sakula | 8cab6ebd9f1b655199eaa0146ba6de735289c3fda5a4635a5e8601e6ec2e9f91

Analysis

max time kernel
121s
max time network
152s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
21-10-2023 21:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.166ed8f938d5d3aab7f183dfa2e650e0.exe
Size

212KB
MD5

166ed8f938d5d3aab7f183dfa2e650e0
SHA1

87c73fc2129bdc336cd52daaac034dd0824b93cd
SHA256

8cab6ebd9f1b655199eaa0146ba6de735289c3fda5a4635a5e8601e6ec2e9f91
SHA512

d46463d3b91f6868d95bb79d7508c65f2373d234388c445bb405f5527b9734b2983cf2552957b9b8929d7115602c2e68e1ff64e94d04f269190b7e1d492e5139
SSDEEP

1536:LQFl29mEkE0L1rDEKrxZKF2zf9g2Pl7W/MwbxMX+ZkPz30rtr8gjXjp0AanBi:829DkEGRQixVSjLFkb30BYgjXjpKnBi

Score

10^/10

sakula rat trojan upx

Malware Config

Extracted

Family

sakula

www.polarroute.com

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2788-0-0x0000000000400000-0x0000000000435000-memory.dmp	family_sakula
behavioral1/memory/2788-1-0x0000000000400000-0x0000000000435000-memory.dmp	family_sakula

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2788-0-0x0000000000400000-0x0000000000435000-memory.dmp	upx
behavioral1/memory/2788-1-0x0000000000400000-0x0000000000435000-memory.dmp	upx

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2688 2788 WerFault.exe NEAS.166ed8f938d5d3aab7f183dfa2e650e0.exe

pid	pid_target	process	target process
2688	2788	WerFault.exe	NEAS.166ed8f938d5d3aab7f183dfa2e650e0.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

NEAS.166ed8f938d5d3aab7f183dfa2e650e0.exe

description	pid	process	target process
PID 2788 wrote to memory of 2688	2788	NEAS.166ed8f938d5d3aab7f183dfa2e650e0.exe	WerFault.exe
PID 2788 wrote to memory of 2688	2788	NEAS.166ed8f938d5d3aab7f183dfa2e650e0.exe	WerFault.exe
PID 2788 wrote to memory of 2688	2788	NEAS.166ed8f938d5d3aab7f183dfa2e650e0.exe	WerFault.exe
PID 2788 wrote to memory of 2688	2788	NEAS.166ed8f938d5d3aab7f183dfa2e650e0.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.166ed8f938d5d3aab7f183dfa2e650e0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.166ed8f938d5d3aab7f183dfa2e650e0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 120
2⤵
- Program crash
PID:2688

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2788-0-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2788-1-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads