Malware Analysis Report

2024-12-07 22:09

Sample ID 220731-h4caqsebd6
Target 7fe9a70dac924f1d4b49dbf8a23b4b5ea087b323ea505b7bb4ee8d4e462a5046
SHA256 7fe9a70dac924f1d4b49dbf8a23b4b5ea087b323ea505b7bb4ee8d4e462a5046
Tags
upx sakula persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

7fe9a70dac924f1d4b49dbf8a23b4b5ea087b323ea505b7bb4ee8d4e462a5046

Threat Level: Known bad

The file 7fe9a70dac924f1d4b49dbf8a23b4b5ea087b323ea505b7bb4ee8d4e462a5046 was found to be: Known bad.

Malicious Activity Summary

upx sakula persistence rat trojan

Sakula

UPX packed file

Executes dropped EXE

Loads dropped DLL

Deletes itself

Adds Run key to start application

Modifies registry key

Runs ping.exe

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-07-31 07:17

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-07-31 07:17

Reported

2022-07-31 10:18

Platform

win7-20220715-en

Max time kernel

151s

Max time network

157s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7fe9a70dac924f1d4b49dbf8a23b4b5ea087b323ea505b7bb4ee8d4e462a5046.exe"

Signatures

Sakula

trojan rat sakula

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" C:\Windows\SysWOW64\reg.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1988 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\7fe9a70dac924f1d4b49dbf8a23b4b5ea087b323ea505b7bb4ee8d4e462a5046.exe C:\Windows\SysWOW64\cmd.exe
PID 1988 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\7fe9a70dac924f1d4b49dbf8a23b4b5ea087b323ea505b7bb4ee8d4e462a5046.exe C:\Windows\SysWOW64\cmd.exe
PID 1988 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\7fe9a70dac924f1d4b49dbf8a23b4b5ea087b323ea505b7bb4ee8d4e462a5046.exe C:\Windows\SysWOW64\cmd.exe
PID 1988 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\7fe9a70dac924f1d4b49dbf8a23b4b5ea087b323ea505b7bb4ee8d4e462a5046.exe C:\Windows\SysWOW64\cmd.exe
PID 1988 wrote to memory of 908 N/A C:\Users\Admin\AppData\Local\Temp\7fe9a70dac924f1d4b49dbf8a23b4b5ea087b323ea505b7bb4ee8d4e462a5046.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 1988 wrote to memory of 908 N/A C:\Users\Admin\AppData\Local\Temp\7fe9a70dac924f1d4b49dbf8a23b4b5ea087b323ea505b7bb4ee8d4e462a5046.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 1988 wrote to memory of 908 N/A C:\Users\Admin\AppData\Local\Temp\7fe9a70dac924f1d4b49dbf8a23b4b5ea087b323ea505b7bb4ee8d4e462a5046.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 1988 wrote to memory of 908 N/A C:\Users\Admin\AppData\Local\Temp\7fe9a70dac924f1d4b49dbf8a23b4b5ea087b323ea505b7bb4ee8d4e462a5046.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 1008 wrote to memory of 852 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1008 wrote to memory of 852 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1008 wrote to memory of 852 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1008 wrote to memory of 852 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1988 wrote to memory of 300 N/A C:\Users\Admin\AppData\Local\Temp\7fe9a70dac924f1d4b49dbf8a23b4b5ea087b323ea505b7bb4ee8d4e462a5046.exe C:\Windows\SysWOW64\cmd.exe
PID 1988 wrote to memory of 300 N/A C:\Users\Admin\AppData\Local\Temp\7fe9a70dac924f1d4b49dbf8a23b4b5ea087b323ea505b7bb4ee8d4e462a5046.exe C:\Windows\SysWOW64\cmd.exe
PID 1988 wrote to memory of 300 N/A C:\Users\Admin\AppData\Local\Temp\7fe9a70dac924f1d4b49dbf8a23b4b5ea087b323ea505b7bb4ee8d4e462a5046.exe C:\Windows\SysWOW64\cmd.exe
PID 1988 wrote to memory of 300 N/A C:\Users\Admin\AppData\Local\Temp\7fe9a70dac924f1d4b49dbf8a23b4b5ea087b323ea505b7bb4ee8d4e462a5046.exe C:\Windows\SysWOW64\cmd.exe
PID 300 wrote to memory of 1684 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 300 wrote to memory of 1684 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 300 wrote to memory of 1684 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 300 wrote to memory of 1684 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\7fe9a70dac924f1d4b49dbf8a23b4b5ea087b323ea505b7bb4ee8d4e462a5046.exe

"C:\Users\Admin\AppData\Local\Temp\7fe9a70dac924f1d4b49dbf8a23b4b5ea087b323ea505b7bb4ee8d4e462a5046.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Windows\SysWOW64\reg.exe

reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\7fe9a70dac924f1d4b49dbf8a23b4b5ea087b323ea505b7bb4ee8d4e462a5046.exe"

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.we11point.com udp
US 204.11.56.48:443 www.we11point.com tcp
US 204.11.56.48:443 www.we11point.com tcp
US 204.11.56.48:443 www.we11point.com tcp
US 204.11.56.48:443 www.we11point.com tcp
US 204.11.56.48:443 www.we11point.com tcp
US 204.11.56.48:443 www.we11point.com tcp
US 204.11.56.48:443 www.we11point.com tcp
US 204.11.56.48:443 www.we11point.com tcp
US 204.11.56.48:443 www.we11point.com tcp
US 204.11.56.48:443 www.we11point.com tcp

Files

memory/1988-54-0x00000000763E1000-0x00000000763E3000-memory.dmp

memory/1988-55-0x0000000000400000-0x000000000040C000-memory.dmp

memory/1008-56-0x0000000000000000-mapping.dmp

memory/1988-57-0x0000000000400000-0x000000000040C000-memory.dmp

\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 854c24eeabfe0bffdba3c7a8de0a6680
SHA1 4f7ea91d34b76113ab49ec7cc1552d3dc8a1e810
SHA256 e21c582dc15bd3111cbc3b18fdeb993bc19b3d55f9abc7f018147346833384ee
SHA512 f549e27da10bd63b57b33cc0b3f8744d435aad7535974555656406a8dad01b9c325fbaf3bf9c6401ef679ac7847eb261aeff04bbfdaff6457b2541dc5f831e33

memory/908-60-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 854c24eeabfe0bffdba3c7a8de0a6680
SHA1 4f7ea91d34b76113ab49ec7cc1552d3dc8a1e810
SHA256 e21c582dc15bd3111cbc3b18fdeb993bc19b3d55f9abc7f018147346833384ee
SHA512 f549e27da10bd63b57b33cc0b3f8744d435aad7535974555656406a8dad01b9c325fbaf3bf9c6401ef679ac7847eb261aeff04bbfdaff6457b2541dc5f831e33

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 854c24eeabfe0bffdba3c7a8de0a6680
SHA1 4f7ea91d34b76113ab49ec7cc1552d3dc8a1e810
SHA256 e21c582dc15bd3111cbc3b18fdeb993bc19b3d55f9abc7f018147346833384ee
SHA512 f549e27da10bd63b57b33cc0b3f8744d435aad7535974555656406a8dad01b9c325fbaf3bf9c6401ef679ac7847eb261aeff04bbfdaff6457b2541dc5f831e33

memory/852-63-0x0000000000000000-mapping.dmp

memory/1988-64-0x00000000001B0000-0x00000000001BC000-memory.dmp

memory/1988-65-0x00000000001B0000-0x00000000001BC000-memory.dmp

memory/1988-66-0x00000000001B0000-0x00000000001BC000-memory.dmp

memory/908-67-0x0000000000400000-0x000000000040C000-memory.dmp

memory/300-68-0x0000000000000000-mapping.dmp

memory/1684-69-0x0000000000000000-mapping.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-07-31 07:17

Reported

2022-07-31 10:18

Platform

win10v2004-20220721-en

Max time kernel

138s

Max time network

144s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7fe9a70dac924f1d4b49dbf8a23b4b5ea087b323ea505b7bb4ee8d4e462a5046.exe"

