sakula | d496522fd93ca1cb2bca9979b7868a39cbfb534ba328136a1d674dd8e88cd497

Analysis

max time kernel
125s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
17/10/2022, 08:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d496522fd93ca1cb2bca9979b7868a39cbfb534ba328136a1d674dd8e88cd497.exe
Size 222KB
Sample221017-kfz31abbc7
SHA256 d496522fd93ca1cb2bca9979b7868a39cbfb534ba328136a1d674dd8e88cd497
MD5 a999566216b6111e7e3a79cc38ea7275
SHA1 e7128d2bf65d01607ce1f636b99c8efeb08828f0
SHA512 445ca5235b0abe97b495cea68e5c5f805b096c8224a9622770ff5d289321a669a9ab90c90f22c56d9f145853eacac4be21d6391b46ee12ae061c8b639c877d2e
SSDEEP 6144:n29qRfVSnfj30BmhqC8WSr24AyqaLjLj64fm:zRfQniC8WSa4C6L2wm
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000300000001e64b-133.dat	family_sakula
behavioral2/files/0x000300000001e64b-134.dat	family_sakula

Executes dropped EXE 1 IoCs

pid	Process
384	MediaCenter.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	d496522fd93ca1cb2bca9979b7868a39cbfb534ba328136a1d674dd8e88cd497.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	d496522fd93ca1cb2bca9979b7868a39cbfb534ba328136a1d674dd8e88cd497.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3480	PING.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1212	d496522fd93ca1cb2bca9979b7868a39cbfb534ba328136a1d674dd8e88cd497.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1212 wrote to memory of 384	1212	d496522fd93ca1cb2bca9979b7868a39cbfb534ba328136a1d674dd8e88cd497.exe	82
PID 1212 wrote to memory of 384	1212	d496522fd93ca1cb2bca9979b7868a39cbfb534ba328136a1d674dd8e88cd497.exe	82
PID 1212 wrote to memory of 384	1212	d496522fd93ca1cb2bca9979b7868a39cbfb534ba328136a1d674dd8e88cd497.exe	82
PID 1212 wrote to memory of 2528	1212	d496522fd93ca1cb2bca9979b7868a39cbfb534ba328136a1d674dd8e88cd497.exe	90
PID 1212 wrote to memory of 2528	1212	d496522fd93ca1cb2bca9979b7868a39cbfb534ba328136a1d674dd8e88cd497.exe	90
PID 1212 wrote to memory of 2528	1212	d496522fd93ca1cb2bca9979b7868a39cbfb534ba328136a1d674dd8e88cd497.exe	90
PID 2528 wrote to memory of 3480	2528	cmd.exe	92
PID 2528 wrote to memory of 3480	2528	cmd.exe	92
PID 2528 wrote to memory of 3480	2528	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\d496522fd93ca1cb2bca9979b7868a39cbfb534ba328136a1d674dd8e88cd497.exe
"C:\Users\Admin\AppData\Local\Temp\d496522fd93ca1cb2bca9979b7868a39cbfb534ba328136a1d674dd8e88cd497.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
  C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\d496522fd93ca1cb2bca9979b7868a39cbfb534ba328136a1d674dd8e88cd497.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2528
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:3480

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MediaCenter.exe

Path C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Size 222KB
SHA256 33c1a371acf01fdd880ad2851e2bee9fc67db7fcff99d7491605654ae42bb0cc
MD5 2dcec5c4ffc7687ebac33f5f753e8e2f
SHA1 45a21bf6e0c52a5eb9134ab0c1dd45fc92037c0f
SHA512 a9e6accb4a4e071882ebea37fb432dad7350c38b7d0addc3c5c0f2f41f16466dbac8c2c259c50ee63051422f98d8b669edc1b81f190f82ce2e3432531fc43672
SSDEEP 6144:n29qRfVSnfj30BmhqC8WSr24AyqaLjLj64fS:zRfQniC8WSa4C6L2wS
MD5 SHA1 SHA512 SSDEEP

Submit Download