sakula | d30cd9fd9263686038892415029bd8c2d1dd6be5065fdbaf8f2b1b06ea2034af

Analysis

max time kernel
140s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
09/08/2023, 10:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d30cd9fd9263686038892415029bd8c2d1dd6be5065fdbaf8f2b1b06ea2034af.exe
Size 92KB
Sample230809-mq61eaae84
SHA256 d30cd9fd9263686038892415029bd8c2d1dd6be5065fdbaf8f2b1b06ea2034af
MD5 2d55947126b55a85da51185523a66f81
SHA1 57d44030323b4c2afdf684bc84092fa9ce12c40e
SHA512 86a471929e60c3e8aa26ca7034a8f1efb32ff78afab863683abef207309ce505552c3b565b50c68ef036a2772ba60b669546489bb44c0345d4921629fcacd92d
SSDEEP 1536:TJbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtrM:9bfVk29te2jqxCEtg30Bg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sakula persistence rat trojan

Malware Config

Extracted

Family

sakula

www.savmpet.com

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula payload 2 IoCs

resource	yara_rule
behavioral2/files/0x00060000000231c4-135.dat	family_sakula
behavioral2/files/0x00060000000231c4-136.dat	family_sakula

Executes dropped EXE 1 IoCs

pid	Process
4120	AdobeUpdate.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AdobeUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\AdobeUpdate.exe"	d30cd9fd9263686038892415029bd8c2d1dd6be5065fdbaf8f2b1b06ea2034af.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4752	PING.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1056	d30cd9fd9263686038892415029bd8c2d1dd6be5065fdbaf8f2b1b06ea2034af.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 4120	1056	d30cd9fd9263686038892415029bd8c2d1dd6be5065fdbaf8f2b1b06ea2034af.exe	82
PID 1056 wrote to memory of 4120	1056	d30cd9fd9263686038892415029bd8c2d1dd6be5065fdbaf8f2b1b06ea2034af.exe	82
PID 1056 wrote to memory of 4120	1056	d30cd9fd9263686038892415029bd8c2d1dd6be5065fdbaf8f2b1b06ea2034af.exe	82
PID 1056 wrote to memory of 1584	1056	d30cd9fd9263686038892415029bd8c2d1dd6be5065fdbaf8f2b1b06ea2034af.exe	92
PID 1056 wrote to memory of 1584	1056	d30cd9fd9263686038892415029bd8c2d1dd6be5065fdbaf8f2b1b06ea2034af.exe	92
PID 1056 wrote to memory of 1584	1056	d30cd9fd9263686038892415029bd8c2d1dd6be5065fdbaf8f2b1b06ea2034af.exe	92
PID 1584 wrote to memory of 4752	1584	cmd.exe	94
PID 1584 wrote to memory of 4752	1584	cmd.exe	94
PID 1584 wrote to memory of 4752	1584	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\d30cd9fd9263686038892415029bd8c2d1dd6be5065fdbaf8f2b1b06ea2034af.exe
"C:\Users\Admin\AppData\Local\Temp\d30cd9fd9263686038892415029bd8c2d1dd6be5065fdbaf8f2b1b06ea2034af.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe
  C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe
  2⤵
  - Executes dropped EXE
  PID:4120
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\d30cd9fd9263686038892415029bd8c2d1dd6be5065fdbaf8f2b1b06ea2034af.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1584
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:4752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AdobeUpdate.exe

Path C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe
Size 92KB
SHA256 1d998b6077c5d6ba3afb912acc28ca8d3a660e1af413cea0befdabdbf24a5b4f
MD5 baf091416a53c32448be26270f112db9
SHA1 3beea34d821df1d6797945f29d9c60ca2b152ef8
SHA512 9fa20587d1ef65a7e6a23fd08f5d31b57581cebd437262a4aa447c11c5930a3ec9002c1f4921661f1b017b5b8752dd641fc51a8c3f6dc4c43e199d8e758ff1ab
SSDEEP 1536:TJbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtrh:9bfVk29te2jqxCEtg30Bd
MD5 SHA1 SHA512 SSDEEP

Submit Download

AdobeUpdate.exe

Path C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe
Size 92KB
SHA256 1d998b6077c5d6ba3afb912acc28ca8d3a660e1af413cea0befdabdbf24a5b4f
MD5 baf091416a53c32448be26270f112db9
SHA1 3beea34d821df1d6797945f29d9c60ca2b152ef8
SHA512 9fa20587d1ef65a7e6a23fd08f5d31b57581cebd437262a4aa447c11c5930a3ec9002c1f4921661f1b017b5b8752dd641fc51a8c3f6dc4c43e199d8e758ff1ab
SSDEEP 1536:TJbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtrh:9bfVk29te2jqxCEtg30Bd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads