sakula | e67eeb117157e80b07099997f130125100ff35cc44712e54f1842a26e89d5050

General

Target

dfd1856323cba7485217cee5c5c8f48f_JC.exe
Size

92KB
MD5

dfd1856323cba7485217cee5c5c8f48f
SHA1

cddf93ff37818ebf3ec1f36939a47591c7fac798
SHA256

e67eeb117157e80b07099997f130125100ff35cc44712e54f1842a26e89d5050
SHA512

b0ccc4e9e2690c855309c4277b198940e839c64c94d0f3b9eabdacb2deb41be37498b6efc91d8e5e3215e74f23baeba3b378c3ecf64387f8da66b4137345bcc2
SSDEEP

1536:TJbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtrC:9bfVk29te2jqxCEtg30BG

Score

10^/10

sakula persistence rat trojan

Malware Config

Extracted

Family

sakula

C2

www.savmpet.com

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula payload 6 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe	family_sakula
\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe	family_sakula
\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe	family_sakula
\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe	family_sakula

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2520 cmd.exe
Executes dropped EXE 1 IoCs

Processes:

AdobeUpdate.exe

pid process

2988 AdobeUpdate.exe
Loads dropped DLL 4 IoCs

Processes:

dfd1856323cba7485217cee5c5c8f48f_JC.exeAdobeUpdate.exe

pid process

2844 dfd1856323cba7485217cee5c5c8f48f_JC.exe
2988 AdobeUpdate.exe
2988 AdobeUpdate.exe
2988 AdobeUpdate.exe

pid	process
2520	cmd.exe

pid	process
2988	AdobeUpdate.exe

pid	process
2844	dfd1856323cba7485217cee5c5c8f48f_JC.exe
2988	AdobeUpdate.exe
2988	AdobeUpdate.exe
2988	AdobeUpdate.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

dfd1856323cba7485217cee5c5c8f48f_JC.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AdobeUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\AdobeUpdate.exe"	dfd1856323cba7485217cee5c5c8f48f_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2580 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

dfd1856323cba7485217cee5c5c8f48f_JC.exe

description pid process

Token: SeIncBasePriorityPrivilege 2844 dfd1856323cba7485217cee5c5c8f48f_JC.exe

pid	process
2580	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	2844	dfd1856323cba7485217cee5c5c8f48f_JC.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

dfd1856323cba7485217cee5c5c8f48f_JC.execmd.exe

description	pid	process	target process
PID 2844 wrote to memory of 2988	2844	dfd1856323cba7485217cee5c5c8f48f_JC.exe	AdobeUpdate.exe
PID 2844 wrote to memory of 2988	2844	dfd1856323cba7485217cee5c5c8f48f_JC.exe	AdobeUpdate.exe
PID 2844 wrote to memory of 2988	2844	dfd1856323cba7485217cee5c5c8f48f_JC.exe	AdobeUpdate.exe
PID 2844 wrote to memory of 2988	2844	dfd1856323cba7485217cee5c5c8f48f_JC.exe	AdobeUpdate.exe
PID 2844 wrote to memory of 2988	2844	dfd1856323cba7485217cee5c5c8f48f_JC.exe	AdobeUpdate.exe
PID 2844 wrote to memory of 2988	2844	dfd1856323cba7485217cee5c5c8f48f_JC.exe	AdobeUpdate.exe
PID 2844 wrote to memory of 2988	2844	dfd1856323cba7485217cee5c5c8f48f_JC.exe	AdobeUpdate.exe
PID 2844 wrote to memory of 2520	2844	dfd1856323cba7485217cee5c5c8f48f_JC.exe	cmd.exe
PID 2844 wrote to memory of 2520	2844	dfd1856323cba7485217cee5c5c8f48f_JC.exe	cmd.exe
PID 2844 wrote to memory of 2520	2844	dfd1856323cba7485217cee5c5c8f48f_JC.exe	cmd.exe
PID 2844 wrote to memory of 2520	2844	dfd1856323cba7485217cee5c5c8f48f_JC.exe	cmd.exe
PID 2520 wrote to memory of 2580	2520	cmd.exe	PING.EXE
PID 2520 wrote to memory of 2580	2520	cmd.exe	PING.EXE
PID 2520 wrote to memory of 2580	2520	cmd.exe	PING.EXE
PID 2520 wrote to memory of 2580	2520	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\dfd1856323cba7485217cee5c5c8f48f_JC.exe
"C:\Users\Admin\AppData\Local\Temp\dfd1856323cba7485217cee5c5c8f48f_JC.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe
  C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2988
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\dfd1856323cba7485217cee5c5c8f48f_JC.exe"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:2520
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe

Filesize
92KB

MD5
313c0b139968e79b10582154a80324b3

SHA1
914c6608ee2f09930128f6ad5beb441bee79b27f

SHA256
c269b02302974ec7e2338e4cab8748a118b4617f8a98c1a009adda9d41b1a12a

SHA512
0ca362f8baea2ab9bc15b870a39066e40687e5e6bb31e8a2d7153b16c4b7b3f3840d9cf0ac36cf7e9c0745938d4e656b223f2194e462218a7605ddeb2dcf2467

Download Submit
C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe

Filesize
92KB

MD5
313c0b139968e79b10582154a80324b3

SHA1
914c6608ee2f09930128f6ad5beb441bee79b27f

SHA256
c269b02302974ec7e2338e4cab8748a118b4617f8a98c1a009adda9d41b1a12a

SHA512
0ca362f8baea2ab9bc15b870a39066e40687e5e6bb31e8a2d7153b16c4b7b3f3840d9cf0ac36cf7e9c0745938d4e656b223f2194e462218a7605ddeb2dcf2467

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe

Filesize
92KB

MD5
313c0b139968e79b10582154a80324b3

SHA1
914c6608ee2f09930128f6ad5beb441bee79b27f

SHA256
c269b02302974ec7e2338e4cab8748a118b4617f8a98c1a009adda9d41b1a12a

SHA512
0ca362f8baea2ab9bc15b870a39066e40687e5e6bb31e8a2d7153b16c4b7b3f3840d9cf0ac36cf7e9c0745938d4e656b223f2194e462218a7605ddeb2dcf2467

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe

Filesize
92KB

MD5
313c0b139968e79b10582154a80324b3

SHA1
914c6608ee2f09930128f6ad5beb441bee79b27f

SHA256
c269b02302974ec7e2338e4cab8748a118b4617f8a98c1a009adda9d41b1a12a

SHA512
0ca362f8baea2ab9bc15b870a39066e40687e5e6bb31e8a2d7153b16c4b7b3f3840d9cf0ac36cf7e9c0745938d4e656b223f2194e462218a7605ddeb2dcf2467

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe

Filesize
92KB

MD5
313c0b139968e79b10582154a80324b3

SHA1
914c6608ee2f09930128f6ad5beb441bee79b27f

SHA256
c269b02302974ec7e2338e4cab8748a118b4617f8a98c1a009adda9d41b1a12a

SHA512
0ca362f8baea2ab9bc15b870a39066e40687e5e6bb31e8a2d7153b16c4b7b3f3840d9cf0ac36cf7e9c0745938d4e656b223f2194e462218a7605ddeb2dcf2467

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe

Filesize
92KB

MD5
313c0b139968e79b10582154a80324b3

SHA1
914c6608ee2f09930128f6ad5beb441bee79b27f

SHA256
c269b02302974ec7e2338e4cab8748a118b4617f8a98c1a009adda9d41b1a12a

SHA512
0ca362f8baea2ab9bc15b870a39066e40687e5e6bb31e8a2d7153b16c4b7b3f3840d9cf0ac36cf7e9c0745938d4e656b223f2194e462218a7605ddeb2dcf2467

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads