Malware Analysis Report

2024-11-13 18:44

Sample ID 231016-wyr1wsda3y
Target NEAS.4b55f3df2821daf0e027191ee5d28460.exe
SHA256 475930304ddec613ea123921dbabe479adeb1f66f44b7e1799c54518c998be6c
Tags
sakula persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

475930304ddec613ea123921dbabe479adeb1f66f44b7e1799c54518c998be6c

Threat Level: Known bad

The file NEAS.4b55f3df2821daf0e027191ee5d28460.exe was found to be: Known bad.

Malicious Activity Summary

sakula persistence rat trojan

Sakula

Loads dropped DLL

Deletes itself

Executes dropped EXE

Adds Run key to start application

Unsigned PE

Modifies registry key

Runs ping.exe

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-10-16 18:20

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-10-16 18:20

Reported

2023-10-16 20:36

Platform

win7-20230831-en

Max time kernel

147s

Max time network

167s

Command Line

"C:\Users\Admin\AppData\Local\Temp\NEAS.4b55f3df2821daf0e027191ee5d28460.exe"

Signatures

Sakula

trojan rat sakula

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" C:\Windows\SysWOW64\reg.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2176 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.4b55f3df2821daf0e027191ee5d28460.exe C:\Windows\SysWOW64\cmd.exe
PID 2176 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.4b55f3df2821daf0e027191ee5d28460.exe C:\Windows\SysWOW64\cmd.exe
PID 2176 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.4b55f3df2821daf0e027191ee5d28460.exe C:\Windows\SysWOW64\cmd.exe
PID 2176 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.4b55f3df2821daf0e027191ee5d28460.exe C:\Windows\SysWOW64\cmd.exe
PID 2176 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.4b55f3df2821daf0e027191ee5d28460.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 2176 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.4b55f3df2821daf0e027191ee5d28460.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 2176 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.4b55f3df2821daf0e027191ee5d28460.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 2176 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.4b55f3df2821daf0e027191ee5d28460.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 2832 wrote to memory of 2692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2832 wrote to memory of 2692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2832 wrote to memory of 2692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2832 wrote to memory of 2692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2176 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.4b55f3df2821daf0e027191ee5d28460.exe C:\Windows\SysWOW64\cmd.exe
PID 2176 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.4b55f3df2821daf0e027191ee5d28460.exe C:\Windows\SysWOW64\cmd.exe
PID 2176 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.4b55f3df2821daf0e027191ee5d28460.exe C:\Windows\SysWOW64\cmd.exe
PID 2176 wrote to memory of 3028 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.4b55f3df2821daf0e027191ee5d28460.exe C:\Windows\SysWOW64\cmd.exe
PID 3028 wrote to memory of 2484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 3028 wrote to memory of 2484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 3028 wrote to memory of 2484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 3028 wrote to memory of 2484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\NEAS.4b55f3df2821daf0e027191ee5d28460.exe

"C:\Users\Admin\AppData\Local\Temp\NEAS.4b55f3df2821daf0e027191ee5d28460.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Windows\SysWOW64\reg.exe

reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\NEAS.4b55f3df2821daf0e027191ee5d28460.exe"

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.we11point.com udp

Files

memory/2176-0-0x0000000000400000-0x000000000040A000-memory.dmp

memory/2176-1-0x0000000000400000-0x000000000040A000-memory.dmp

\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 4002c9ef9e4253766ca69d641228fc94
SHA1 27bffc4911d448e0ebc714091edbf89c287c71a1
SHA256 cfe2ab1e0c9b7f2d37172801d5c244901c6ec0f3c3f47a764e82381ab12a5716
SHA512 6f4103ff1031fd7e1ea413735ab1be50cad5c4d7fc2d03a112e9066200bd652b16bf4833b83e904437361fc1cf3749c07c7b0b08e7cd0aa292a5e5936bd8cab4

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 4002c9ef9e4253766ca69d641228fc94
SHA1 27bffc4911d448e0ebc714091edbf89c287c71a1
SHA256 cfe2ab1e0c9b7f2d37172801d5c244901c6ec0f3c3f47a764e82381ab12a5716
SHA512 6f4103ff1031fd7e1ea413735ab1be50cad5c4d7fc2d03a112e9066200bd652b16bf4833b83e904437361fc1cf3749c07c7b0b08e7cd0aa292a5e5936bd8cab4

memory/2176-10-0x0000000000220000-0x000000000022A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 4002c9ef9e4253766ca69d641228fc94
SHA1 27bffc4911d448e0ebc714091edbf89c287c71a1
SHA256 cfe2ab1e0c9b7f2d37172801d5c244901c6ec0f3c3f47a764e82381ab12a5716
SHA512 6f4103ff1031fd7e1ea413735ab1be50cad5c4d7fc2d03a112e9066200bd652b16bf4833b83e904437361fc1cf3749c07c7b0b08e7cd0aa292a5e5936bd8cab4

\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 4002c9ef9e4253766ca69d641228fc94
SHA1 27bffc4911d448e0ebc714091edbf89c287c71a1
SHA256 cfe2ab1e0c9b7f2d37172801d5c244901c6ec0f3c3f47a764e82381ab12a5716
SHA512 6f4103ff1031fd7e1ea413735ab1be50cad5c4d7fc2d03a112e9066200bd652b16bf4833b83e904437361fc1cf3749c07c7b0b08e7cd0aa292a5e5936bd8cab4

memory/2120-11-0x0000000000400000-0x000000000040A000-memory.dmp

memory/2176-12-0x0000000000400000-0x000000000040A000-memory.dmp

memory/2176-13-0x0000000000220000-0x000000000022A000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-10-16 18:20

Reported

2023-10-16 20:36

Platform

win10v2004-20230915-en

Max time kernel

143s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\NEAS.4b55f3df2821daf0e027191ee5d28460.exe"

Signatures

Sakula

trojan rat sakula

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" C:\Windows\SysWOW64\reg.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2508 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.4b55f3df2821daf0e027191ee5d28460.exe C:\Windows\SysWOW64\cmd.exe
PID 2508 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.4b55f3df2821daf0e027191ee5d28460.exe C:\Windows\SysWOW64\cmd.exe
PID 2508 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.4b55f3df2821daf0e027191ee5d28460.exe C:\Windows\SysWOW64\cmd.exe
PID 2508 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.4b55f3df2821daf0e027191ee5d28460.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 2508 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.4b55f3df2821daf0e027191ee5d28460.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 2508 wrote to memory of 2032 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.4b55f3df2821daf0e027191ee5d28460.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 1968 wrote to memory of 1976 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1968 wrote to memory of 1976 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1968 wrote to memory of 1976 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2508 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.4b55f3df2821daf0e027191ee5d28460.exe C:\Windows\SysWOW64\cmd.exe
PID 2508 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.4b55f3df2821daf0e027191ee5d28460.exe C:\Windows\SysWOW64\cmd.exe
PID 2508 wrote to memory of 4764 N/A C:\Users\Admin\AppData\Local\Temp\NEAS.4b55f3df2821daf0e027191ee5d28460.exe C:\Windows\SysWOW64\cmd.exe
PID 4764 wrote to memory of 2720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4764 wrote to memory of 2720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4764 wrote to memory of 2720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\NEAS.4b55f3df2821daf0e027191ee5d28460.exe

"C:\Users\Admin\AppData\Local\Temp\NEAS.4b55f3df2821daf0e027191ee5d28460.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Windows\SysWOW64\reg.exe

reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\NEAS.4b55f3df2821daf0e027191ee5d28460.exe"

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1

Network

Country Destination Domain Proto
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 www.we11point.com udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 254.20.238.8.in-addr.arpa udp
US 8.8.8.8:53 www.we11point.com udp
US 8.8.8.8:53 1.202.248.87.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 www.we11point.com udp
US 8.8.8.8:53 www.we11point.com udp
US 8.8.8.8:53 90.16.208.104.in-addr.arpa udp

Files

memory/2508-0-0x0000000000400000-0x000000000040A000-memory.dmp

memory/2508-1-0x0000000000400000-0x000000000040A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 1e3e627f04f9f7d7b65727e8c31de62a
SHA1 9792867b29b1465ea37b959c64777145ac639670
SHA256 c3c77c2b16aa029f07694165e6b92d59df9af2013172ac66f278b96b9bc61f69
SHA512 65d41afef2527705512f637395b05e1d02cff26351cb88580c6a7201f340943f0ac0223ce5fd17065656fb4e2bf07d704f323fe25631b7f234d0937bcd8ce805

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 1e3e627f04f9f7d7b65727e8c31de62a
SHA1 9792867b29b1465ea37b959c64777145ac639670
SHA256 c3c77c2b16aa029f07694165e6b92d59df9af2013172ac66f278b96b9bc61f69
SHA512 65d41afef2527705512f637395b05e1d02cff26351cb88580c6a7201f340943f0ac0223ce5fd17065656fb4e2bf07d704f323fe25631b7f234d0937bcd8ce805

memory/2508-6-0x0000000000400000-0x000000000040A000-memory.dmp