Overview

overview

10

Static

static

2f75127174...8d.exe

windows7_x64

10

2f75127174...8d.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    148s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    26/03/2022, 06:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2f75127174f624462df8fbae0de572c2eb6c04b4562ea16ba05dff714ca48a8d.exe
  • Size 47KB
  • Sample220326-hjs3rahdg2
  • SHA256 2f75127174f624462df8fbae0de572c2eb6c04b4562ea16ba05dff714ca48a8d
  • MD5 SHA1 SHA512
Score
10/10
sakulapersistencerattrojan

Malware Config

Signatures

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2f75127174f624462df8fbae0de572c2eb6c04b4562ea16ba05dff714ca48a8d.exe
    "C:\Users\Admin\AppData\Local\Temp\2f75127174f624462df8fbae0de572c2eb6c04b4562ea16ba05dff714ca48a8d.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4424
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3772
      • C:\Windows\SysWOW64\reg.exe
        reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"
        3⤵
        • Adds Run key to start application
        • Modifies registry key
        PID:3424
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3744
      • C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
        C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
        3⤵
        • Executes dropped EXE
        PID:676
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\2f75127174f624462df8fbae0de572c2eb6c04b4562ea16ba05dff714ca48a8d.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4180
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1
        3⤵
        • Runs ping.exe
        PID:800

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/676-139-0x0000000000400000-0x000000000040B000-memory.dmp
        Download

        memory/4424-133-0x0000000000400000-0x000000000040B000-memory.dmp
        Download