Malware Analysis Report

2024-12-07 22:09

Sample ID 221012-t2gcfsbfck
Target 7f2039c641810dc1bc2b9b2786759a2c382f0e0c34dc0b799d7167fde40cb566
SHA256 7f2039c641810dc1bc2b9b2786759a2c382f0e0c34dc0b799d7167fde40cb566
Tags
sakula persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

7f2039c641810dc1bc2b9b2786759a2c382f0e0c34dc0b799d7167fde40cb566

Threat Level: Known bad

The file 7f2039c641810dc1bc2b9b2786759a2c382f0e0c34dc0b799d7167fde40cb566 was found to be: Known bad.

Malicious Activity Summary

sakula persistence rat trojan

Sakula family

Sakula

Sakula payload

Executes dropped EXE

Checks computer location settings

Deletes itself

Loads dropped DLL

Adds Run key to start application

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Runs ping.exe

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-10-12 16:32

Signatures

Sakula family

sakula

Sakula payload

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2022-10-12 16:32

Reported

2022-10-12 16:35

Platform

win10v2004-20220901-en

Max time kernel

128s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7f2039c641810dc1bc2b9b2786759a2c382f0e0c34dc0b799d7167fde40cb566.exe"

Signatures

Sakula

trojan rat sakula

Sakula payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\7f2039c641810dc1bc2b9b2786759a2c382f0e0c34dc0b799d7167fde40cb566.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" C:\Users\Admin\AppData\Local\Temp\7f2039c641810dc1bc2b9b2786759a2c382f0e0c34dc0b799d7167fde40cb566.exe N/A

Enumerates physical storage devices

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7f2039c641810dc1bc2b9b2786759a2c382f0e0c34dc0b799d7167fde40cb566.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\7f2039c641810dc1bc2b9b2786759a2c382f0e0c34dc0b799d7167fde40cb566.exe

"C:\Users\Admin\AppData\Local\Temp\7f2039c641810dc1bc2b9b2786759a2c382f0e0c34dc0b799d7167fde40cb566.exe"

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\7f2039c641810dc1bc2b9b2786759a2c382f0e0c34dc0b799d7167fde40cb566.exe"

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1

Network

Country Destination Domain Proto
US 8.8.8.8:53 citrix.vipreclod.com udp
US 20.42.72.131:443 tcp
BE 67.24.25.254:80 tcp
BE 67.24.25.254:80 tcp
BE 67.24.25.254:80 tcp
US 8.8.8.8:53 citrix.vipreclod.com udp
US 8.8.8.8:53 citrix.vipreclod.com udp
TH 184.22.175.13:80 tcp
TH 184.22.175.13:80 tcp

Files

memory/4584-132-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 96fdc6e2eb7bfba13e34446d33aad7bc
SHA1 3c9387c56c0e420deb4f62a7ab44687722cadfa5
SHA256 dd77fc69efbba517c5d8404cbc1bf8f6d69a09f37507565a5109aa713f939981
SHA512 8889929e4f5fb4269c5193341aa6753cc25ec32f637cc71f70e5454627df03145bf6c1388efed161832c7956d8846bae6a5c6919b079e4e11e487e7320235201

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 96fdc6e2eb7bfba13e34446d33aad7bc
SHA1 3c9387c56c0e420deb4f62a7ab44687722cadfa5
SHA256 dd77fc69efbba517c5d8404cbc1bf8f6d69a09f37507565a5109aa713f939981
SHA512 8889929e4f5fb4269c5193341aa6753cc25ec32f637cc71f70e5454627df03145bf6c1388efed161832c7956d8846bae6a5c6919b079e4e11e487e7320235201

memory/1136-135-0x0000000000000000-mapping.dmp

memory/4228-136-0x0000000000000000-mapping.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2022-10-12 16:32

Reported

2022-10-12 16:36

Platform

win7-20220812-en

Max time kernel

126s

Max time network

143s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7f2039c641810dc1bc2b9b2786759a2c382f0e0c34dc0b799d7167fde40cb566.exe"

Signatures

Sakula

trojan rat sakula

Sakula payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" C:\Users\Admin\AppData\Local\Temp\7f2039c641810dc1bc2b9b2786759a2c382f0e0c34dc0b799d7167fde40cb566.exe N/A

Enumerates physical storage devices

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7f2039c641810dc1bc2b9b2786759a2c382f0e0c34dc0b799d7167fde40cb566.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1972 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\7f2039c641810dc1bc2b9b2786759a2c382f0e0c34dc0b799d7167fde40cb566.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 1972 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\7f2039c641810dc1bc2b9b2786759a2c382f0e0c34dc0b799d7167fde40cb566.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 1972 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\7f2039c641810dc1bc2b9b2786759a2c382f0e0c34dc0b799d7167fde40cb566.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 1972 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\7f2039c641810dc1bc2b9b2786759a2c382f0e0c34dc0b799d7167fde40cb566.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 1972 wrote to memory of 592 N/A C:\Users\Admin\AppData\Local\Temp\7f2039c641810dc1bc2b9b2786759a2c382f0e0c34dc0b799d7167fde40cb566.exe C:\Windows\SysWOW64\cmd.exe
PID 1972 wrote to memory of 592 N/A C:\Users\Admin\AppData\Local\Temp\7f2039c641810dc1bc2b9b2786759a2c382f0e0c34dc0b799d7167fde40cb566.exe C:\Windows\SysWOW64\cmd.exe
PID 1972 wrote to memory of 592 N/A C:\Users\Admin\AppData\Local\Temp\7f2039c641810dc1bc2b9b2786759a2c382f0e0c34dc0b799d7167fde40cb566.exe C:\Windows\SysWOW64\cmd.exe
PID 1972 wrote to memory of 592 N/A C:\Users\Admin\AppData\Local\Temp\7f2039c641810dc1bc2b9b2786759a2c382f0e0c34dc0b799d7167fde40cb566.exe C:\Windows\SysWOW64\cmd.exe
PID 592 wrote to memory of 1664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 592 wrote to memory of 1664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 592 wrote to memory of 1664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 592 wrote to memory of 1664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\7f2039c641810dc1bc2b9b2786759a2c382f0e0c34dc0b799d7167fde40cb566.exe

"C:\Users\Admin\AppData\Local\Temp\7f2039c641810dc1bc2b9b2786759a2c382f0e0c34dc0b799d7167fde40cb566.exe"

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\7f2039c641810dc1bc2b9b2786759a2c382f0e0c34dc0b799d7167fde40cb566.exe"

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1

Network

Country Destination Domain Proto
US 8.8.8.8:53 citrix.vipreclod.com udp
TH 184.22.175.13:80 tcp
TH 184.22.175.13:80 tcp

Files

memory/1972-54-0x00000000751A1000-0x00000000751A3000-memory.dmp

\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 5c2025af2118c2c19c84d019156fad68
SHA1 5962557fcfb0c503fe7d9dc88c1272e72c64d72b
SHA256 d7f1d6e34d831562dc8dd4b9235f83e2fe65e5354e4fce28cc5885454bd3f44e
SHA512 5347f50cb5faf87aa0534fef5088edcbc545a2a8f2ff1801eea00a5a9e32ee7f869f10845979ec23c4d8023697e39a752fb9b87dbbacc3b2551cea504f5775f5

\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 5c2025af2118c2c19c84d019156fad68
SHA1 5962557fcfb0c503fe7d9dc88c1272e72c64d72b
SHA256 d7f1d6e34d831562dc8dd4b9235f83e2fe65e5354e4fce28cc5885454bd3f44e
SHA512 5347f50cb5faf87aa0534fef5088edcbc545a2a8f2ff1801eea00a5a9e32ee7f869f10845979ec23c4d8023697e39a752fb9b87dbbacc3b2551cea504f5775f5

memory/1360-57-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 5c2025af2118c2c19c84d019156fad68
SHA1 5962557fcfb0c503fe7d9dc88c1272e72c64d72b
SHA256 d7f1d6e34d831562dc8dd4b9235f83e2fe65e5354e4fce28cc5885454bd3f44e
SHA512 5347f50cb5faf87aa0534fef5088edcbc545a2a8f2ff1801eea00a5a9e32ee7f869f10845979ec23c4d8023697e39a752fb9b87dbbacc3b2551cea504f5775f5

memory/592-60-0x0000000000000000-mapping.dmp

memory/1664-61-0x0000000000000000-mapping.dmp