sakula | d9c2a44499d7ee91fe6d7270caee934acf961164eaba250ba0b700b788d36128

Analysis

max time kernel
145s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
22/10/2023, 17:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NEAS.be376371771bb547c306eafc3fe4ec40.exe
Size 37KB
Sample231022-v1ctbaac49
SHA256 d9c2a44499d7ee91fe6d7270caee934acf961164eaba250ba0b700b788d36128
MD5 be376371771bb547c306eafc3fe4ec40
SHA1 7f267f8f4b910417aea6f1b370c51c4dee644195
SHA512 8ed2270b831d8df4483399e94117d2b056eaac30b8283bab0cd66023b7934c7eed0d32487402e37b7485b9a95e682ded1892c72e96cef590f27ce71afc3bc0c7
SSDEEP 768:D7Xezc/T6Zp14hyYtoVxYF9mH8VQ1PcPW/M9z9:n6zqhyYtkYWRPTEz9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sakula persistence rat trojan

Malware Config

Extracted

Family

sakula

http://www.we11point.com:443/view.asp?cookie=%s&type=%d&vid=%d
http://www.we11point.com:443/photo/%s.jpg?vid=%d

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Executes dropped EXE 1 IoCs

pid	Process
5080	MediaCenter.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	reg.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2300	reg.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1792	PING.EXE

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4780 wrote to memory of 1120	4780	NEAS.be376371771bb547c306eafc3fe4ec40.exe	90
PID 4780 wrote to memory of 1120	4780	NEAS.be376371771bb547c306eafc3fe4ec40.exe	90
PID 4780 wrote to memory of 1120	4780	NEAS.be376371771bb547c306eafc3fe4ec40.exe	90
PID 4780 wrote to memory of 5080	4780	NEAS.be376371771bb547c306eafc3fe4ec40.exe	91
PID 4780 wrote to memory of 5080	4780	NEAS.be376371771bb547c306eafc3fe4ec40.exe	91
PID 4780 wrote to memory of 5080	4780	NEAS.be376371771bb547c306eafc3fe4ec40.exe	91
PID 1120 wrote to memory of 2300	1120	cmd.exe	93
PID 1120 wrote to memory of 2300	1120	cmd.exe	93
PID 1120 wrote to memory of 2300	1120	cmd.exe	93
PID 4780 wrote to memory of 4564	4780	NEAS.be376371771bb547c306eafc3fe4ec40.exe	96
PID 4780 wrote to memory of 4564	4780	NEAS.be376371771bb547c306eafc3fe4ec40.exe	96
PID 4780 wrote to memory of 4564	4780	NEAS.be376371771bb547c306eafc3fe4ec40.exe	96
PID 4564 wrote to memory of 1792	4564	cmd.exe	99
PID 4564 wrote to memory of 1792	4564	cmd.exe	99
PID 4564 wrote to memory of 1792	4564	cmd.exe	99

C:\Users\Admin\AppData\Local\Temp\NEAS.be376371771bb547c306eafc3fe4ec40.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.be376371771bb547c306eafc3fe4ec40.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4780
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1120
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:2300
- C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
  C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\NEAS.be376371771bb547c306eafc3fe4ec40.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4564
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MediaCenter.exe

Path C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Size 37KB
SHA256 29fc096bbd6db6b8894fdb99240f87f7ed8e9b181255c2c747027bd1040b289d
MD5 a1cc64011f3d3178725144d2efbfc3c0
SHA1 0c8652dcc99194386eb1b5c2c15094aef8da11c7
SHA512 fd5177242913d786bdac942d48577fdfb7399ffa5b3b8a0d468efaf0f67b80ab374a5825ebf7431804f125036f62ec444e4f38593bfe4ad6f414d913be481a8a
SSDEEP 768:D7Xezc/T6Zp14hyYtoVxYF9mH8VQ1PcPW/M9zZ:n6zqhyYtkYWRPTEzZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

MediaCenter.exe

Path C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Size 37KB
SHA256 29fc096bbd6db6b8894fdb99240f87f7ed8e9b181255c2c747027bd1040b289d
MD5 a1cc64011f3d3178725144d2efbfc3c0
SHA1 0c8652dcc99194386eb1b5c2c15094aef8da11c7
SHA512 fd5177242913d786bdac942d48577fdfb7399ffa5b3b8a0d468efaf0f67b80ab374a5825ebf7431804f125036f62ec444e4f38593bfe4ad6f414d913be481a8a
SSDEEP 768:D7Xezc/T6Zp14hyYtoVxYF9mH8VQ1PcPW/M9zZ:n6zqhyYtkYWRPTEzZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4780-0-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/4780-5-0x0000000000400000-0x0000000000408000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads