sakula | 45d89ec308ca69ab82df464b7166f53aed8be43f3702c65a711bcf72bb72974f

General

Target
45d89ec308ca69ab82df464b7166f53aed8be43f3702c65a711bcf72bb72974f.exe
Size 44KB
Sample231108-q2dpsabh4y
SHA256 45d89ec308ca69ab82df464b7166f53aed8be43f3702c65a711bcf72bb72974f
MD5 0cb69e72b4b060af02339b16f618dc71
SHA1 76777d0f7bea903e8ee4875d92bfc9fe4fcf665b
SHA512 c55fa00e56232347bd0efe9bfee59e933942b4947d52a77c1fdda1aecb50bb2a77ec7576c7d6fa356b7a4f5c5fa492a790af5a831dc943add866c8c98b87f930
SSDEEP 768:GhSksandb4GgyMsw4hyYtoVxYMcm1oUt1vnhBa:GTsGpjhyYtkYMRyUFM
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sakula persistence rat trojan

Malware Config

Extracted

Family

sakula

C2

http://vpn.premrera.com:443/viewpre.asp?cstring=%s&tom=%d&id=%d
http://vpn.premrera.com:443/photo/%s.jpg?id=%d
http://173.254.226.212:443/viewpre.asp?cstring=%s&tom=%d&id=%d
http://173.254.226.212:443/photo/%s.jpg?id=%d

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Executes dropped EXE 1 IoCs

pid	Process
3140	MediaCenter.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	reg.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2468	reg.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4420	PING.EXE

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4920 wrote to memory of 5024	4920	45d89ec308ca69ab82df464b7166f53aed8be43f3702c65a711bcf72bb72974f.exe	93
PID 4920 wrote to memory of 5024	4920	45d89ec308ca69ab82df464b7166f53aed8be43f3702c65a711bcf72bb72974f.exe	93
PID 4920 wrote to memory of 5024	4920	45d89ec308ca69ab82df464b7166f53aed8be43f3702c65a711bcf72bb72974f.exe	93
PID 4920 wrote to memory of 3612	4920	45d89ec308ca69ab82df464b7166f53aed8be43f3702c65a711bcf72bb72974f.exe	94
PID 4920 wrote to memory of 3612	4920	45d89ec308ca69ab82df464b7166f53aed8be43f3702c65a711bcf72bb72974f.exe	94
PID 4920 wrote to memory of 3612	4920	45d89ec308ca69ab82df464b7166f53aed8be43f3702c65a711bcf72bb72974f.exe	94
PID 4920 wrote to memory of 3784	4920	45d89ec308ca69ab82df464b7166f53aed8be43f3702c65a711bcf72bb72974f.exe	95
PID 4920 wrote to memory of 3784	4920	45d89ec308ca69ab82df464b7166f53aed8be43f3702c65a711bcf72bb72974f.exe	95
PID 4920 wrote to memory of 3784	4920	45d89ec308ca69ab82df464b7166f53aed8be43f3702c65a711bcf72bb72974f.exe	95
PID 3612 wrote to memory of 3140	3612	cmd.exe	100
PID 3612 wrote to memory of 3140	3612	cmd.exe	100
PID 3612 wrote to memory of 3140	3612	cmd.exe	100
PID 5024 wrote to memory of 2468	5024	cmd.exe	101
PID 5024 wrote to memory of 2468	5024	cmd.exe	101
PID 5024 wrote to memory of 2468	5024	cmd.exe	101
PID 3784 wrote to memory of 4420	3784	cmd.exe	102
PID 3784 wrote to memory of 4420	3784	cmd.exe	102
PID 3784 wrote to memory of 4420	3784	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\45d89ec308ca69ab82df464b7166f53aed8be43f3702c65a711bcf72bb72974f.exe
"C:\Users\Admin\AppData\Local\Temp\45d89ec308ca69ab82df464b7166f53aed8be43f3702c65a711bcf72bb72974f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5024
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:2468
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3612
- - C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
    C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
    3⤵
    - Executes dropped EXE
    PID:3140
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\45d89ec308ca69ab82df464b7166f53aed8be43f3702c65a711bcf72bb72974f.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3784
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:4420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MediaCenter.exe

Path C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Size 44KB
SHA256 fa953c0b0c341e5e1d9201e15c98f72e055cfbc26e53b08603ad0d842059aab5
MD5 91e25e7793fac972fc3ec3fe7911bcb1
SHA1 2253c519d83a06ae4e3142562075ce517f6e1a99
SHA512 2b1d364bc3b033944df8d336d70bd934e57b08ef862b439926a356a9feb0e62f9db9b7214c83884307d066d9b0f0fd773806778d8c0ed1d02fb8ee2b804871c7
SSDEEP 768:GhSksandb4GgyMsw4hyYtoVxYMcm1oUt1vnhBR:GTsGpjhyYtkYMRyUFj
MD5 SHA1 SHA512 SSDEEP

Submit Download

MediaCenter.exe

Path C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Size 44KB
SHA256 fa953c0b0c341e5e1d9201e15c98f72e055cfbc26e53b08603ad0d842059aab5
MD5 91e25e7793fac972fc3ec3fe7911bcb1
SHA1 2253c519d83a06ae4e3142562075ce517f6e1a99
SHA512 2b1d364bc3b033944df8d336d70bd934e57b08ef862b439926a356a9feb0e62f9db9b7214c83884307d066d9b0f0fd773806778d8c0ed1d02fb8ee2b804871c7
SSDEEP 768:GhSksandb4GgyMsw4hyYtoVxYMcm1oUt1vnhBR:GTsGpjhyYtkYMRyUFj
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3140-6-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/3140-7-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/4920-0-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/4920-2-0x0000000000400000-0x000000000040B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads