Analysis
-
max time kernel
130s -
max time network
218s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
-
submitted
21-10-2023 21:14
General
-
Target
NEAS.166ed8f938d5d3aab7f183dfa2e650e0.exe
-
Size
212KB
-
MD5
166ed8f938d5d3aab7f183dfa2e650e0
-
SHA1
87c73fc2129bdc336cd52daaac034dd0824b93cd
-
SHA256
8cab6ebd9f1b655199eaa0146ba6de735289c3fda5a4635a5e8601e6ec2e9f91
-
SHA512
d46463d3b91f6868d95bb79d7508c65f2373d234388c445bb405f5527b9734b2983cf2552957b9b8929d7115602c2e68e1ff64e94d04f269190b7e1d492e5139
-
SSDEEP
1536:LQFl29mEkE0L1rDEKrxZKF2zf9g2Pl7W/MwbxMX+ZkPz30rtr8gjXjp0AanBi:829DkEGRQixVSjLFkb30BYgjXjpKnBi
Score
10/10
Malware Config
Extracted
Family
sakula
C2
www.polarroute.com
Signatures
-
Sakula
Sakula is a remote access trojan with various capabilities.
-
Sakula payload 2 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Program crash 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.166ed8f938d5d3aab7f183dfa2e650e0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.166ed8f938d5d3aab7f183dfa2e650e0.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4984 -s 3402⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4984 -ip 49841⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4984-0-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/4984-1-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB