sakula | 7f2039c641810dc1bc2b9b2786759a2c382f0e0c34dc0b799d7167fde40cb566

Analysis

max time kernel
128s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2022, 16:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7f2039c641810dc1bc2b9b2786759a2c382f0e0c34dc0b799d7167fde40cb566.exe
Size 88KB
Sample221012-t2gcfsbfck
SHA256 7f2039c641810dc1bc2b9b2786759a2c382f0e0c34dc0b799d7167fde40cb566
MD5 72bec5d48d53b44c2fca686dd0ed2709
SHA1 54e7b076891ab25f59e4950dc7420fa1c8aae9f7
SHA512 301bed29246734d7ee05b591d74c9e545dc3d2b592dbec0f1cb9c405264f6bb2a2722584e0b10aed58c63ef8b508340944d538bf11e657a7706573311a9e3f2e
SSDEEP 1536:Boaj1hJL1S9t0MIeboal8bCKxo7h0RP0jwHVz30rtroyPTEzS:y0hpgz6xGhTjwHN30BEybEO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0004000000022de5-133.dat	family_sakula
behavioral2/files/0x0004000000022de5-134.dat	family_sakula

Executes dropped EXE 1 IoCs

pid	Process
4584	MediaCenter.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	7f2039c641810dc1bc2b9b2786759a2c382f0e0c34dc0b799d7167fde40cb566.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	7f2039c641810dc1bc2b9b2786759a2c382f0e0c34dc0b799d7167fde40cb566.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4228	PING.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1936	7f2039c641810dc1bc2b9b2786759a2c382f0e0c34dc0b799d7167fde40cb566.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 4584	1936	7f2039c641810dc1bc2b9b2786759a2c382f0e0c34dc0b799d7167fde40cb566.exe	82
PID 1936 wrote to memory of 4584	1936	7f2039c641810dc1bc2b9b2786759a2c382f0e0c34dc0b799d7167fde40cb566.exe	82
PID 1936 wrote to memory of 4584	1936	7f2039c641810dc1bc2b9b2786759a2c382f0e0c34dc0b799d7167fde40cb566.exe	82
PID 1936 wrote to memory of 1136	1936	7f2039c641810dc1bc2b9b2786759a2c382f0e0c34dc0b799d7167fde40cb566.exe	92
PID 1936 wrote to memory of 1136	1936	7f2039c641810dc1bc2b9b2786759a2c382f0e0c34dc0b799d7167fde40cb566.exe	92
PID 1936 wrote to memory of 1136	1936	7f2039c641810dc1bc2b9b2786759a2c382f0e0c34dc0b799d7167fde40cb566.exe	92
PID 1136 wrote to memory of 4228	1136	cmd.exe	94
PID 1136 wrote to memory of 4228	1136	cmd.exe	94
PID 1136 wrote to memory of 4228	1136	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\7f2039c641810dc1bc2b9b2786759a2c382f0e0c34dc0b799d7167fde40cb566.exe
"C:\Users\Admin\AppData\Local\Temp\7f2039c641810dc1bc2b9b2786759a2c382f0e0c34dc0b799d7167fde40cb566.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
  C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\7f2039c641810dc1bc2b9b2786759a2c382f0e0c34dc0b799d7167fde40cb566.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1136
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:4228

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MediaCenter.exe

Path C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Size 88KB
SHA256 dd77fc69efbba517c5d8404cbc1bf8f6d69a09f37507565a5109aa713f939981
MD5 96fdc6e2eb7bfba13e34446d33aad7bc
SHA1 3c9387c56c0e420deb4f62a7ab44687722cadfa5
SHA512 8889929e4f5fb4269c5193341aa6753cc25ec32f637cc71f70e5454627df03145bf6c1388efed161832c7956d8846bae6a5c6919b079e4e11e487e7320235201
SSDEEP 1536:Boaj1hJL1S9t0MIeboal8bCKxo7h0RP0jwHVz30rtroyPTEzm:y0hpgz6xGhTjwHN30BEybES
MD5 SHA1 SHA512 SSDEEP

Submit Download