sakula | f3a618af1d97c0ce971b5cda4732908f5c357334f9a540ff025f8565290cc0ac

General

Target
NEAS.c857e28a8f6c956aa381d2b6b9e7b020.exe
Size 12KB
Sample231102-rlgxyafa45
SHA256 f3a618af1d97c0ce971b5cda4732908f5c357334f9a540ff025f8565290cc0ac
MD5 c857e28a8f6c956aa381d2b6b9e7b020
SHA1 f9ce3d2a1ea3891b235461cb96d9f7dda63d6d9d
SHA512 768df386137e92d973fd345e5fdaf13122173c491ff0ab672f1744c24282ffc338563dc79d75dadb2669c22a7ac7490637ade0e726aa60262f1513041a2a965f
SSDEEP 192:+UoHtBBPR/wn3VGswB1ZztrM5gwX/wJlB5rC/42oq+vLtr9ZCspE+TMgrZMVT:Hk6g7trW54DLdAeMvVT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sakula persistence rat trojan upx

Malware Config

Extracted

Family

sakula

C2

http://www.we11point.com:443/view.asp?cookie=%s&type=%d&vid=%d
http://www.we11point.com:443/photo/%s.jpg?vid=%d

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Executes dropped EXE 1 IoCs

pid	Process
3088	MediaCenter.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/872-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/872-1-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/872-2-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0006000000022e30-5.dat	upx
behavioral2/files/0x0006000000022e30-6.dat	upx
behavioral2/memory/872-7-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/3088-10-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	reg.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
548	reg.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
804	PING.EXE

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 872 wrote to memory of 1748	872	NEAS.c857e28a8f6c956aa381d2b6b9e7b020.exe	100
PID 872 wrote to memory of 1748	872	NEAS.c857e28a8f6c956aa381d2b6b9e7b020.exe	100
PID 872 wrote to memory of 1748	872	NEAS.c857e28a8f6c956aa381d2b6b9e7b020.exe	100
PID 872 wrote to memory of 3088	872	NEAS.c857e28a8f6c956aa381d2b6b9e7b020.exe	102
PID 872 wrote to memory of 3088	872	NEAS.c857e28a8f6c956aa381d2b6b9e7b020.exe	102
PID 872 wrote to memory of 3088	872	NEAS.c857e28a8f6c956aa381d2b6b9e7b020.exe	102
PID 1748 wrote to memory of 548	1748	cmd.exe	103
PID 1748 wrote to memory of 548	1748	cmd.exe	103
PID 1748 wrote to memory of 548	1748	cmd.exe	103
PID 872 wrote to memory of 2176	872	NEAS.c857e28a8f6c956aa381d2b6b9e7b020.exe	112
PID 872 wrote to memory of 2176	872	NEAS.c857e28a8f6c956aa381d2b6b9e7b020.exe	112
PID 872 wrote to memory of 2176	872	NEAS.c857e28a8f6c956aa381d2b6b9e7b020.exe	112
PID 2176 wrote to memory of 804	2176	cmd.exe	114
PID 2176 wrote to memory of 804	2176	cmd.exe	114
PID 2176 wrote to memory of 804	2176	cmd.exe	114

C:\Users\Admin\AppData\Local\Temp\NEAS.c857e28a8f6c956aa381d2b6b9e7b020.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.c857e28a8f6c956aa381d2b6b9e7b020.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:872
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1748
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:548
- C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
  C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\NEAS.c857e28a8f6c956aa381d2b6b9e7b020.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2176
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MediaCenter.exe

Path C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Size 12KB
SHA256 d443e9d87458084f361ab12812e1548a7b929b5e9e1910cac868dda9c72cb79a
MD5 5080affc0c5321194d393599ce478306
SHA1 1e27968796992ddd67c5eae632b66bdf3acfde41
SHA512 09be2460df561c5d3d4b837aaf83ad0c48a80a2bcf43da57bb3cb7b9f488a2fbf4bd6b693ad4e17485a3c14672d758a2509664c7578e63cc2bab2b526e12fa86
SSDEEP 192:+UoHtBBPR/wn3VGswB1ZztrM5gwX/wJlB5rC/42oq+vLtr9ZCspE+TMgrZMV4:Hk6g7trW54DLdAeMvV4
MD5 SHA1 SHA512 SSDEEP

Submit Download

MediaCenter.exe

Path C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Size 12KB
SHA256 d443e9d87458084f361ab12812e1548a7b929b5e9e1910cac868dda9c72cb79a
MD5 5080affc0c5321194d393599ce478306
SHA1 1e27968796992ddd67c5eae632b66bdf3acfde41
SHA512 09be2460df561c5d3d4b837aaf83ad0c48a80a2bcf43da57bb3cb7b9f488a2fbf4bd6b693ad4e17485a3c14672d758a2509664c7578e63cc2bab2b526e12fa86
SSDEEP 192:+UoHtBBPR/wn3VGswB1ZztrM5gwX/wJlB5rC/42oq+vLtr9ZCspE+TMgrZMV4:Hk6g7trW54DLdAeMvV4
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/872-0-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/872-1-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/872-2-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/872-7-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/3088-10-0x0000000000400000-0x000000000040B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads