sakula | 9f92741e2edb51b51e0143511cd24ba77825b4307bcb10fde6b6e0dc3f6c560e

General

Target
NEAS.7ebc035c4333830745ff919625eea0c0.exe
Size 76KB
Sample231102-kjrwssbf22
SHA256 9f92741e2edb51b51e0143511cd24ba77825b4307bcb10fde6b6e0dc3f6c560e
MD5 7ebc035c4333830745ff919625eea0c0
SHA1 ba850da0349c55864ca94f273521f72c2882d8da
SHA512 1bdba57aedc532c87d3ab1c684f00cd2651e49b21f18add55773b625d7da61b27f575ca121793d00d3a318e870729acc8a73846aaf9a38994d500fe02da89dca
SSDEEP 768:FhSksandb4GgyMsp4hyYtoVxYGm1ZAIPsED3VK2+ZtyOjgO4r9vFAg2rqf:FTsGpehyYtkYvnbYTjipvF2i
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sakula persistence rat trojan

Malware Config

Extracted

Family

sakula

C2

http://vpn.premrera.com:443/viewpre.asp?cstring=%s&tom=%d&id=%d
http://vpn.premrera.com:443/photo/%s.jpg?id=%d
http://173.254.226.212:443/viewpre.asp?cstring=%s&tom=%d&id=%d
http://173.254.226.212:443/photo/%s.jpg?id=%d

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Executes dropped EXE 1 IoCs

pid	Process
4780	MediaCenter.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	reg.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2080	reg.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4968	PING.EXE

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4792 wrote to memory of 2312	4792	NEAS.7ebc035c4333830745ff919625eea0c0.exe	91
PID 4792 wrote to memory of 2312	4792	NEAS.7ebc035c4333830745ff919625eea0c0.exe	91
PID 4792 wrote to memory of 2312	4792	NEAS.7ebc035c4333830745ff919625eea0c0.exe	91
PID 4792 wrote to memory of 3576	4792	NEAS.7ebc035c4333830745ff919625eea0c0.exe	93
PID 4792 wrote to memory of 3576	4792	NEAS.7ebc035c4333830745ff919625eea0c0.exe	93
PID 4792 wrote to memory of 3576	4792	NEAS.7ebc035c4333830745ff919625eea0c0.exe	93
PID 4792 wrote to memory of 2436	4792	NEAS.7ebc035c4333830745ff919625eea0c0.exe	92
PID 4792 wrote to memory of 2436	4792	NEAS.7ebc035c4333830745ff919625eea0c0.exe	92
PID 4792 wrote to memory of 2436	4792	NEAS.7ebc035c4333830745ff919625eea0c0.exe	92
PID 2436 wrote to memory of 4968	2436	cmd.exe	98
PID 2436 wrote to memory of 4968	2436	cmd.exe	98
PID 2436 wrote to memory of 4968	2436	cmd.exe	98
PID 3576 wrote to memory of 4780	3576	cmd.exe	99
PID 3576 wrote to memory of 4780	3576	cmd.exe	99
PID 3576 wrote to memory of 4780	3576	cmd.exe	99
PID 2312 wrote to memory of 2080	2312	cmd.exe	97
PID 2312 wrote to memory of 2080	2312	cmd.exe	97
PID 2312 wrote to memory of 2080	2312	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\NEAS.7ebc035c4333830745ff919625eea0c0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.7ebc035c4333830745ff919625eea0c0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2312
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:2080
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\NEAS.7ebc035c4333830745ff919625eea0c0.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2436
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:4968
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3576
- - C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
    C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
    3⤵
    - Executes dropped EXE
    PID:4780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MediaCenter.exe

Path C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Size 76KB
SHA256 e62ba16649387ed48f043c281a415544a2bc58807f7cb1ce520f2e49779701c6
MD5 db2b5d7bd371b1601f562510c82667fc
SHA1 e50705466f929809e735a8a8ce540eca53cfcd41
SHA512 72d92b7b5d4f08a076369768028d3be5b0cee4b56543feebc78405129d68018d891b0c34ba493e6872a4a36a84594fea69b9c1f443651c473cbf3605d8d82764
SSDEEP 768:FhSksandb4GgyMsp4hyYtoVxYGm1ZAIPsED3VK2+ZtyOjgO4r9vFAg2rq+:FTsGpehyYtkYvnbYTjipvF2H
MD5 SHA1 SHA512 SSDEEP

Submit Download

MediaCenter.exe

Path C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Size 76KB
SHA256 e62ba16649387ed48f043c281a415544a2bc58807f7cb1ce520f2e49779701c6
MD5 db2b5d7bd371b1601f562510c82667fc
SHA1 e50705466f929809e735a8a8ce540eca53cfcd41
SHA512 72d92b7b5d4f08a076369768028d3be5b0cee4b56543feebc78405129d68018d891b0c34ba493e6872a4a36a84594fea69b9c1f443651c473cbf3605d8d82764
SSDEEP 768:FhSksandb4GgyMsp4hyYtoVxYGm1ZAIPsED3VK2+ZtyOjgO4r9vFAg2rq+:FTsGpehyYtkYvnbYTjipvF2H
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4792-0-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4792-1-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4792-2-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4792-4-0x0000000000400000-0x000000000040C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads