sakula | d9c2a44499d7ee91fe6d7270caee934acf961164eaba250ba0b700b788d36128

General

Target

NEAS.be376371771bb547c306eafc3fe4ec40.exe
Size

37KB
MD5

be376371771bb547c306eafc3fe4ec40
SHA1

7f267f8f4b910417aea6f1b370c51c4dee644195
SHA256

d9c2a44499d7ee91fe6d7270caee934acf961164eaba250ba0b700b788d36128
SHA512

8ed2270b831d8df4483399e94117d2b056eaac30b8283bab0cd66023b7934c7eed0d32487402e37b7485b9a95e682ded1892c72e96cef590f27ce71afc3bc0c7
SSDEEP

768:D7Xezc/T6Zp14hyYtoVxYF9mH8VQ1PcPW/M9z9:n6zqhyYtkYWRPTEz9

Score

10^/10

sakula persistence rat trojan

Malware Config

Extracted

Family

sakula

C2

http://www.we11point.com:443/view.asp?cookie=%s&type=%d&vid=%d

http://www.we11point.com:443/photo/%s.jpg?vid=%d

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2900 cmd.exe
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

2660 MediaCenter.exe
Loads dropped DLL 2 IoCs

Processes:

NEAS.be376371771bb547c306eafc3fe4ec40.exe

pid process

1212 NEAS.be376371771bb547c306eafc3fe4ec40.exe
1212 NEAS.be376371771bb547c306eafc3fe4ec40.exe

pid	process
2900	cmd.exe

pid	process
2660	MediaCenter.exe

pid	process
1212	NEAS.be376371771bb547c306eafc3fe4ec40.exe
1212	NEAS.be376371771bb547c306eafc3fe4ec40.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	reg.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

2932 reg.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2828 PING.EXE

pid	process
2932	reg.exe

pid	process
2828	PING.EXE

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

NEAS.be376371771bb547c306eafc3fe4ec40.execmd.execmd.exe

description	pid	process	target process
PID 1212 wrote to memory of 2056	1212	NEAS.be376371771bb547c306eafc3fe4ec40.exe	cmd.exe
PID 1212 wrote to memory of 2056	1212	NEAS.be376371771bb547c306eafc3fe4ec40.exe	cmd.exe
PID 1212 wrote to memory of 2056	1212	NEAS.be376371771bb547c306eafc3fe4ec40.exe	cmd.exe
PID 1212 wrote to memory of 2056	1212	NEAS.be376371771bb547c306eafc3fe4ec40.exe	cmd.exe
PID 1212 wrote to memory of 2660	1212	NEAS.be376371771bb547c306eafc3fe4ec40.exe	MediaCenter.exe
PID 1212 wrote to memory of 2660	1212	NEAS.be376371771bb547c306eafc3fe4ec40.exe	MediaCenter.exe
PID 1212 wrote to memory of 2660	1212	NEAS.be376371771bb547c306eafc3fe4ec40.exe	MediaCenter.exe
PID 1212 wrote to memory of 2660	1212	NEAS.be376371771bb547c306eafc3fe4ec40.exe	MediaCenter.exe
PID 2056 wrote to memory of 2932	2056	cmd.exe	reg.exe
PID 2056 wrote to memory of 2932	2056	cmd.exe	reg.exe
PID 2056 wrote to memory of 2932	2056	cmd.exe	reg.exe
PID 2056 wrote to memory of 2932	2056	cmd.exe	reg.exe
PID 1212 wrote to memory of 2900	1212	NEAS.be376371771bb547c306eafc3fe4ec40.exe	cmd.exe
PID 1212 wrote to memory of 2900	1212	NEAS.be376371771bb547c306eafc3fe4ec40.exe	cmd.exe
PID 1212 wrote to memory of 2900	1212	NEAS.be376371771bb547c306eafc3fe4ec40.exe	cmd.exe
PID 1212 wrote to memory of 2900	1212	NEAS.be376371771bb547c306eafc3fe4ec40.exe	cmd.exe
PID 2900 wrote to memory of 2828	2900	cmd.exe	PING.EXE
PID 2900 wrote to memory of 2828	2900	cmd.exe	PING.EXE
PID 2900 wrote to memory of 2828	2900	cmd.exe	PING.EXE
PID 2900 wrote to memory of 2828	2900	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\NEAS.be376371771bb547c306eafc3fe4ec40.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.be376371771bb547c306eafc3fe4ec40.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1212

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2056

C:\Windows\SysWOW64\reg.exe
reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"
3⤵
- Adds Run key to start application
- Modifies registry key
PID:2932

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:2660

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\NEAS.be376371771bb547c306eafc3fe4ec40.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2900

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:2828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Filesize
37KB

MD5
ab06b0ddee3dfeedc9ba6c632da9ddde

SHA1
b9876aa52cc741c44e0380b7a12122b3b277831c

SHA256
306776c557a37d311c72e7e0584958be666f784475d62c752c33c580e660d936

SHA512
f8ba5e730e88d322be60369c6d7e914bea10f900ca5ef7d6583658e2e92bc84489755557c493827c194e3d0494ebf1b6e63fb4202389711a130a7367c30d44be

Download Submit
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Filesize
37KB

MD5
ab06b0ddee3dfeedc9ba6c632da9ddde

SHA1
b9876aa52cc741c44e0380b7a12122b3b277831c

SHA256
306776c557a37d311c72e7e0584958be666f784475d62c752c33c580e660d936

SHA512
f8ba5e730e88d322be60369c6d7e914bea10f900ca5ef7d6583658e2e92bc84489755557c493827c194e3d0494ebf1b6e63fb4202389711a130a7367c30d44be

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Filesize
37KB

MD5
ab06b0ddee3dfeedc9ba6c632da9ddde

SHA1
b9876aa52cc741c44e0380b7a12122b3b277831c

SHA256
306776c557a37d311c72e7e0584958be666f784475d62c752c33c580e660d936

SHA512
f8ba5e730e88d322be60369c6d7e914bea10f900ca5ef7d6583658e2e92bc84489755557c493827c194e3d0494ebf1b6e63fb4202389711a130a7367c30d44be

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Filesize
37KB

MD5
ab06b0ddee3dfeedc9ba6c632da9ddde

SHA1
b9876aa52cc741c44e0380b7a12122b3b277831c

SHA256
306776c557a37d311c72e7e0584958be666f784475d62c752c33c580e660d936

SHA512
f8ba5e730e88d322be60369c6d7e914bea10f900ca5ef7d6583658e2e92bc84489755557c493827c194e3d0494ebf1b6e63fb4202389711a130a7367c30d44be

Download Submit
memory/1212-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1212-10-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2660-9-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads