sakula | d9c2a44499d7ee91fe6d7270caee934acf961164eaba250ba0b700b788d36128

Analysis

max time kernel
145s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
22-10-2023 17:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.be376371771bb547c306eafc3fe4ec40.exe
Size

37KB
MD5

be376371771bb547c306eafc3fe4ec40
SHA1

7f267f8f4b910417aea6f1b370c51c4dee644195
SHA256

d9c2a44499d7ee91fe6d7270caee934acf961164eaba250ba0b700b788d36128
SHA512

8ed2270b831d8df4483399e94117d2b056eaac30b8283bab0cd66023b7934c7eed0d32487402e37b7485b9a95e682ded1892c72e96cef590f27ce71afc3bc0c7
SSDEEP

768:D7Xezc/T6Zp14hyYtoVxYF9mH8VQ1PcPW/M9z9:n6zqhyYtkYWRPTEz9

Score

10^/10

sakula persistence rat trojan

Malware Config

Extracted

Family

sakula

http://www.we11point.com:443/view.asp?cookie=%s&type=%d&vid=%d

http://www.we11point.com:443/photo/%s.jpg?vid=%d

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

5080 MediaCenter.exe

pid	process
5080	MediaCenter.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	reg.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

2300 reg.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1792 PING.EXE

pid	process
2300	reg.exe

pid	process
1792	PING.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

NEAS.be376371771bb547c306eafc3fe4ec40.execmd.execmd.exe

description	pid	process	target process
PID 4780 wrote to memory of 1120	4780	NEAS.be376371771bb547c306eafc3fe4ec40.exe	cmd.exe
PID 4780 wrote to memory of 1120	4780	NEAS.be376371771bb547c306eafc3fe4ec40.exe	cmd.exe
PID 4780 wrote to memory of 1120	4780	NEAS.be376371771bb547c306eafc3fe4ec40.exe	cmd.exe
PID 4780 wrote to memory of 5080	4780	NEAS.be376371771bb547c306eafc3fe4ec40.exe	MediaCenter.exe
PID 4780 wrote to memory of 5080	4780	NEAS.be376371771bb547c306eafc3fe4ec40.exe	MediaCenter.exe
PID 4780 wrote to memory of 5080	4780	NEAS.be376371771bb547c306eafc3fe4ec40.exe	MediaCenter.exe
PID 1120 wrote to memory of 2300	1120	cmd.exe	reg.exe
PID 1120 wrote to memory of 2300	1120	cmd.exe	reg.exe
PID 1120 wrote to memory of 2300	1120	cmd.exe	reg.exe
PID 4780 wrote to memory of 4564	4780	NEAS.be376371771bb547c306eafc3fe4ec40.exe	cmd.exe
PID 4780 wrote to memory of 4564	4780	NEAS.be376371771bb547c306eafc3fe4ec40.exe	cmd.exe
PID 4780 wrote to memory of 4564	4780	NEAS.be376371771bb547c306eafc3fe4ec40.exe	cmd.exe
PID 4564 wrote to memory of 1792	4564	cmd.exe	PING.EXE
PID 4564 wrote to memory of 1792	4564	cmd.exe	PING.EXE
PID 4564 wrote to memory of 1792	4564	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\NEAS.be376371771bb547c306eafc3fe4ec40.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.be376371771bb547c306eafc3fe4ec40.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4780

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1120

C:\Windows\SysWOW64\reg.exe
reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"
3⤵
- Adds Run key to start application
- Modifies registry key
PID:2300

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:5080

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\NEAS.be376371771bb547c306eafc3fe4ec40.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:4564

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Filesize
37KB

MD5
a1cc64011f3d3178725144d2efbfc3c0

SHA1
0c8652dcc99194386eb1b5c2c15094aef8da11c7

SHA256
29fc096bbd6db6b8894fdb99240f87f7ed8e9b181255c2c747027bd1040b289d

SHA512
fd5177242913d786bdac942d48577fdfb7399ffa5b3b8a0d468efaf0f67b80ab374a5825ebf7431804f125036f62ec444e4f38593bfe4ad6f414d913be481a8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Filesize
37KB

MD5
a1cc64011f3d3178725144d2efbfc3c0

SHA1
0c8652dcc99194386eb1b5c2c15094aef8da11c7

SHA256
29fc096bbd6db6b8894fdb99240f87f7ed8e9b181255c2c747027bd1040b289d

SHA512
fd5177242913d786bdac942d48577fdfb7399ffa5b3b8a0d468efaf0f67b80ab374a5825ebf7431804f125036f62ec444e4f38593bfe4ad6f414d913be481a8a

Download Submit
memory/4780-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4780-5-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download