Malware Analysis Report

2024-11-13 18:44

Sample ID 231013-yg9kqagg73
Target NEAS.1cf23f1a8d357c5e5466acdb7ed4dca0.exe
SHA256 7111f7cdfe1b2b426fd0d98360f19b581896dde6f77997abaf6fededba0c420d
Tags
sakula persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

7111f7cdfe1b2b426fd0d98360f19b581896dde6f77997abaf6fededba0c420d

Threat Level: Known bad

The file NEAS.1cf23f1a8d357c5e5466acdb7ed4dca0.exe was found to be: Known bad.

Malicious Activity Summary

sakula persistence rat trojan

Sakula

Deletes itself

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Unsigned PE

Modifies registry key

Runs ping.exe

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-10-13 19:46

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-10-13 19:46

Reported

2023-10-13 20:30

Platform

win7-20230831-en

Max time kernel

141s

Max time network

159s

Command Line

"C:\Users\Admin\AppData\Local\Temp\NEAS.1cf23f1a8d357c5e5466acdb7ed4dca0.exe"

Signatures

Sakula

trojan rat sakula

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" C:\Windows\SysWOW64\reg.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2692 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.1cf23f1a8d357c5e5466acdb7ed4dca0.exe C:\Windows\SysWOW64\cmd.exe
PID 2692 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.1cf23f1a8d357c5e5466acdb7ed4dca0.exe C:\Windows\SysWOW64\cmd.exe
PID 2692 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.1cf23f1a8d357c5e5466acdb7ed4dca0.exe C:\Windows\SysWOW64\cmd.exe
PID 2692 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.1cf23f1a8d357c5e5466acdb7ed4dca0.exe C:\Windows\SysWOW64\cmd.exe
PID 2692 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.1cf23f1a8d357c5e5466acdb7ed4dca0.exe C:\Windows\SysWOW64\cmd.exe
PID 2692 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.1cf23f1a8d357c5e5466acdb7ed4dca0.exe C:\Windows\SysWOW64\cmd.exe
PID 2692 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.1cf23f1a8d357c5e5466acdb7ed4dca0.exe C:\Windows\SysWOW64\cmd.exe
PID 2692 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.1cf23f1a8d357c5e5466acdb7ed4dca0.exe C:\Windows\SysWOW64\cmd.exe
PID 2692 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.1cf23f1a8d357c5e5466acdb7ed4dca0.exe C:\Windows\SysWOW64\cmd.exe
PID 2692 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.1cf23f1a8d357c5e5466acdb7ed4dca0.exe C:\Windows\SysWOW64\cmd.exe
PID 2692 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.1cf23f1a8d357c5e5466acdb7ed4dca0.exe C:\Windows\SysWOW64\cmd.exe
PID 2692 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.1cf23f1a8d357c5e5466acdb7ed4dca0.exe C:\Windows\SysWOW64\cmd.exe
PID 3068 wrote to memory of 2652 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 3068 wrote to memory of 2652 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 3068 wrote to memory of 2652 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 3068 wrote to memory of 2652 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 2368 wrote to memory of 1720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2368 wrote to memory of 1720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2368 wrote to memory of 1720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2368 wrote to memory of 1720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2704 wrote to memory of 2624 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2704 wrote to memory of 2624 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2704 wrote to memory of 2624 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2704 wrote to memory of 2624 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\NEAS.1cf23f1a8d357c5e5466acdb7ed4dca0.exe

"C:\Users\Admin\AppData\Local\Temp\NEAS.1cf23f1a8d357c5e5466acdb7ed4dca0.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\NEAS.1cf23f1a8d357c5e5466acdb7ed4dca0.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Windows\SysWOW64\reg.exe

reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1

Network

Country Destination Domain Proto
US 8.8.8.8:53 vpn.premrera.com udp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp

Files

memory/2692-0-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2692-2-0x0000000000400000-0x0000000000409000-memory.dmp

\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 0b0eb4435d189829761fb935d047051d
SHA1 f42707bb6b9687f5b2172a50bbe325bfcd1156b0
SHA256 06588a9b1df750f826df0decf1584f2d3596acc21b125390ec473e986b6c3be5
SHA512 69e21955f2517121b2c3a939eb82020d109e552e148f764b1fab27d9f158a82a867b387a4ec3ceb1b30ccbf869feec7794f1ae7616ff662a88467bfb578f7701

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 0b0eb4435d189829761fb935d047051d
SHA1 f42707bb6b9687f5b2172a50bbe325bfcd1156b0
SHA256 06588a9b1df750f826df0decf1584f2d3596acc21b125390ec473e986b6c3be5
SHA512 69e21955f2517121b2c3a939eb82020d109e552e148f764b1fab27d9f158a82a867b387a4ec3ceb1b30ccbf869feec7794f1ae7616ff662a88467bfb578f7701

\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 0b0eb4435d189829761fb935d047051d
SHA1 f42707bb6b9687f5b2172a50bbe325bfcd1156b0
SHA256 06588a9b1df750f826df0decf1584f2d3596acc21b125390ec473e986b6c3be5
SHA512 69e21955f2517121b2c3a939eb82020d109e552e148f764b1fab27d9f158a82a867b387a4ec3ceb1b30ccbf869feec7794f1ae7616ff662a88467bfb578f7701

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 0b0eb4435d189829761fb935d047051d
SHA1 f42707bb6b9687f5b2172a50bbe325bfcd1156b0
SHA256 06588a9b1df750f826df0decf1584f2d3596acc21b125390ec473e986b6c3be5
SHA512 69e21955f2517121b2c3a939eb82020d109e552e148f764b1fab27d9f158a82a867b387a4ec3ceb1b30ccbf869feec7794f1ae7616ff662a88467bfb578f7701

Analysis: behavioral2

Detonation Overview

Submitted

2023-10-13 19:46

Reported

2023-10-13 20:31

Platform

win10v2004-20230915-en

Max time kernel

155s

Max time network

163s

Command Line

"C:\Users\Admin\AppData\Local\Temp\NEAS.1cf23f1a8d357c5e5466acdb7ed4dca0.exe"

Signatures

Sakula

trojan rat sakula

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" C:\Windows\SysWOW64\reg.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2640 wrote to memory of 3956 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.1cf23f1a8d357c5e5466acdb7ed4dca0.exe C:\Windows\SysWOW64\cmd.exe
PID 2640 wrote to memory of 3956 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.1cf23f1a8d357c5e5466acdb7ed4dca0.exe C:\Windows\SysWOW64\cmd.exe
PID 2640 wrote to memory of 3956 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.1cf23f1a8d357c5e5466acdb7ed4dca0.exe C:\Windows\SysWOW64\cmd.exe
PID 2640 wrote to memory of 4844 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.1cf23f1a8d357c5e5466acdb7ed4dca0.exe C:\Windows\SysWOW64\cmd.exe
PID 2640 wrote to memory of 4844 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.1cf23f1a8d357c5e5466acdb7ed4dca0.exe C:\Windows\SysWOW64\cmd.exe
PID 2640 wrote to memory of 4844 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.1cf23f1a8d357c5e5466acdb7ed4dca0.exe C:\Windows\SysWOW64\cmd.exe
PID 2640 wrote to memory of 4040 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.1cf23f1a8d357c5e5466acdb7ed4dca0.exe C:\Windows\SysWOW64\cmd.exe
PID 2640 wrote to memory of 4040 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.1cf23f1a8d357c5e5466acdb7ed4dca0.exe C:\Windows\SysWOW64\cmd.exe
PID 2640 wrote to memory of 4040 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.1cf23f1a8d357c5e5466acdb7ed4dca0.exe C:\Windows\SysWOW64\cmd.exe
PID 4844 wrote to memory of 2416 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 4844 wrote to memory of 2416 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 4844 wrote to memory of 2416 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 3956 wrote to memory of 1196 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3956 wrote to memory of 1196 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3956 wrote to memory of 1196 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4040 wrote to memory of 3572 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4040 wrote to memory of 3572 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4040 wrote to memory of 3572 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\NEAS.1cf23f1a8d357c5e5466acdb7ed4dca0.exe

"C:\Users\Admin\AppData\Local\Temp\NEAS.1cf23f1a8d357c5e5466acdb7ed4dca0.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\NEAS.1cf23f1a8d357c5e5466acdb7ed4dca0.exe"

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Windows\SysWOW64\reg.exe

reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1

Network

Country Destination Domain Proto
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 240.81.21.72.in-addr.arpa udp
US 8.8.8.8:53 vpn.premrera.com udp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 8.8.8.8:53 27.197.91.208.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 8.3.197.209.in-addr.arpa udp
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 38.148.119.40.in-addr.arpa udp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 208.91.197.27:443 vpn.premrera.com tcp
US 8.8.8.8:53 13.173.189.20.in-addr.arpa udp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp

Files

memory/2640-0-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2640-2-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 31c36ac08fdf8f980b8059bd34c2550d
SHA1 ac62cd3af80b5023caf87a1a21e2809be85b12c6
SHA256 a5fbcc54fc8402fb47cc10cd0166dd8f10654d98265e12a6daf964460cddb8b6
SHA512 3d9df91c063fbb714487dfb58fe38898e0ba5f577880fdb9ec82b0d07bd2d5b3223ca70e7a26df97f505c7ea1dbfd667b91d7ccbbf8477d400c480044d013555

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 31c36ac08fdf8f980b8059bd34c2550d
SHA1 ac62cd3af80b5023caf87a1a21e2809be85b12c6
SHA256 a5fbcc54fc8402fb47cc10cd0166dd8f10654d98265e12a6daf964460cddb8b6
SHA512 3d9df91c063fbb714487dfb58fe38898e0ba5f577880fdb9ec82b0d07bd2d5b3223ca70e7a26df97f505c7ea1dbfd667b91d7ccbbf8477d400c480044d013555