sakula | 1750a3d2a6a958392ab8013cf84048adf697d80c894e9abeee7c6316114daa4b

General

Target

NEAS.c49775978cfd25a9e5373afad7de51d0.exe
Size

300KB
MD5

c49775978cfd25a9e5373afad7de51d0
SHA1

635fc8df88d3a70a57e8ac3da0863651068cf7a1
SHA256

1750a3d2a6a958392ab8013cf84048adf697d80c894e9abeee7c6316114daa4b
SHA512

60dae27a448f15db0c96bc631d364755e330983c2b27dbd9a89b131177b28bb0e124832d2996efb17d3e8a4c41d7bbfd19327122f1405056f7797f512fb38832
SSDEEP

6144:M29qRfVSndj30B3wBxE1+ijiBKk3etdgI2MyzNORQtOfl1qNVo7R+S+N/v:0RfQn+w8EYiBlr

Score

10^/10

sakula persistence rat trojan

Malware Config

Extracted

Family

sakula

C2

www.polarroute.com

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula payload 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2180-0-0x0000000000400000-0x0000000000420000-memory.dmp	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
behavioral2/memory/4952-5-0x0000000000400000-0x0000000000420000-memory.dmp	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
behavioral2/memory/2180-6-0x0000000000400000-0x0000000000420000-memory.dmp	family_sakula

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

NEAS.c49775978cfd25a9e5373afad7de51d0.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	NEAS.c49775978cfd25a9e5373afad7de51d0.exe

Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

4952 MediaCenter.exe

pid	process
4952	MediaCenter.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

NEAS.c49775978cfd25a9e5373afad7de51d0.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	NEAS.c49775978cfd25a9e5373afad7de51d0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

4464 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

NEAS.c49775978cfd25a9e5373afad7de51d0.exe

description pid process

Token: SeIncBasePriorityPrivilege 2180 NEAS.c49775978cfd25a9e5373afad7de51d0.exe

pid	process
4464	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	2180	NEAS.c49775978cfd25a9e5373afad7de51d0.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

NEAS.c49775978cfd25a9e5373afad7de51d0.execmd.exe

description	pid	process	target process
PID 2180 wrote to memory of 4952	2180	NEAS.c49775978cfd25a9e5373afad7de51d0.exe	MediaCenter.exe
PID 2180 wrote to memory of 4952	2180	NEAS.c49775978cfd25a9e5373afad7de51d0.exe	MediaCenter.exe
PID 2180 wrote to memory of 4952	2180	NEAS.c49775978cfd25a9e5373afad7de51d0.exe	MediaCenter.exe
PID 2180 wrote to memory of 4428	2180	NEAS.c49775978cfd25a9e5373afad7de51d0.exe	cmd.exe
PID 2180 wrote to memory of 4428	2180	NEAS.c49775978cfd25a9e5373afad7de51d0.exe	cmd.exe
PID 2180 wrote to memory of 4428	2180	NEAS.c49775978cfd25a9e5373afad7de51d0.exe	cmd.exe
PID 4428 wrote to memory of 4464	4428	cmd.exe	PING.EXE
PID 4428 wrote to memory of 4464	4428	cmd.exe	PING.EXE
PID 4428 wrote to memory of 4464	4428	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\NEAS.c49775978cfd25a9e5373afad7de51d0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.c49775978cfd25a9e5373afad7de51d0.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2180

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:4952

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\NEAS.c49775978cfd25a9e5373afad7de51d0.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:4428

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:4464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Filesize
300KB

MD5
c6b3a7519a14aa91cbfda70ab2507114

SHA1
0c0497efb74d02347ed2cfcb6fe596c2b7aad8fd

SHA256
029e795cdca6d8b537365a1242dd1bce17e158aecb0db9a37fae206e7b23f50c

SHA512
4037990615075293be0deed46a90c6bcfc91f1196ec2eb6b21d0a3c31f90371e60e5d95871e846b247588655178b496bc9144b62a3b20681b32c04fe94051ea9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Filesize
300KB

MD5
c6b3a7519a14aa91cbfda70ab2507114

SHA1
0c0497efb74d02347ed2cfcb6fe596c2b7aad8fd

SHA256
029e795cdca6d8b537365a1242dd1bce17e158aecb0db9a37fae206e7b23f50c

SHA512
4037990615075293be0deed46a90c6bcfc91f1196ec2eb6b21d0a3c31f90371e60e5d95871e846b247588655178b496bc9144b62a3b20681b32c04fe94051ea9

Download Submit
memory/2180-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2180-6-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4952-5-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads