sakula | 919b7ab3ae3534b5f996d231b269f9d1e72830a17d96cd350ce320c3ad5cd6aa

Analysis

max time kernel
141s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
27/10/2023, 01:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NEAS.b7f5edce3547da45966a78dea9d6ba90_JC.exe
Size 38KB
Sample231027-bz3hsscf44
SHA256 919b7ab3ae3534b5f996d231b269f9d1e72830a17d96cd350ce320c3ad5cd6aa
MD5 b7f5edce3547da45966a78dea9d6ba90
SHA1 85ad447a9456a5ec344ea6b6557722904d5497f0
SHA512 a9d6db8cef21464008d078d5e042899a26046fb3ff88d253be341d02100bcebf55e5b18f6858ee9d75a9620a2a76817c5105c92eb991f2a6036d927b8ed2f74f
SSDEEP 768:u7Xezc/T6Zp14hyYtoVxYF9mHF1yD3BmNV5:a6zqhyYtkYWI3Bm
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sakula persistence rat trojan

Malware Config

Extracted

Family

sakula

http://www.we11point.com:443/view.asp?cookie=%s&type=%d&vid=%d
http://www.we11point.com:443/photo/%s.jpg?vid=%d

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Executes dropped EXE 1 IoCs

pid	Process
4000	MediaCenter.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	reg.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2188	reg.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1780	PING.EXE

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 224 wrote to memory of 4164	224	NEAS.b7f5edce3547da45966a78dea9d6ba90_JC.exe	91
PID 224 wrote to memory of 4164	224	NEAS.b7f5edce3547da45966a78dea9d6ba90_JC.exe	91
PID 224 wrote to memory of 4164	224	NEAS.b7f5edce3547da45966a78dea9d6ba90_JC.exe	91
PID 224 wrote to memory of 4000	224	NEAS.b7f5edce3547da45966a78dea9d6ba90_JC.exe	92
PID 224 wrote to memory of 4000	224	NEAS.b7f5edce3547da45966a78dea9d6ba90_JC.exe	92
PID 224 wrote to memory of 4000	224	NEAS.b7f5edce3547da45966a78dea9d6ba90_JC.exe	92
PID 4164 wrote to memory of 2188	4164	cmd.exe	94
PID 4164 wrote to memory of 2188	4164	cmd.exe	94
PID 4164 wrote to memory of 2188	4164	cmd.exe	94
PID 224 wrote to memory of 3052	224	NEAS.b7f5edce3547da45966a78dea9d6ba90_JC.exe	98
PID 224 wrote to memory of 3052	224	NEAS.b7f5edce3547da45966a78dea9d6ba90_JC.exe	98
PID 224 wrote to memory of 3052	224	NEAS.b7f5edce3547da45966a78dea9d6ba90_JC.exe	98
PID 3052 wrote to memory of 1780	3052	cmd.exe	100
PID 3052 wrote to memory of 1780	3052	cmd.exe	100
PID 3052 wrote to memory of 1780	3052	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\NEAS.b7f5edce3547da45966a78dea9d6ba90_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.b7f5edce3547da45966a78dea9d6ba90_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:224
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4164
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:2188
- C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
  C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
  2⤵
  - Executes dropped EXE
  PID:4000
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\NEAS.b7f5edce3547da45966a78dea9d6ba90_JC.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3052
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MediaCenter.exe

Path C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Size 38KB
SHA256 42b47508eba7ea09cc6a2967404bb7520626307d469e575d446f48581aa1023e
MD5 01a8cc7a5505cf93139b167ffa1b94ac
SHA1 68f1c2a2475c76d6ba9f9ad0240842102b3b865c
SHA512 131f1481b53194c17a02c480434beb58bb74a3a88c569166753366926039964c7cd791138beda20906c8a9829b3451464ca1c79388ca93ab48380c3059127913
SSDEEP 768:u7Xezc/T6Zp14hyYtoVxYF9mHF1yD3BmNVL:a6zqhyYtkYWI3Bw
MD5 SHA1 SHA512 SSDEEP

Submit Download

MediaCenter.exe

Path C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Size 38KB
SHA256 42b47508eba7ea09cc6a2967404bb7520626307d469e575d446f48581aa1023e
MD5 01a8cc7a5505cf93139b167ffa1b94ac
SHA1 68f1c2a2475c76d6ba9f9ad0240842102b3b865c
SHA512 131f1481b53194c17a02c480434beb58bb74a3a88c569166753366926039964c7cd791138beda20906c8a9829b3451464ca1c79388ca93ab48380c3059127913
SSDEEP 768:u7Xezc/T6Zp14hyYtoVxYF9mHF1yD3BmNVL:a6zqhyYtkYWI3Bw
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/224-0-0x0000000000400000-0x000000000040A000-memory.dmp

Download

memory/224-1-0x0000000000400000-0x000000000040A000-memory.dmp

Download

memory/224-2-0x0000000000400000-0x000000000040A000-memory.dmp

Download

memory/224-7-0x0000000000400000-0x000000000040A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads