Overview

overview

10

Static

static

962398a814...2f.exe

windows7_x64

10

962398a814...2f.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    142s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    26/03/2022, 03:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    962398a8148727431d8a651dcacbb972883559f651f19784a0a0cd9c30c63a2f.exe
  • Size 42KB
  • Sample220326-d7673afha5
  • SHA256 962398a8148727431d8a651dcacbb972883559f651f19784a0a0cd9c30c63a2f
  • MD5 SHA1 SHA512
Score
10/10
sakulapersistencerattrojan

Malware Config

Signatures

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\962398a8148727431d8a651dcacbb972883559f651f19784a0a0cd9c30c63a2f.exe
    "C:\Users\Admin\AppData\Local\Temp\962398a8148727431d8a651dcacbb972883559f651f19784a0a0cd9c30c63a2f.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4720
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5096
      • C:\Windows\SysWOW64\reg.exe
        reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"
        3⤵
        • Adds Run key to start application
        • Modifies registry key
        PID:560
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4316
      • C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
        C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
        3⤵
        • Executes dropped EXE
        PID:3440
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\962398a8148727431d8a651dcacbb972883559f651f19784a0a0cd9c30c63a2f.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3720
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1
        3⤵
        • Runs ping.exe
        PID:4672

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/3440-139-0x0000000000400000-0x000000000040B000-memory.dmp
        Download

        memory/4720-133-0x0000000000400000-0x000000000040B000-memory.dmp
        Download