Signatures

Sakula

trojan rat sakula

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" C:\Windows\SysWOW64\reg.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4872 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\7fe9a70dac924f1d4b49dbf8a23b4b5ea087b323ea505b7bb4ee8d4e462a5046.exe C:\Windows\SysWOW64\cmd.exe
PID 4872 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\7fe9a70dac924f1d4b49dbf8a23b4b5ea087b323ea505b7bb4ee8d4e462a5046.exe C:\Windows\SysWOW64\cmd.exe
PID 4872 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\7fe9a70dac924f1d4b49dbf8a23b4b5ea087b323ea505b7bb4ee8d4e462a5046.exe C:\Windows\SysWOW64\cmd.exe
PID 4872 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\7fe9a70dac924f1d4b49dbf8a23b4b5ea087b323ea505b7bb4ee8d4e462a5046.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 4872 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\7fe9a70dac924f1d4b49dbf8a23b4b5ea087b323ea505b7bb4ee8d4e462a5046.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 4872 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\7fe9a70dac924f1d4b49dbf8a23b4b5ea087b323ea505b7bb4ee8d4e462a5046.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 2056 wrote to memory of 4752 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2056 wrote to memory of 4752 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2056 wrote to memory of 4752 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4872 wrote to memory of 4628 N/A C:\Users\Admin\AppData\Local\Temp\7fe9a70dac924f1d4b49dbf8a23b4b5ea087b323ea505b7bb4ee8d4e462a5046.exe C:\Windows\SysWOW64\cmd.exe
PID 4872 wrote to memory of 4628 N/A C:\Users\Admin\AppData\Local\Temp\7fe9a70dac924f1d4b49dbf8a23b4b5ea087b323ea505b7bb4ee8d4e462a5046.exe C:\Windows\SysWOW64\cmd.exe
PID 4872 wrote to memory of 4628 N/A C:\Users\Admin\AppData\Local\Temp\7fe9a70dac924f1d4b49dbf8a23b4b5ea087b323ea505b7bb4ee8d4e462a5046.exe C:\Windows\SysWOW64\cmd.exe
PID 4628 wrote to memory of 5040 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4628 wrote to memory of 5040 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4628 wrote to memory of 5040 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\7fe9a70dac924f1d4b49dbf8a23b4b5ea087b323ea505b7bb4ee8d4e462a5046.exe

"C:\Users\Admin\AppData\Local\Temp\7fe9a70dac924f1d4b49dbf8a23b4b5ea087b323ea505b7bb4ee8d4e462a5046.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Windows\SysWOW64\reg.exe

reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\7fe9a70dac924f1d4b49dbf8a23b4b5ea087b323ea505b7bb4ee8d4e462a5046.exe"

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1

Network

Country Destination Domain Proto
US 93.184.220.29:80 tcp
US 93.184.220.29:80 tcp
FR 2.18.109.224:443 tcp
NL 20.50.201.200:443 tcp
US 8.8.8.8:53 www.we11point.com udp
US 204.11.56.48:443 www.we11point.com tcp
US 93.184.221.240:80 tcp
US 93.184.221.240:80 tcp
US 93.184.221.240:80 tcp
US 204.11.56.48:443 www.we11point.com tcp
US 204.11.56.48:443 www.we11point.com tcp
US 204.11.56.48:443 www.we11point.com tcp
US 204.11.56.48:443 www.we11point.com tcp
US 204.11.56.48:443 www.we11point.com tcp
US 204.11.56.48:443 www.we11point.com tcp
US 204.11.56.48:443 www.we11point.com tcp
US 204.11.56.48:443 www.we11point.com tcp
US 204.11.56.48:443 www.we11point.com tcp
US 204.11.56.48:443 www.we11point.com tcp
US 204.11.56.48:443 www.we11point.com tcp

Files

memory/4872-130-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2056-131-0x0000000000000000-mapping.dmp

memory/3580-132-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 2409e9c494ba65149494cd39cbd5274c
SHA1 fdb11d6741b2cb7b32e4c3fc74c547b4a35d13cd
SHA256 72797b4bba05ff413f0ccc682ef88785f185542dce73d85919789eef7e566896
SHA512 e3dc95f221bda5c74583564f200000dfbfc6dd417ce50256d6aac13b024495898842cea38ef8b27bb66077837da1222b9e6c9d3858220b4f830a9daff78f91c8

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 2409e9c494ba65149494cd39cbd5274c
SHA1 fdb11d6741b2cb7b32e4c3fc74c547b4a35d13cd
SHA256 72797b4bba05ff413f0ccc682ef88785f185542dce73d85919789eef7e566896
SHA512 e3dc95f221bda5c74583564f200000dfbfc6dd417ce50256d6aac13b024495898842cea38ef8b27bb66077837da1222b9e6c9d3858220b4f830a9daff78f91c8

memory/4752-135-0x0000000000000000-mapping.dmp

memory/4872-136-0x0000000000400000-0x000000000040C000-memory.dmp

memory/3580-137-0x0000000000400000-0x000000000040C000-memory.dmp

memory/4628-138-0x0000000000000000-mapping.dmp

memory/5040-139-0x0000000000000000-mapping.dmp