sakula | 6794211eacc25f6d8d7b15495b989101fb61ac8dbadcf04d212c0a1ebee526c6

Analysis

max time kernel
145s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
09/08/2023, 15:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6794211eacc25f6d8d7b15495b989101fb61ac8dbadcf04d212c0a1ebee526c6.exe
Size 41KB
Sample230809-tbyh2scf64
SHA256 6794211eacc25f6d8d7b15495b989101fb61ac8dbadcf04d212c0a1ebee526c6
MD5 0c6fe884b555a5fc6d4e030e75d3f66b
SHA1 98cd4ee65a200ffd4112231367c4baa1b68046ea
SHA512 58ac71d0a7f69aefd14842ba0e6fcc6a6367308fcba4104138ed96fd4a21d39091077de87f32b5f7b548e1ce211b79ebc33bd9128f043454683cd56ca711d4b1
SSDEEP 768:+mAMlx3ppWo00zpPGlAm7WlSFOc/VBUiFzuXhhf0Ys93NUd70aXXXB6Q7DJ:+RMbZ4sp8PWlet/VBfghp0Ys93i708XH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sakula persistence rat trojan

Malware Config

Extracted

Family

sakula

www.polarroute.com

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula payload 4 IoCs

resource	yara_rule
behavioral2/memory/3472-139-0x0000000000400000-0x000000000041D000-memory.dmp	family_sakula
behavioral2/memory/4908-141-0x0000000000400000-0x000000000041D000-memory.dmp	family_sakula
behavioral2/memory/3472-146-0x0000000000400000-0x000000000041D000-memory.dmp	family_sakula
behavioral2/memory/4908-154-0x0000000000400000-0x000000000041D000-memory.dmp	family_sakula

Executes dropped EXE 1 IoCs

pid	Process
4908	MediaCenter.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	6794211eacc25f6d8d7b15495b989101fb61ac8dbadcf04d212c0a1ebee526c6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4156	PING.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3472	6794211eacc25f6d8d7b15495b989101fb61ac8dbadcf04d212c0a1ebee526c6.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3472 wrote to memory of 4908	3472	6794211eacc25f6d8d7b15495b989101fb61ac8dbadcf04d212c0a1ebee526c6.exe	81
PID 3472 wrote to memory of 4908	3472	6794211eacc25f6d8d7b15495b989101fb61ac8dbadcf04d212c0a1ebee526c6.exe	81
PID 3472 wrote to memory of 4908	3472	6794211eacc25f6d8d7b15495b989101fb61ac8dbadcf04d212c0a1ebee526c6.exe	81
PID 3472 wrote to memory of 208	3472	6794211eacc25f6d8d7b15495b989101fb61ac8dbadcf04d212c0a1ebee526c6.exe	91
PID 3472 wrote to memory of 208	3472	6794211eacc25f6d8d7b15495b989101fb61ac8dbadcf04d212c0a1ebee526c6.exe	91
PID 3472 wrote to memory of 208	3472	6794211eacc25f6d8d7b15495b989101fb61ac8dbadcf04d212c0a1ebee526c6.exe	91
PID 208 wrote to memory of 4156	208	cmd.exe	93
PID 208 wrote to memory of 4156	208	cmd.exe	93
PID 208 wrote to memory of 4156	208	cmd.exe	93

C:\Users\Admin\AppData\Local\Temp\6794211eacc25f6d8d7b15495b989101fb61ac8dbadcf04d212c0a1ebee526c6.exe
"C:\Users\Admin\AppData\Local\Temp\6794211eacc25f6d8d7b15495b989101fb61ac8dbadcf04d212c0a1ebee526c6.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3472
- C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
  C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\6794211eacc25f6d8d7b15495b989101fb61ac8dbadcf04d212c0a1ebee526c6.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:208
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:4156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

yzzzrdhb175015606[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7QVM26BR\yzzzrdhb175015606[1].htm
Size 2KB
SHA256 91182a40c071dbe3b3d8dca43f99f770401f0fcc20ccc811194ba8131f8345f3
MD5 18151e136949ca25a6537b5232d55478
SHA1 6cca4203a950a0e8ca3278368fae40f0bdf7fd57
SHA512 29feb26d69e2e5d474087a4782529718e148af76bee751156e85e9a8719045e530ddb75ed066f0f32cb84889166a9d59e9f2bd192a43d8c260f5585f1fb38443
MD5 SHA1 SHA512

Submit Download

MediaCenter.exe

Path C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Size 41KB
SHA256 b0db37778f84beebf1d79b25ab4b9a358584404958b7537f971334034ba68fcd
MD5 e75bbb1ed12ab86f8b7310793c544806
SHA1 f814980af35a32d7df60b5ba18678febe5b3886e
SHA512 cfdbc5430542aebb0cab2609e84f78cb30a4065b8c4f197bec18bc394f9c78ad993ad8c43fbb429057fe431d2d196ad07c6a10b77a7f51f480bbd9dec9c87997
SSDEEP 768:+mAMlx3ppWo00zpPGlAm7WlSFOc/VBUiFzuXhhf0Ys93NUd70aXXXB6Q7Dr:+RMbZ4sp8PWlet/VBfghp0Ys93i708Xp
MD5 SHA1 SHA512 SSDEEP

Submit Download

MediaCenter.exe

Path C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Size 41KB
SHA256 b0db37778f84beebf1d79b25ab4b9a358584404958b7537f971334034ba68fcd
MD5 e75bbb1ed12ab86f8b7310793c544806
SHA1 f814980af35a32d7df60b5ba18678febe5b3886e
SHA512 cfdbc5430542aebb0cab2609e84f78cb30a4065b8c4f197bec18bc394f9c78ad993ad8c43fbb429057fe431d2d196ad07c6a10b77a7f51f480bbd9dec9c87997
SSDEEP 768:+mAMlx3ppWo00zpPGlAm7WlSFOc/VBUiFzuXhhf0Ys93NUd70aXXXB6Q7Dr:+RMbZ4sp8PWlet/VBfghp0Ys93i708Xp
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3472-133-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/3472-139-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/3472-146-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/4908-137-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/4908-141-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/4908-154-0x0000000000400000-0x000000000041D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads