Malware Analysis Report

2024-11-13 18:44

Sample ID 231016-wwsveabg71
Target NEAS.31aa06702e3563d705d5f9f20a96bae0.exe
SHA256 f988e1706878a2e93a7331ad1ec76c43fef3f9320d8c5795834e4717dcbeb2ef
Tags
sakula persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f988e1706878a2e93a7331ad1ec76c43fef3f9320d8c5795834e4717dcbeb2ef

Threat Level: Known bad

The file NEAS.31aa06702e3563d705d5f9f20a96bae0.exe was found to be: Known bad.

Malicious Activity Summary

sakula persistence rat trojan

Sakula

Executes dropped EXE

Deletes itself

Loads dropped DLL

Adds Run key to start application

Unsigned PE

Runs ping.exe

Modifies registry key

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-10-16 18:16

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-10-16 18:16

Reported

2023-10-16 18:55

Platform

win7-20230831-en

Max time kernel

145s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\NEAS.31aa06702e3563d705d5f9f20a96bae0.exe"

Signatures

Sakula

trojan rat sakula

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" C:\Windows\SysWOW64\reg.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3040 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.31aa06702e3563d705d5f9f20a96bae0.exe C:\Windows\SysWOW64\cmd.exe
PID 3040 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.31aa06702e3563d705d5f9f20a96bae0.exe C:\Windows\SysWOW64\cmd.exe
PID 3040 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.31aa06702e3563d705d5f9f20a96bae0.exe C:\Windows\SysWOW64\cmd.exe
PID 3040 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.31aa06702e3563d705d5f9f20a96bae0.exe C:\Windows\SysWOW64\cmd.exe
PID 3040 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.31aa06702e3563d705d5f9f20a96bae0.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 3040 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.31aa06702e3563d705d5f9f20a96bae0.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 3040 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.31aa06702e3563d705d5f9f20a96bae0.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 3040 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.31aa06702e3563d705d5f9f20a96bae0.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 2480 wrote to memory of 2496 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2480 wrote to memory of 2496 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2480 wrote to memory of 2496 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2480 wrote to memory of 2496 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3040 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.31aa06702e3563d705d5f9f20a96bae0.exe C:\Windows\SysWOW64\cmd.exe
PID 3040 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.31aa06702e3563d705d5f9f20a96bae0.exe C:\Windows\SysWOW64\cmd.exe
PID 3040 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.31aa06702e3563d705d5f9f20a96bae0.exe C:\Windows\SysWOW64\cmd.exe
PID 3040 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.31aa06702e3563d705d5f9f20a96bae0.exe C:\Windows\SysWOW64\cmd.exe
PID 2832 wrote to memory of 2740 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2832 wrote to memory of 2740 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2832 wrote to memory of 2740 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2832 wrote to memory of 2740 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\NEAS.31aa06702e3563d705d5f9f20a96bae0.exe

"C:\Users\Admin\AppData\Local\Temp\NEAS.31aa06702e3563d705d5f9f20a96bae0.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Windows\SysWOW64\reg.exe

reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\NEAS.31aa06702e3563d705d5f9f20a96bae0.exe"

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.we11point.com udp

Files

memory/3040-0-0x0000000000400000-0x0000000000408000-memory.dmp

\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 b0c679b003a0dff9fc6fc64cf5551441
SHA1 cb3c05e8f8eed3b180bba55550a555ee0ac050ca
SHA256 30e496ce105d61f723f48bc9a183f6c689b1a42ec3e063523ca855cdba3268b8
SHA512 6c85eedded9ac15868936125f571fc9084b93e7327f4e8bc8139f8d9050fbaf4b3a0957f9e8a2f0a9ca1da17c6ea7605a19e1295ca58756fb64c3701ac31fd51

\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 b0c679b003a0dff9fc6fc64cf5551441
SHA1 cb3c05e8f8eed3b180bba55550a555ee0ac050ca
SHA256 30e496ce105d61f723f48bc9a183f6c689b1a42ec3e063523ca855cdba3268b8
SHA512 6c85eedded9ac15868936125f571fc9084b93e7327f4e8bc8139f8d9050fbaf4b3a0957f9e8a2f0a9ca1da17c6ea7605a19e1295ca58756fb64c3701ac31fd51

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 b0c679b003a0dff9fc6fc64cf5551441
SHA1 cb3c05e8f8eed3b180bba55550a555ee0ac050ca
SHA256 30e496ce105d61f723f48bc9a183f6c689b1a42ec3e063523ca855cdba3268b8
SHA512 6c85eedded9ac15868936125f571fc9084b93e7327f4e8bc8139f8d9050fbaf4b3a0957f9e8a2f0a9ca1da17c6ea7605a19e1295ca58756fb64c3701ac31fd51

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 b0c679b003a0dff9fc6fc64cf5551441
SHA1 cb3c05e8f8eed3b180bba55550a555ee0ac050ca
SHA256 30e496ce105d61f723f48bc9a183f6c689b1a42ec3e063523ca855cdba3268b8
SHA512 6c85eedded9ac15868936125f571fc9084b93e7327f4e8bc8139f8d9050fbaf4b3a0957f9e8a2f0a9ca1da17c6ea7605a19e1295ca58756fb64c3701ac31fd51

memory/3040-9-0x0000000000400000-0x0000000000408000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-10-16 18:16

Reported

2023-10-16 18:55

Platform

win10v2004-20230915-en

Max time kernel

147s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\NEAS.31aa06702e3563d705d5f9f20a96bae0.exe"

Signatures

Sakula

trojan rat sakula

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" C:\Windows\SysWOW64\reg.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4244 wrote to memory of 4892 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.31aa06702e3563d705d5f9f20a96bae0.exe C:\Windows\SysWOW64\cmd.exe
PID 4244 wrote to memory of 4892 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.31aa06702e3563d705d5f9f20a96bae0.exe C:\Windows\SysWOW64\cmd.exe
PID 4244 wrote to memory of 4892 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.31aa06702e3563d705d5f9f20a96bae0.exe C:\Windows\SysWOW64\cmd.exe
PID 4244 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.31aa06702e3563d705d5f9f20a96bae0.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 4244 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.31aa06702e3563d705d5f9f20a96bae0.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 4244 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.31aa06702e3563d705d5f9f20a96bae0.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 4892 wrote to memory of 4948 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4892 wrote to memory of 4948 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4892 wrote to memory of 4948 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4244 wrote to memory of 3460 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.31aa06702e3563d705d5f9f20a96bae0.exe C:\Windows\SysWOW64\cmd.exe
PID 4244 wrote to memory of 3460 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.31aa06702e3563d705d5f9f20a96bae0.exe C:\Windows\SysWOW64\cmd.exe
PID 4244 wrote to memory of 3460 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.31aa06702e3563d705d5f9f20a96bae0.exe C:\Windows\SysWOW64\cmd.exe
PID 3460 wrote to memory of 2132 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 3460 wrote to memory of 2132 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 3460 wrote to memory of 2132 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\NEAS.31aa06702e3563d705d5f9f20a96bae0.exe

"C:\Users\Admin\AppData\Local\Temp\NEAS.31aa06702e3563d705d5f9f20a96bae0.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Windows\SysWOW64\reg.exe

reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\NEAS.31aa06702e3563d705d5f9f20a96bae0.exe"

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1

Network

Country Destination Domain Proto
US 8.8.8.8:53 146.78.124.51.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 9.57.101.20.in-addr.arpa udp
US 8.8.8.8:53 www.we11point.com udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 www.we11point.com udp
US 8.8.8.8:53 www.we11point.com udp
US 8.8.8.8:53 www.we11point.com udp
US 8.8.8.8:53 10.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 www.we11point.com udp

Files

memory/4244-0-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 035790c5b0c2e161504cf584e6c6cf99
SHA1 d2a8b29af9b5b4b7cc4b0783812a6127e9dbfe2a
SHA256 bcf249397d40080849cf1a4bbbcf4fd05b8b6a6194aab612b155f9cc5e03e66f
SHA512 48bb111fc432fec0606bf92280e5bdf229757942e667f8e3335c9d2c8d674e56d9ce981f94764e5f374bcb0078063a87b9e1519898b1dc3d7725505623d39b7e

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 035790c5b0c2e161504cf584e6c6cf99
SHA1 d2a8b29af9b5b4b7cc4b0783812a6127e9dbfe2a
SHA256 bcf249397d40080849cf1a4bbbcf4fd05b8b6a6194aab612b155f9cc5e03e66f
SHA512 48bb111fc432fec0606bf92280e5bdf229757942e667f8e3335c9d2c8d674e56d9ce981f94764e5f374bcb0078063a87b9e1519898b1dc3d7725505623d39b7e

memory/4348-5-0x0000000000400000-0x0000000000408000-memory.dmp

memory/4244-6-0x0000000000400000-0x0000000000408000-memory.dmp