sakula | d9c2a44499d7ee91fe6d7270caee934acf961164eaba250ba0b700b788d36128

General

Target
NEAS.be376371771bb547c306eafc3fe4ec40.exe
Size 37KB
Sample231022-v1ctbaac49
SHA256 d9c2a44499d7ee91fe6d7270caee934acf961164eaba250ba0b700b788d36128
MD5 be376371771bb547c306eafc3fe4ec40
SHA1 7f267f8f4b910417aea6f1b370c51c4dee644195
SHA512 8ed2270b831d8df4483399e94117d2b056eaac30b8283bab0cd66023b7934c7eed0d32487402e37b7485b9a95e682ded1892c72e96cef590f27ce71afc3bc0c7
SSDEEP 768:D7Xezc/T6Zp14hyYtoVxYF9mH8VQ1PcPW/M9z9:n6zqhyYtkYWRPTEz9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sakula persistence rat trojan

Malware Config

Extracted

Family

sakula

C2

http://www.we11point.com:443/view.asp?cookie=%s&type=%d&vid=%d
http://www.we11point.com:443/photo/%s.jpg?vid=%d

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Deletes itself 1 IoCs

pid	Process
2900	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2660	MediaCenter.exe

Loads dropped DLL 2 IoCs

pid	Process
1212	NEAS.be376371771bb547c306eafc3fe4ec40.exe
1212	NEAS.be376371771bb547c306eafc3fe4ec40.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	reg.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2932	reg.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2828	PING.EXE

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1212 wrote to memory of 2056	1212	NEAS.be376371771bb547c306eafc3fe4ec40.exe	28
PID 1212 wrote to memory of 2056	1212	NEAS.be376371771bb547c306eafc3fe4ec40.exe	28
PID 1212 wrote to memory of 2056	1212	NEAS.be376371771bb547c306eafc3fe4ec40.exe	28
PID 1212 wrote to memory of 2056	1212	NEAS.be376371771bb547c306eafc3fe4ec40.exe	28
PID 1212 wrote to memory of 2660	1212	NEAS.be376371771bb547c306eafc3fe4ec40.exe	30
PID 1212 wrote to memory of 2660	1212	NEAS.be376371771bb547c306eafc3fe4ec40.exe	30
PID 1212 wrote to memory of 2660	1212	NEAS.be376371771bb547c306eafc3fe4ec40.exe	30
PID 1212 wrote to memory of 2660	1212	NEAS.be376371771bb547c306eafc3fe4ec40.exe	30
PID 2056 wrote to memory of 2932	2056	cmd.exe	31
PID 2056 wrote to memory of 2932	2056	cmd.exe	31
PID 2056 wrote to memory of 2932	2056	cmd.exe	31
PID 2056 wrote to memory of 2932	2056	cmd.exe	31
PID 1212 wrote to memory of 2900	1212	NEAS.be376371771bb547c306eafc3fe4ec40.exe	34
PID 1212 wrote to memory of 2900	1212	NEAS.be376371771bb547c306eafc3fe4ec40.exe	34
PID 1212 wrote to memory of 2900	1212	NEAS.be376371771bb547c306eafc3fe4ec40.exe	34
PID 1212 wrote to memory of 2900	1212	NEAS.be376371771bb547c306eafc3fe4ec40.exe	34
PID 2900 wrote to memory of 2828	2900	cmd.exe	36
PID 2900 wrote to memory of 2828	2900	cmd.exe	36
PID 2900 wrote to memory of 2828	2900	cmd.exe	36
PID 2900 wrote to memory of 2828	2900	cmd.exe	36

C:\Users\Admin\AppData\Local\Temp\NEAS.be376371771bb547c306eafc3fe4ec40.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.be376371771bb547c306eafc3fe4ec40.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2056
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:2932
- C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
  C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\NEAS.be376371771bb547c306eafc3fe4ec40.exe"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:2900
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MediaCenter.exe

Path C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Size 37KB
SHA256 306776c557a37d311c72e7e0584958be666f784475d62c752c33c580e660d936
MD5 ab06b0ddee3dfeedc9ba6c632da9ddde
SHA1 b9876aa52cc741c44e0380b7a12122b3b277831c
SHA512 f8ba5e730e88d322be60369c6d7e914bea10f900ca5ef7d6583658e2e92bc84489755557c493827c194e3d0494ebf1b6e63fb4202389711a130a7367c30d44be
SSDEEP 768:D7Xezc/T6Zp14hyYtoVxYF9mH8VQ1PcPW/M9zq:n6zqhyYtkYWRPTEzq
MD5 SHA1 SHA512 SSDEEP

Submit Download

MediaCenter.exe

Path C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Size 37KB
SHA256 306776c557a37d311c72e7e0584958be666f784475d62c752c33c580e660d936
MD5 ab06b0ddee3dfeedc9ba6c632da9ddde
SHA1 b9876aa52cc741c44e0380b7a12122b3b277831c
SHA512 f8ba5e730e88d322be60369c6d7e914bea10f900ca5ef7d6583658e2e92bc84489755557c493827c194e3d0494ebf1b6e63fb4202389711a130a7367c30d44be
SSDEEP 768:D7Xezc/T6Zp14hyYtoVxYF9mH8VQ1PcPW/M9zq:n6zqhyYtkYWRPTEzq
MD5 SHA1 SHA512 SSDEEP

Submit Download

MediaCenter.exe

Path \Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Size 37KB
SHA256 306776c557a37d311c72e7e0584958be666f784475d62c752c33c580e660d936
MD5 ab06b0ddee3dfeedc9ba6c632da9ddde
SHA1 b9876aa52cc741c44e0380b7a12122b3b277831c
SHA512 f8ba5e730e88d322be60369c6d7e914bea10f900ca5ef7d6583658e2e92bc84489755557c493827c194e3d0494ebf1b6e63fb4202389711a130a7367c30d44be
SSDEEP 768:D7Xezc/T6Zp14hyYtoVxYF9mH8VQ1PcPW/M9zq:n6zqhyYtkYWRPTEzq
MD5 SHA1 SHA512 SSDEEP

Submit Download

MediaCenter.exe

Path \Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Size 37KB
SHA256 306776c557a37d311c72e7e0584958be666f784475d62c752c33c580e660d936
MD5 ab06b0ddee3dfeedc9ba6c632da9ddde
SHA1 b9876aa52cc741c44e0380b7a12122b3b277831c
SHA512 f8ba5e730e88d322be60369c6d7e914bea10f900ca5ef7d6583658e2e92bc84489755557c493827c194e3d0494ebf1b6e63fb4202389711a130a7367c30d44be
SSDEEP 768:D7Xezc/T6Zp14hyYtoVxYF9mH8VQ1PcPW/M9zq:n6zqhyYtkYWRPTEzq
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1212-0-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/1212-10-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/2660-9-0x0000000000400000-0x0000000000408000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads