sakula | f3a618af1d97c0ce971b5cda4732908f5c357334f9a540ff025f8565290cc0ac

General

Target

NEAS.c857e28a8f6c956aa381d2b6b9e7b020.exe
Size

12KB
MD5

c857e28a8f6c956aa381d2b6b9e7b020
SHA1

f9ce3d2a1ea3891b235461cb96d9f7dda63d6d9d
SHA256

f3a618af1d97c0ce971b5cda4732908f5c357334f9a540ff025f8565290cc0ac
SHA512

768df386137e92d973fd345e5fdaf13122173c491ff0ab672f1744c24282ffc338563dc79d75dadb2669c22a7ac7490637ade0e726aa60262f1513041a2a965f
SSDEEP

192:+UoHtBBPR/wn3VGswB1ZztrM5gwX/wJlB5rC/42oq+vLtr9ZCspE+TMgrZMVT:Hk6g7trW54DLdAeMvVT

Score

10^/10

sakula persistence rat trojan upx

Malware Config

Extracted

Family

sakula

C2

http://www.we11point.com:443/view.asp?cookie=%s&type=%d&vid=%d

http://www.we11point.com:443/photo/%s.jpg?vid=%d

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

3088 MediaCenter.exe

pid	process
3088	MediaCenter.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/872-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/872-1-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/872-2-0x0000000000400000-0x000000000040B000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	upx
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	upx
behavioral2/memory/872-7-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/3088-10-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	reg.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

548 reg.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

804 PING.EXE

pid	process
548	reg.exe

pid	process
804	PING.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

NEAS.c857e28a8f6c956aa381d2b6b9e7b020.execmd.execmd.exe

description	pid	process	target process
PID 872 wrote to memory of 1748	872	NEAS.c857e28a8f6c956aa381d2b6b9e7b020.exe	cmd.exe
PID 872 wrote to memory of 1748	872	NEAS.c857e28a8f6c956aa381d2b6b9e7b020.exe	cmd.exe
PID 872 wrote to memory of 1748	872	NEAS.c857e28a8f6c956aa381d2b6b9e7b020.exe	cmd.exe
PID 872 wrote to memory of 3088	872	NEAS.c857e28a8f6c956aa381d2b6b9e7b020.exe	MediaCenter.exe
PID 872 wrote to memory of 3088	872	NEAS.c857e28a8f6c956aa381d2b6b9e7b020.exe	MediaCenter.exe
PID 872 wrote to memory of 3088	872	NEAS.c857e28a8f6c956aa381d2b6b9e7b020.exe	MediaCenter.exe
PID 1748 wrote to memory of 548	1748	cmd.exe	reg.exe
PID 1748 wrote to memory of 548	1748	cmd.exe	reg.exe
PID 1748 wrote to memory of 548	1748	cmd.exe	reg.exe
PID 872 wrote to memory of 2176	872	NEAS.c857e28a8f6c956aa381d2b6b9e7b020.exe	cmd.exe
PID 872 wrote to memory of 2176	872	NEAS.c857e28a8f6c956aa381d2b6b9e7b020.exe	cmd.exe
PID 872 wrote to memory of 2176	872	NEAS.c857e28a8f6c956aa381d2b6b9e7b020.exe	cmd.exe
PID 2176 wrote to memory of 804	2176	cmd.exe	PING.EXE
PID 2176 wrote to memory of 804	2176	cmd.exe	PING.EXE
PID 2176 wrote to memory of 804	2176	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\NEAS.c857e28a8f6c956aa381d2b6b9e7b020.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.c857e28a8f6c956aa381d2b6b9e7b020.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:872

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1748

C:\Windows\SysWOW64\reg.exe
reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"
3⤵
- Adds Run key to start application
- Modifies registry key
PID:548

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:3088

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\NEAS.c857e28a8f6c956aa381d2b6b9e7b020.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2176

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Filesize
12KB

MD5
5080affc0c5321194d393599ce478306

SHA1
1e27968796992ddd67c5eae632b66bdf3acfde41

SHA256
d443e9d87458084f361ab12812e1548a7b929b5e9e1910cac868dda9c72cb79a

SHA512
09be2460df561c5d3d4b837aaf83ad0c48a80a2bcf43da57bb3cb7b9f488a2fbf4bd6b693ad4e17485a3c14672d758a2509664c7578e63cc2bab2b526e12fa86

Download Submit
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Filesize
12KB

MD5
5080affc0c5321194d393599ce478306

SHA1
1e27968796992ddd67c5eae632b66bdf3acfde41

SHA256
d443e9d87458084f361ab12812e1548a7b929b5e9e1910cac868dda9c72cb79a

SHA512
09be2460df561c5d3d4b837aaf83ad0c48a80a2bcf43da57bb3cb7b9f488a2fbf4bd6b693ad4e17485a3c14672d758a2509664c7578e63cc2bab2b526e12fa86

Download Submit
memory/872-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/872-1-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/872-2-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/872-7-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3088-10-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads