Malware Analysis Report

2024-11-13 18:44

Sample ID 231015-yjvjksac42
Target e8c9b7f59a3a01397d9e5a7be24aba70_exe32.exe
SHA256 bdca0c7f1c605c0c7276aace42c629d34351a3a96bc1e6f92143a574d7056448
Tags
sakula persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

bdca0c7f1c605c0c7276aace42c629d34351a3a96bc1e6f92143a574d7056448

Threat Level: Known bad

The file e8c9b7f59a3a01397d9e5a7be24aba70_exe32.exe was found to be: Known bad.

Malicious Activity Summary

sakula persistence rat trojan

Sakula

Deletes itself

Loads dropped DLL

Executes dropped EXE

Adds Run key to start application

Unsigned PE

Modifies registry key

Runs ping.exe

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-10-15 19:49

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-10-15 19:49

Reported

2023-10-16 01:41

Platform

win7-20230831-en

Max time kernel

142s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e8c9b7f59a3a01397d9e5a7be24aba70_exe32.exe"

Signatures

Sakula

trojan rat sakula

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" C:\Windows\SysWOW64\reg.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2124 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\e8c9b7f59a3a01397d9e5a7be24aba70_exe32.exe C:\Windows\SysWOW64\cmd.exe
PID 2124 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\e8c9b7f59a3a01397d9e5a7be24aba70_exe32.exe C:\Windows\SysWOW64\cmd.exe
PID 2124 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\e8c9b7f59a3a01397d9e5a7be24aba70_exe32.exe C:\Windows\SysWOW64\cmd.exe
PID 2124 wrote to memory of 2640 N/A C:\Users\Admin\AppData\Local\Temp\e8c9b7f59a3a01397d9e5a7be24aba70_exe32.exe C:\Windows\SysWOW64\cmd.exe
PID 2124 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\e8c9b7f59a3a01397d9e5a7be24aba70_exe32.exe C:\Windows\SysWOW64\cmd.exe
PID 2124 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\e8c9b7f59a3a01397d9e5a7be24aba70_exe32.exe C:\Windows\SysWOW64\cmd.exe
PID 2124 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\e8c9b7f59a3a01397d9e5a7be24aba70_exe32.exe C:\Windows\SysWOW64\cmd.exe
PID 2124 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\e8c9b7f59a3a01397d9e5a7be24aba70_exe32.exe C:\Windows\SysWOW64\cmd.exe
PID 2124 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\e8c9b7f59a3a01397d9e5a7be24aba70_exe32.exe C:\Windows\SysWOW64\cmd.exe
PID 2124 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\e8c9b7f59a3a01397d9e5a7be24aba70_exe32.exe C:\Windows\SysWOW64\cmd.exe
PID 2124 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\e8c9b7f59a3a01397d9e5a7be24aba70_exe32.exe C:\Windows\SysWOW64\cmd.exe
PID 2124 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\e8c9b7f59a3a01397d9e5a7be24aba70_exe32.exe C:\Windows\SysWOW64\cmd.exe
PID 2096 wrote to memory of 2704 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 2096 wrote to memory of 2704 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 2096 wrote to memory of 2704 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 2096 wrote to memory of 2704 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 2956 wrote to memory of 2580 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2956 wrote to memory of 2580 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2956 wrote to memory of 2580 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2956 wrote to memory of 2580 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2640 wrote to memory of 2812 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2640 wrote to memory of 2812 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2640 wrote to memory of 2812 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2640 wrote to memory of 2812 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\e8c9b7f59a3a01397d9e5a7be24aba70_exe32.exe

"C:\Users\Admin\AppData\Local\Temp\e8c9b7f59a3a01397d9e5a7be24aba70_exe32.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\e8c9b7f59a3a01397d9e5a7be24aba70_exe32.exe"

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1

C:\Windows\SysWOW64\reg.exe

reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 vpn.premrera.com udp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp

Files

memory/2124-0-0x0000000000400000-0x000000000040B000-memory.dmp

memory/2124-1-0x0000000000400000-0x000000000040B000-memory.dmp

memory/2124-3-0x0000000000400000-0x000000000040B000-memory.dmp

\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 883951d65fa1f12b3c90532aa9ef7559
SHA1 6220f46ec93752e98a3f4963c38362347f309625
SHA256 802eb58b93f000b19fab6f4283b5cfdbe9a7fd802536972931ad45004aae1b80
SHA512 86b7fc6af4998e86705b2e8d21f6d1ef5e8bb914f6cb911effed464880cf929555a90abd395240b770cb4fe90228523f00d7832348be9bdf962bbfe30d203a7d

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 883951d65fa1f12b3c90532aa9ef7559
SHA1 6220f46ec93752e98a3f4963c38362347f309625
SHA256 802eb58b93f000b19fab6f4283b5cfdbe9a7fd802536972931ad45004aae1b80
SHA512 86b7fc6af4998e86705b2e8d21f6d1ef5e8bb914f6cb911effed464880cf929555a90abd395240b770cb4fe90228523f00d7832348be9bdf962bbfe30d203a7d

\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 883951d65fa1f12b3c90532aa9ef7559
SHA1 6220f46ec93752e98a3f4963c38362347f309625
SHA256 802eb58b93f000b19fab6f4283b5cfdbe9a7fd802536972931ad45004aae1b80
SHA512 86b7fc6af4998e86705b2e8d21f6d1ef5e8bb914f6cb911effed464880cf929555a90abd395240b770cb4fe90228523f00d7832348be9bdf962bbfe30d203a7d

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 883951d65fa1f12b3c90532aa9ef7559
SHA1 6220f46ec93752e98a3f4963c38362347f309625
SHA256 802eb58b93f000b19fab6f4283b5cfdbe9a7fd802536972931ad45004aae1b80
SHA512 86b7fc6af4998e86705b2e8d21f6d1ef5e8bb914f6cb911effed464880cf929555a90abd395240b770cb4fe90228523f00d7832348be9bdf962bbfe30d203a7d

Analysis: behavioral2

Detonation Overview

Submitted

2023-10-15 19:49

Reported

2023-10-16 01:41

Platform

win10v2004-20230915-en

Max time kernel

141s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e8c9b7f59a3a01397d9e5a7be24aba70_exe32.exe"

Signatures

Sakula

trojan rat sakula

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" C:\Windows\SysWOW64\reg.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1760 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\e8c9b7f59a3a01397d9e5a7be24aba70_exe32.exe C:\Windows\SysWOW64\cmd.exe
PID 1760 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\e8c9b7f59a3a01397d9e5a7be24aba70_exe32.exe C:\Windows\SysWOW64\cmd.exe
PID 1760 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\e8c9b7f59a3a01397d9e5a7be24aba70_exe32.exe C:\Windows\SysWOW64\cmd.exe
PID 1760 wrote to memory of 4892 N/A C:\Users\Admin\AppData\Local\Temp\e8c9b7f59a3a01397d9e5a7be24aba70_exe32.exe C:\Windows\SysWOW64\cmd.exe
PID 1760 wrote to memory of 4892 N/A C:\Users\Admin\AppData\Local\Temp\e8c9b7f59a3a01397d9e5a7be24aba70_exe32.exe C:\Windows\SysWOW64\cmd.exe
PID 1760 wrote to memory of 4892 N/A C:\Users\Admin\AppData\Local\Temp\e8c9b7f59a3a01397d9e5a7be24aba70_exe32.exe C:\Windows\SysWOW64\cmd.exe
PID 1760 wrote to memory of 3804 N/A C:\Users\Admin\AppData\Local\Temp\e8c9b7f59a3a01397d9e5a7be24aba70_exe32.exe C:\Windows\SysWOW64\cmd.exe
PID 1760 wrote to memory of 3804 N/A C:\Users\Admin\AppData\Local\Temp\e8c9b7f59a3a01397d9e5a7be24aba70_exe32.exe C:\Windows\SysWOW64\cmd.exe
PID 1760 wrote to memory of 3804 N/A C:\Users\Admin\AppData\Local\Temp\e8c9b7f59a3a01397d9e5a7be24aba70_exe32.exe C:\Windows\SysWOW64\cmd.exe
PID 3804 wrote to memory of 4396 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 3804 wrote to memory of 4396 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 3804 wrote to memory of 4396 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4376 wrote to memory of 1100 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4376 wrote to memory of 1100 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4376 wrote to memory of 1100 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4892 wrote to memory of 2680 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 4892 wrote to memory of 2680 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 4892 wrote to memory of 2680 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

Processes

C:\Users\Admin\AppData\Local\Temp\e8c9b7f59a3a01397d9e5a7be24aba70_exe32.exe

"C:\Users\Admin\AppData\Local\Temp\e8c9b7f59a3a01397d9e5a7be24aba70_exe32.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\e8c9b7f59a3a01397d9e5a7be24aba70_exe32.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Windows\SysWOW64\reg.exe

reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 vpn.premrera.com udp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 8.8.8.8:53 27.197.91.208.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 1.208.79.178.in-addr.arpa udp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp

Files

memory/1760-0-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1760-1-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1760-3-0x0000000000400000-0x000000000040B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 48941d7f9ecdaff4cac38744c5963729
SHA1 81b197bc674aa67c3eef95807f2ba9e10a91a8f1
SHA256 37d279b569e4e6ef6aa0e8d9392b9a3be97a1505c6004bf8bcb57f69810a57b5
SHA512 62d0321ac0d7ef310062cb26b2a4a629711223c2176b1a41f1bd0b70478c68c7074512c8cfbea923d54fdc1ede06c42104a6e40d7bf409ea4896391022d6ea61

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 48941d7f9ecdaff4cac38744c5963729
SHA1 81b197bc674aa67c3eef95807f2ba9e10a91a8f1
SHA256 37d279b569e4e6ef6aa0e8d9392b9a3be97a1505c6004bf8bcb57f69810a57b5
SHA512 62d0321ac0d7ef310062cb26b2a4a629711223c2176b1a41f1bd0b70478c68c7074512c8cfbea923d54fdc1ede06c42104a6e40d7bf409ea4896391022d6ea61