Malware Analysis Report

2024-12-07 22:09

Sample ID 221012-t2sqgsbfdm
Target 82334fde2fa92edf636d8885d542627f98aa326cf50df9b0f124229d8d857b11
SHA256 82334fde2fa92edf636d8885d542627f98aa326cf50df9b0f124229d8d857b11
Tags
sakula persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

82334fde2fa92edf636d8885d542627f98aa326cf50df9b0f124229d8d857b11

Threat Level: Known bad

The file 82334fde2fa92edf636d8885d542627f98aa326cf50df9b0f124229d8d857b11 was found to be: Known bad.

Malicious Activity Summary

sakula persistence rat trojan

Sakula

Sakula family

Sakula payload

Executes dropped EXE

Deletes itself

Checks computer location settings

Loads dropped DLL

Adds Run key to start application

Enumerates physical storage devices

Runs ping.exe

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-10-12 16:33

Signatures

Sakula family

sakula

Sakula payload

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-10-12 16:33

Reported

2022-10-12 16:36

Platform

win7-20220812-en

Max time kernel

123s

Max time network

138s

Command Line

"C:\Users\Admin\AppData\Local\Temp\82334fde2fa92edf636d8885d542627f98aa326cf50df9b0f124229d8d857b11.exe"

Signatures

Sakula

trojan rat sakula

Sakula payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" C:\Users\Admin\AppData\Local\Temp\82334fde2fa92edf636d8885d542627f98aa326cf50df9b0f124229d8d857b11.exe N/A

Enumerates physical storage devices

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82334fde2fa92edf636d8885d542627f98aa326cf50df9b0f124229d8d857b11.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1248 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\82334fde2fa92edf636d8885d542627f98aa326cf50df9b0f124229d8d857b11.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 1248 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\82334fde2fa92edf636d8885d542627f98aa326cf50df9b0f124229d8d857b11.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 1248 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\82334fde2fa92edf636d8885d542627f98aa326cf50df9b0f124229d8d857b11.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 1248 wrote to memory of 1384 N/A C:\Users\Admin\AppData\Local\Temp\82334fde2fa92edf636d8885d542627f98aa326cf50df9b0f124229d8d857b11.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 1248 wrote to memory of 1336 N/A C:\Users\Admin\AppData\Local\Temp\82334fde2fa92edf636d8885d542627f98aa326cf50df9b0f124229d8d857b11.exe C:\Windows\SysWOW64\cmd.exe
PID 1248 wrote to memory of 1336 N/A C:\Users\Admin\AppData\Local\Temp\82334fde2fa92edf636d8885d542627f98aa326cf50df9b0f124229d8d857b11.exe C:\Windows\SysWOW64\cmd.exe
PID 1248 wrote to memory of 1336 N/A C:\Users\Admin\AppData\Local\Temp\82334fde2fa92edf636d8885d542627f98aa326cf50df9b0f124229d8d857b11.exe C:\Windows\SysWOW64\cmd.exe
PID 1248 wrote to memory of 1336 N/A C:\Users\Admin\AppData\Local\Temp\82334fde2fa92edf636d8885d542627f98aa326cf50df9b0f124229d8d857b11.exe C:\Windows\SysWOW64\cmd.exe
PID 1336 wrote to memory of 776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1336 wrote to memory of 776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1336 wrote to memory of 776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1336 wrote to memory of 776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\82334fde2fa92edf636d8885d542627f98aa326cf50df9b0f124229d8d857b11.exe

"C:\Users\Admin\AppData\Local\Temp\82334fde2fa92edf636d8885d542627f98aa326cf50df9b0f124229d8d857b11.exe"

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\82334fde2fa92edf636d8885d542627f98aa326cf50df9b0f124229d8d857b11.exe"

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1

Network

Country Destination Domain Proto
US 8.8.8.8:53 citrix.vipreclod.com udp
TH 184.22.175.13:80 tcp
TH 184.22.175.13:80 tcp

Files

memory/1248-54-0x0000000075351000-0x0000000075353000-memory.dmp

\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 75830ee0a9c362ebc86b098f0ef8107f
SHA1 160cc558f627c017ac6e1d08cc7c1fe960b40650
SHA256 f1ecfc2558d559c035593e108cd2007778b0c7eec8c4aea81a4d985b9332229f
SHA512 d23f770e7a4d64f6818d71529edf4a4a581da739e3bbf3ed52854f74b528c7dd263dba274a10c160998f8b363c1a56fbc407648b623ccfafdedf2cc7a384e76b

\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 75830ee0a9c362ebc86b098f0ef8107f
SHA1 160cc558f627c017ac6e1d08cc7c1fe960b40650
SHA256 f1ecfc2558d559c035593e108cd2007778b0c7eec8c4aea81a4d985b9332229f
SHA512 d23f770e7a4d64f6818d71529edf4a4a581da739e3bbf3ed52854f74b528c7dd263dba274a10c160998f8b363c1a56fbc407648b623ccfafdedf2cc7a384e76b

memory/1384-57-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 75830ee0a9c362ebc86b098f0ef8107f
SHA1 160cc558f627c017ac6e1d08cc7c1fe960b40650
SHA256 f1ecfc2558d559c035593e108cd2007778b0c7eec8c4aea81a4d985b9332229f
SHA512 d23f770e7a4d64f6818d71529edf4a4a581da739e3bbf3ed52854f74b528c7dd263dba274a10c160998f8b363c1a56fbc407648b623ccfafdedf2cc7a384e76b

memory/1336-60-0x0000000000000000-mapping.dmp

memory/776-61-0x0000000000000000-mapping.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-10-12 16:33

Reported

2022-10-12 16:36

Platform

win10v2004-20220901-en

Max time kernel

145s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\82334fde2fa92edf636d8885d542627f98aa326cf50df9b0f124229d8d857b11.exe"

Signatures

Sakula

trojan rat sakula

Sakula payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\82334fde2fa92edf636d8885d542627f98aa326cf50df9b0f124229d8d857b11.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" C:\Users\Admin\AppData\Local\Temp\82334fde2fa92edf636d8885d542627f98aa326cf50df9b0f124229d8d857b11.exe N/A

Enumerates physical storage devices

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\82334fde2fa92edf636d8885d542627f98aa326cf50df9b0f124229d8d857b11.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\82334fde2fa92edf636d8885d542627f98aa326cf50df9b0f124229d8d857b11.exe

"C:\Users\Admin\AppData\Local\Temp\82334fde2fa92edf636d8885d542627f98aa326cf50df9b0f124229d8d857b11.exe"

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\82334fde2fa92edf636d8885d542627f98aa326cf50df9b0f124229d8d857b11.exe"

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1

Network

Country Destination Domain Proto
US 8.8.8.8:53 citrix.vipreclod.com udp
US 8.253.208.113:80 tcp
FR 2.18.109.224:443 tcp
US 8.8.8.8:53 citrix.vipreclod.com udp
US 20.42.73.25:443 tcp
NL 87.248.202.1:80 tcp
NL 87.248.202.1:80 tcp
US 93.184.221.240:80 tcp
US 8.8.8.8:53 citrix.vipreclod.com udp
US 8.8.8.8:53 citrix.vipreclod.com udp
TH 184.22.175.13:80 tcp
TH 184.22.175.13:80 tcp
TH 184.22.175.13:80 tcp

Files

memory/4792-132-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 727665c7349d6cff3367b40d2e23163c
SHA1 ecc90f7722cbff9a5d674e3cb20bf0c1e7a05a5b
SHA256 63335ee7068a4ec5844eb9806ab98452ad57d94a096cfa4c08fac9787a7ee4b5
SHA512 8647c9c536c0e221c633836964e268e4102535ae8f6fcace3f69baeb30a423c303667f94d32f4351b8fddefa80414e523d703a118824396f0ba3f51f2536c8c3

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 727665c7349d6cff3367b40d2e23163c
SHA1 ecc90f7722cbff9a5d674e3cb20bf0c1e7a05a5b
SHA256 63335ee7068a4ec5844eb9806ab98452ad57d94a096cfa4c08fac9787a7ee4b5
SHA512 8647c9c536c0e221c633836964e268e4102535ae8f6fcace3f69baeb30a423c303667f94d32f4351b8fddefa80414e523d703a118824396f0ba3f51f2536c8c3

memory/2836-135-0x0000000000000000-mapping.dmp

memory/4492-136-0x0000000000000000-mapping.dmp