sakula | 5d9b5be7fb44448822ccf9e020c8f0ad2790f3df5d2f84e8b680b78168350bfe

General

Target

NEAS.eba4cdc0e44a700cc86432eeefd82f40.exe
Size

99KB
MD5

eba4cdc0e44a700cc86432eeefd82f40
SHA1

cbb38653fced9ffd4b78daf20ae7be82222322be
SHA256

5d9b5be7fb44448822ccf9e020c8f0ad2790f3df5d2f84e8b680b78168350bfe
SHA512

371ced12fcae4754e4e0f809b93cc3c2bbdb8168cf7cb936b229d9d39b0185e14cf5270e6893f2d89e1346b00e701e1884419df40f4a82398f3c5513005a6662
SSDEEP

1536:Loaj1hJL1S9t0MIeboal8bCKxo7h0RPaaml0Nz30rtrtx7:c0hpgz6xGhZamyF30B5x7

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula payload 7 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3488-0-0x0000000000400000-0x000000000041B000-memory.dmp	family_sakula
behavioral2/memory/3488-2-0x0000000000400000-0x000000000041B000-memory.dmp	family_sakula
behavioral2/memory/5032-5-0x0000000000400000-0x000000000041B000-memory.dmp	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
behavioral2/memory/5032-7-0x0000000000400000-0x000000000041B000-memory.dmp	family_sakula
behavioral2/memory/3488-8-0x0000000000400000-0x000000000041B000-memory.dmp	family_sakula

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

NEAS.eba4cdc0e44a700cc86432eeefd82f40.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000\Control Panel\International\Geo\Nation	NEAS.eba4cdc0e44a700cc86432eeefd82f40.exe

Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

5032 MediaCenter.exe

pid	process
5032	MediaCenter.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

NEAS.eba4cdc0e44a700cc86432eeefd82f40.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	NEAS.eba4cdc0e44a700cc86432eeefd82f40.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2544 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

NEAS.eba4cdc0e44a700cc86432eeefd82f40.exe

description pid process

Token: SeIncBasePriorityPrivilege 3488 NEAS.eba4cdc0e44a700cc86432eeefd82f40.exe

pid	process
2544	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	3488	NEAS.eba4cdc0e44a700cc86432eeefd82f40.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

NEAS.eba4cdc0e44a700cc86432eeefd82f40.execmd.exe

description	pid	process	target process
PID 3488 wrote to memory of 5032	3488	NEAS.eba4cdc0e44a700cc86432eeefd82f40.exe	MediaCenter.exe
PID 3488 wrote to memory of 5032	3488	NEAS.eba4cdc0e44a700cc86432eeefd82f40.exe	MediaCenter.exe
PID 3488 wrote to memory of 5032	3488	NEAS.eba4cdc0e44a700cc86432eeefd82f40.exe	MediaCenter.exe
PID 3488 wrote to memory of 700	3488	NEAS.eba4cdc0e44a700cc86432eeefd82f40.exe	cmd.exe
PID 3488 wrote to memory of 700	3488	NEAS.eba4cdc0e44a700cc86432eeefd82f40.exe	cmd.exe
PID 3488 wrote to memory of 700	3488	NEAS.eba4cdc0e44a700cc86432eeefd82f40.exe	cmd.exe
PID 700 wrote to memory of 2544	700	cmd.exe	PING.EXE
PID 700 wrote to memory of 2544	700	cmd.exe	PING.EXE
PID 700 wrote to memory of 2544	700	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\NEAS.eba4cdc0e44a700cc86432eeefd82f40.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.eba4cdc0e44a700cc86432eeefd82f40.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3488

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:5032

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\NEAS.eba4cdc0e44a700cc86432eeefd82f40.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:700

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Filesize
99KB

MD5
9e08ccfd074b31c26ddc9a77ecd0911b

SHA1
20c51f678b4fefeb9075a426fa4d87a6e1197440

SHA256
183df0dfbe2b2676c22771015ed69e6086fae29074bed54eb8a000d18c7edf75

SHA512
5e4d33a4ec995d40e35d30d4cebfcfce2d5f030f3ba4be16d4d550917962ad8fa869234f4a42d580d94071bc0df9165d11cf751a3b29ab62019c847e03ecead2

Download Submit
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Filesize
99KB

MD5
9e08ccfd074b31c26ddc9a77ecd0911b

SHA1
20c51f678b4fefeb9075a426fa4d87a6e1197440

SHA256
183df0dfbe2b2676c22771015ed69e6086fae29074bed54eb8a000d18c7edf75

SHA512
5e4d33a4ec995d40e35d30d4cebfcfce2d5f030f3ba4be16d4d550917962ad8fa869234f4a42d580d94071bc0df9165d11cf751a3b29ab62019c847e03ecead2

Download Submit
memory/3488-0-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3488-2-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3488-8-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/5032-5-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/5032-7-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads