sakula | 82bb4fe580e2d7ece683c8d0fc74f2968f029c75e685eb5181bc81fdbb576039

General

Target
NEAS.3004e60797cdd74b27819ffb5ffef2b0_JC.exe
Size 71KB
Sample231017-1qtxqsba25
SHA256 82bb4fe580e2d7ece683c8d0fc74f2968f029c75e685eb5181bc81fdbb576039
MD5 3004e60797cdd74b27819ffb5ffef2b0
SHA1 8c2fd283c7bf498efd3c20bf4cc224648d7dcb52
SHA512 49bff79d90a1f766a07617111cd164caef4714fa5e012480e0b653b6a4b02e9f4ebca4ca782c27d84c0017fbc20f5f263a439de8c0d35935ab1addd60d3932d2
SSDEEP 768:bhSksandb4GgyMsp4hyYtoVxYGm1ZAe0oAGo:bTsGpehyYtkYvnr0o9o
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sakula persistence rat trojan

Malware Config

Extracted

Family

sakula

C2

http://vpn.premrera.com:443/viewpre.asp?cstring=%s&tom=%d&id=%d
http://vpn.premrera.com:443/photo/%s.jpg?id=%d
http://173.254.226.212:443/viewpre.asp?cstring=%s&tom=%d&id=%d
http://173.254.226.212:443/photo/%s.jpg?id=%d

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Executes dropped EXE 1 IoCs

pid	Process
4148	MediaCenter.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	reg.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
4316	reg.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1876	PING.EXE

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 3052	3036	NEAS.3004e60797cdd74b27819ffb5ffef2b0_JC.exe	89
PID 3036 wrote to memory of 3052	3036	NEAS.3004e60797cdd74b27819ffb5ffef2b0_JC.exe	89
PID 3036 wrote to memory of 3052	3036	NEAS.3004e60797cdd74b27819ffb5ffef2b0_JC.exe	89
PID 3036 wrote to memory of 2204	3036	NEAS.3004e60797cdd74b27819ffb5ffef2b0_JC.exe	90
PID 3036 wrote to memory of 2204	3036	NEAS.3004e60797cdd74b27819ffb5ffef2b0_JC.exe	90
PID 3036 wrote to memory of 2204	3036	NEAS.3004e60797cdd74b27819ffb5ffef2b0_JC.exe	90
PID 3036 wrote to memory of 3572	3036	NEAS.3004e60797cdd74b27819ffb5ffef2b0_JC.exe	91
PID 3036 wrote to memory of 3572	3036	NEAS.3004e60797cdd74b27819ffb5ffef2b0_JC.exe	91
PID 3036 wrote to memory of 3572	3036	NEAS.3004e60797cdd74b27819ffb5ffef2b0_JC.exe	91
PID 3052 wrote to memory of 4316	3052	cmd.exe	95
PID 3052 wrote to memory of 4316	3052	cmd.exe	95
PID 3052 wrote to memory of 4316	3052	cmd.exe	95
PID 3572 wrote to memory of 1876	3572	cmd.exe	97
PID 3572 wrote to memory of 1876	3572	cmd.exe	97
PID 3572 wrote to memory of 1876	3572	cmd.exe	97
PID 2204 wrote to memory of 4148	2204	cmd.exe	96
PID 2204 wrote to memory of 4148	2204	cmd.exe	96
PID 2204 wrote to memory of 4148	2204	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\NEAS.3004e60797cdd74b27819ffb5ffef2b0_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.3004e60797cdd74b27819ffb5ffef2b0_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3052
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:4316
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2204
- - C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
    C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
    3⤵
    - Executes dropped EXE
    PID:4148
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\NEAS.3004e60797cdd74b27819ffb5ffef2b0_JC.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3572
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MediaCenter.exe

Path C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Size 71KB
SHA256 aabd7c59fdb647cfbc2896def738916b9e96783f01e8d52d6d7d77f9e998ba7b
MD5 625838939c8f1281d01504b0da26e4cf
SHA1 f8cb5192ee899d5f69ec1b8d81e1ab6a50fcea92
SHA512 e831f8578f5f8a92a64950a28a92fad61244f91648977c375f73b3e1e2586b75cc93b57e9e72372f73a7d85285309bac04fc6341f89011113bf2679fe246cc26
SSDEEP 768:bhSksandb4GgyMsp4hyYtoVxYGm1ZAe0oAGZ:bTsGpehyYtkYvnr0o9Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

MediaCenter.exe

Path C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Size 71KB
SHA256 aabd7c59fdb647cfbc2896def738916b9e96783f01e8d52d6d7d77f9e998ba7b
MD5 625838939c8f1281d01504b0da26e4cf
SHA1 f8cb5192ee899d5f69ec1b8d81e1ab6a50fcea92
SHA512 e831f8578f5f8a92a64950a28a92fad61244f91648977c375f73b3e1e2586b75cc93b57e9e72372f73a7d85285309bac04fc6341f89011113bf2679fe246cc26
SSDEEP 768:bhSksandb4GgyMsp4hyYtoVxYGm1ZAe0oAGZ:bTsGpehyYtkYvnr0o9Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3036-0-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/3036-1-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/3036-2-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/3036-4-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/4148-8-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/4148-9-0x0000000000400000-0x000000000040B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads