Malware Analysis Report

2025-01-02 02:52

Sample ID 220906-1ey3baffhk
Target 6c2a5e3bda43426781fbb5693fdf2a96
SHA256 1b5cce8b8a38d3caef308cb2200f7a3c5439f47936e63e0a9683e5c80f44116b
Tags
upx sakula persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1b5cce8b8a38d3caef308cb2200f7a3c5439f47936e63e0a9683e5c80f44116b

Threat Level: Known bad

The file 6c2a5e3bda43426781fbb5693fdf2a96 was found to be: Known bad.

Malicious Activity Summary

upx sakula persistence rat trojan

Sakula

UPX packed file

Executes dropped EXE

Loads dropped DLL

Deletes itself

Adds Run key to start application

Modifies registry key

Suspicious use of WriteProcessMemory

Runs ping.exe

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-09-06 21:34

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-09-06 21:34

Reported

2022-09-06 21:37

Platform

win7-20220812-en

Max time kernel

116s

Max time network

166s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6c2a5e3bda43426781fbb5693fdf2a96.exe"

Signatures

Sakula

trojan rat sakula

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" C:\Windows\SysWOW64\reg.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1388 wrote to memory of 792 N/A C:\Users\Admin\AppData\Local\Temp\6c2a5e3bda43426781fbb5693fdf2a96.exe C:\Windows\SysWOW64\cmd.exe
PID 1388 wrote to memory of 792 N/A C:\Users\Admin\AppData\Local\Temp\6c2a5e3bda43426781fbb5693fdf2a96.exe C:\Windows\SysWOW64\cmd.exe
PID 1388 wrote to memory of 792 N/A C:\Users\Admin\AppData\Local\Temp\6c2a5e3bda43426781fbb5693fdf2a96.exe C:\Windows\SysWOW64\cmd.exe
PID 1388 wrote to memory of 792 N/A C:\Users\Admin\AppData\Local\Temp\6c2a5e3bda43426781fbb5693fdf2a96.exe C:\Windows\SysWOW64\cmd.exe
PID 1388 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\6c2a5e3bda43426781fbb5693fdf2a96.exe C:\Windows\SysWOW64\cmd.exe
PID 1388 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\6c2a5e3bda43426781fbb5693fdf2a96.exe C:\Windows\SysWOW64\cmd.exe
PID 1388 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\6c2a5e3bda43426781fbb5693fdf2a96.exe C:\Windows\SysWOW64\cmd.exe
PID 1388 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\6c2a5e3bda43426781fbb5693fdf2a96.exe C:\Windows\SysWOW64\cmd.exe
PID 1388 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Temp\6c2a5e3bda43426781fbb5693fdf2a96.exe C:\Windows\SysWOW64\cmd.exe
PID 1388 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Temp\6c2a5e3bda43426781fbb5693fdf2a96.exe C:\Windows\SysWOW64\cmd.exe
PID 1388 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Temp\6c2a5e3bda43426781fbb5693fdf2a96.exe C:\Windows\SysWOW64\cmd.exe
PID 1388 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Temp\6c2a5e3bda43426781fbb5693fdf2a96.exe C:\Windows\SysWOW64\cmd.exe
PID 2012 wrote to memory of 1168 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 2012 wrote to memory of 1168 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 2012 wrote to memory of 1168 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 2012 wrote to memory of 1168 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 792 wrote to memory of 912 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 792 wrote to memory of 912 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 792 wrote to memory of 912 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 792 wrote to memory of 912 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1164 wrote to memory of 904 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1164 wrote to memory of 904 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1164 wrote to memory of 904 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1164 wrote to memory of 904 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\6c2a5e3bda43426781fbb5693fdf2a96.exe

"C:\Users\Admin\AppData\Local\Temp\6c2a5e3bda43426781fbb5693fdf2a96.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\6c2a5e3bda43426781fbb5693fdf2a96.exe"

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Windows\SysWOW64\reg.exe

reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1

Network

Country Destination Domain Proto
US 8.8.8.8:53 vpn.premrera.com udp
US 208.91.197.27:443 vpn.premrera.com tcp
US 173.254.226.212:443 tcp
US 173.254.226.212:443 tcp

Files

memory/1388-54-0x0000000074AD1000-0x0000000074AD3000-memory.dmp

memory/1388-55-0x0000000000400000-0x000000000040D000-memory.dmp

memory/792-56-0x0000000000000000-mapping.dmp

memory/2012-57-0x0000000000000000-mapping.dmp

memory/1164-58-0x0000000000000000-mapping.dmp

memory/1388-59-0x0000000000400000-0x000000000040D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 2d5d0cefc576aa916383504e1baba102
SHA1 97cae77569916e6922d9cf585f335b4b12540191
SHA256 abf70cb1775f92e4e7ae7cc9ad7b92a127b4b8a99d8f19c279b47af8a9eb3717
SHA512 b62901db93e081279f078e705342d8adf1707bdf0797cd3b9fc2f55aa9b919c42f28e0f37df4af29e60cf717f8fdec800ce1dccfa63355be4b05c0a47b19a350

\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 2d5d0cefc576aa916383504e1baba102
SHA1 97cae77569916e6922d9cf585f335b4b12540191
SHA256 abf70cb1775f92e4e7ae7cc9ad7b92a127b4b8a99d8f19c279b47af8a9eb3717
SHA512 b62901db93e081279f078e705342d8adf1707bdf0797cd3b9fc2f55aa9b919c42f28e0f37df4af29e60cf717f8fdec800ce1dccfa63355be4b05c0a47b19a350

memory/1168-63-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 2d5d0cefc576aa916383504e1baba102
SHA1 97cae77569916e6922d9cf585f335b4b12540191
SHA256 abf70cb1775f92e4e7ae7cc9ad7b92a127b4b8a99d8f19c279b47af8a9eb3717
SHA512 b62901db93e081279f078e705342d8adf1707bdf0797cd3b9fc2f55aa9b919c42f28e0f37df4af29e60cf717f8fdec800ce1dccfa63355be4b05c0a47b19a350

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 2d5d0cefc576aa916383504e1baba102
SHA1 97cae77569916e6922d9cf585f335b4b12540191
SHA256 abf70cb1775f92e4e7ae7cc9ad7b92a127b4b8a99d8f19c279b47af8a9eb3717
SHA512 b62901db93e081279f078e705342d8adf1707bdf0797cd3b9fc2f55aa9b919c42f28e0f37df4af29e60cf717f8fdec800ce1dccfa63355be4b05c0a47b19a350

memory/2012-66-0x0000000000130000-0x000000000013D000-memory.dmp

memory/2012-67-0x0000000000130000-0x000000000013D000-memory.dmp

memory/904-69-0x0000000000000000-mapping.dmp

memory/912-68-0x0000000000000000-mapping.dmp

memory/2012-70-0x0000000000130000-0x000000000013D000-memory.dmp

memory/2012-71-0x0000000000130000-0x000000000013D000-memory.dmp

memory/1168-72-0x0000000000400000-0x000000000040D000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-09-06 21:34

Reported

2022-09-06 21:37

Platform

win10v2004-20220812-en

Max time kernel

152s

Max time network

187s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6c2a5e3bda43426781fbb5693fdf2a96.exe"

Signatures

Sakula

trojan rat sakula

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" C:\Windows\SysWOW64\reg.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4436 wrote to memory of 3820 N/A C:\Users\Admin\AppData\Local\Temp\6c2a5e3bda43426781fbb5693fdf2a96.exe C:\Windows\SysWOW64\cmd.exe
PID 4436 wrote to memory of 3820 N/A C:\Users\Admin\AppData\Local\Temp\6c2a5e3bda43426781fbb5693fdf2a96.exe C:\Windows\SysWOW64\cmd.exe
PID 4436 wrote to memory of 3820 N/A C:\Users\Admin\AppData\Local\Temp\6c2a5e3bda43426781fbb5693fdf2a96.exe C:\Windows\SysWOW64\cmd.exe
PID 4436 wrote to memory of 4820 N/A C:\Users\Admin\AppData\Local\Temp\6c2a5e3bda43426781fbb5693fdf2a96.exe C:\Windows\SysWOW64\cmd.exe
PID 4436 wrote to memory of 4820 N/A C:\Users\Admin\AppData\Local\Temp\6c2a5e3bda43426781fbb5693fdf2a96.exe C:\Windows\SysWOW64\cmd.exe
PID 4436 wrote to memory of 4820 N/A C:\Users\Admin\AppData\Local\Temp\6c2a5e3bda43426781fbb5693fdf2a96.exe C:\Windows\SysWOW64\cmd.exe
PID 4436 wrote to memory of 4888 N/A C:\Users\Admin\AppData\Local\Temp\6c2a5e3bda43426781fbb5693fdf2a96.exe C:\Windows\SysWOW64\cmd.exe
PID 4436 wrote to memory of 4888 N/A C:\Users\Admin\AppData\Local\Temp\6c2a5e3bda43426781fbb5693fdf2a96.exe C:\Windows\SysWOW64\cmd.exe
PID 4436 wrote to memory of 4888 N/A C:\Users\Admin\AppData\Local\Temp\6c2a5e3bda43426781fbb5693fdf2a96.exe C:\Windows\SysWOW64\cmd.exe
PID 3820 wrote to memory of 3832 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3820 wrote to memory of 3832 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3820 wrote to memory of 3832 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4888 wrote to memory of 3756 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4888 wrote to memory of 3756 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4888 wrote to memory of 3756 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4820 wrote to memory of 3736 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 4820 wrote to memory of 3736 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 4820 wrote to memory of 3736 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

Processes

C:\Users\Admin\AppData\Local\Temp\6c2a5e3bda43426781fbb5693fdf2a96.exe

"C:\Users\Admin\AppData\Local\Temp\6c2a5e3bda43426781fbb5693fdf2a96.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\6c2a5e3bda43426781fbb5693fdf2a96.exe"

C:\Windows\SysWOW64\reg.exe

reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

Network

Country Destination Domain Proto
US 52.109.8.86:443 tcp
US 8.8.8.8:53 vpn.premrera.com udp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
NL 178.79.208.1:80 tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
IE 40.126.31.71:443 tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp

Files

memory/4436-132-0x0000000000400000-0x000000000040D000-memory.dmp

memory/4436-133-0x0000000000400000-0x000000000040D000-memory.dmp

memory/3820-134-0x0000000000000000-mapping.dmp

memory/4820-135-0x0000000000000000-mapping.dmp

memory/4888-136-0x0000000000000000-mapping.dmp

memory/4436-137-0x0000000000400000-0x000000000040D000-memory.dmp

memory/3756-139-0x0000000000000000-mapping.dmp

memory/3832-138-0x0000000000000000-mapping.dmp

memory/3736-140-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 d63f2fb5bf9e17b1e90e5a0ab7a70c35
SHA1 3b492f68875936a2f5a6a92403b80881f272b232
SHA256 edaf0a4d4f71d633b53d6bd6f5091ad6a7a88258c650772033b3832cea368e93
SHA512 fb37e0b2167352d1f7679797228c6402e8b254184c7d6a2c2e277b33a4cac2fc5fe39bfc72d52c1e3f4ec574f528f810f7b876785575ff61398d1f679cbd8263

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 d63f2fb5bf9e17b1e90e5a0ab7a70c35
SHA1 3b492f68875936a2f5a6a92403b80881f272b232
SHA256 edaf0a4d4f71d633b53d6bd6f5091ad6a7a88258c650772033b3832cea368e93
SHA512 fb37e0b2167352d1f7679797228c6402e8b254184c7d6a2c2e277b33a4cac2fc5fe39bfc72d52c1e3f4ec574f528f810f7b876785575ff61398d1f679cbd8263

memory/3736-143-0x0000000000400000-0x000000000040D000-memory.dmp

memory/3736-144-0x0000000000400000-0x000000000040D000-memory.dmp