3296	3540	b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe	69
PID 3540 wrote to memory of 3296	3540	b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe	69
PID 3540 wrote to memory of 3296	3540	b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe	69
PID 3540 wrote to memory of 3592	3540	b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe	70
PID 3540 wrote to memory of 3592	3540	b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe	70
PID 3540 wrote to memory of 3592	3540	b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe	70
PID 3540 wrote to memory of 4088	3540	b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe	71
PID 3540 wrote to memory of 4088	3540	b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe	71
PID 3540 wrote to memory of 4088	3540	b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe	71
PID 3592 wrote to memory of 1992	3592	cmd.exe	75
PID 3592 wrote to memory of 1992	3592	cmd.exe	75
PID 3592 wrote to memory of 1992	3592	cmd.exe	75
PID 4088 wrote to memory of 2744	4088	cmd.exe	76
PID 4088 wrote to memory of 2744	4088	cmd.exe	76
PID 4088 wrote to memory of 2744	4088	cmd.exe	76
PID 3296 wrote to memory of 3052	3296	cmd.exe	77
PID 3296 wrote to memory of 3052	3296	cmd.exe	77
PID 3296 wrote to memory of 3052	3296	cmd.exe	77

C:\Users\Admin\AppData\Local\Temp\b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe
"C:\Users\Admin\AppData\Local\Temp\b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3540
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3296
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:3052
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3592
- - C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
    C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
    3⤵
    - Executes dropped EXE
    PID:1992
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4088
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2744

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3540-115-0x0000000000401000-0x0000000000404000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads