sakula | 87d289e296b3779a744d2ceac8ef592c510b7c6a34157a7f88ba19fa36113fbc

General

Target
87d289e296b3779a744d2ceac8ef592c510b7c6a34157a7f88ba19fa36113fbc.exe
Size 44KB
Sample231109-yyernsdb6w
SHA256 87d289e296b3779a744d2ceac8ef592c510b7c6a34157a7f88ba19fa36113fbc
MD5 1e25cb169893f2ce73e137ae18c6df82
SHA1 2112f760a5c3095fadeef5bd45fdc6979b07953b
SHA512 dd28f177631343a2c1ea5be0fd23329f40865681bf443c7e472a82cd85a7763ad3a84a7bd5569691b43160d826655e2884494f681074fdeabc70b979141057a5
SSDEEP 768:GhSksandb4GgyMsw4hyYtoVxYMcm1oUt1vnhBL:GTsGpjhyYtkYMRyUFp
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sakula persistence rat trojan

Malware Config

Extracted

Family

sakula

C2

http://vpn.premrera.com:443/viewpre.asp?cstring=%s&tom=%d&id=%d
http://vpn.premrera.com:443/photo/%s.jpg?id=%d
http://173.254.226.212:443/viewpre.asp?cstring=%s&tom=%d&id=%d
http://173.254.226.212:443/photo/%s.jpg?id=%d

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Executes dropped EXE 1 IoCs

pid	Process
2224	MediaCenter.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	reg.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2820	reg.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4244	PING.EXE

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 180 wrote to memory of 4856	180	87d289e296b3779a744d2ceac8ef592c510b7c6a34157a7f88ba19fa36113fbc.exe	95
PID 180 wrote to memory of 4856	180	87d289e296b3779a744d2ceac8ef592c510b7c6a34157a7f88ba19fa36113fbc.exe	95
PID 180 wrote to memory of 4856	180	87d289e296b3779a744d2ceac8ef592c510b7c6a34157a7f88ba19fa36113fbc.exe	95
PID 180 wrote to memory of 3092	180	87d289e296b3779a744d2ceac8ef592c510b7c6a34157a7f88ba19fa36113fbc.exe	96
PID 180 wrote to memory of 3092	180	87d289e296b3779a744d2ceac8ef592c510b7c6a34157a7f88ba19fa36113fbc.exe	96
PID 180 wrote to memory of 3092	180	87d289e296b3779a744d2ceac8ef592c510b7c6a34157a7f88ba19fa36113fbc.exe	96
PID 180 wrote to memory of 4692	180	87d289e296b3779a744d2ceac8ef592c510b7c6a34157a7f88ba19fa36113fbc.exe	97
PID 180 wrote to memory of 4692	180	87d289e296b3779a744d2ceac8ef592c510b7c6a34157a7f88ba19fa36113fbc.exe	97
PID 180 wrote to memory of 4692	180	87d289e296b3779a744d2ceac8ef592c510b7c6a34157a7f88ba19fa36113fbc.exe	97
PID 3092 wrote to memory of 2224	3092	cmd.exe	101
PID 3092 wrote to memory of 2224	3092	cmd.exe	101
PID 3092 wrote to memory of 2224	3092	cmd.exe	101
PID 4692 wrote to memory of 4244	4692	cmd.exe	103
PID 4692 wrote to memory of 4244	4692	cmd.exe	103
PID 4692 wrote to memory of 4244	4692	cmd.exe	103
PID 4856 wrote to memory of 2820	4856	cmd.exe	102
PID 4856 wrote to memory of 2820	4856	cmd.exe	102
PID 4856 wrote to memory of 2820	4856	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\87d289e296b3779a744d2ceac8ef592c510b7c6a34157a7f88ba19fa36113fbc.exe
"C:\Users\Admin\AppData\Local\Temp\87d289e296b3779a744d2ceac8ef592c510b7c6a34157a7f88ba19fa36113fbc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:180
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4856
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:2820
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3092
- - C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
    C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
    3⤵
    - Executes dropped EXE
    PID:2224
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\87d289e296b3779a744d2ceac8ef592c510b7c6a34157a7f88ba19fa36113fbc.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4692
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:4244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MediaCenter.exe

Path C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Size 44KB
SHA256 ce6ca727611f8a1a37e05f787267d5ac3401a6e6057d9d8a7bbac291a630e461
MD5 7363969e07c5afc7379ff67198f3e8f0
SHA1 ee19383f75aa878e75373c32ddeada2fe13478e4
SHA512 833fa21d6a8e846027706cc96a3468bbdf9f135eb9cbb23939b7925342410553e3049aacd6b759b1ef3d5b0169d452ef929d93f0d9697f07cf6941135a568583
SSDEEP 768:GhSksandb4GgyMsw4hyYtoVxYMcm1oUt1vnhBo:GTsGpjhyYtkYMRyUF+
MD5 SHA1 SHA512 SSDEEP

Submit Download

MediaCenter.exe

Path C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Size 44KB
SHA256 ce6ca727611f8a1a37e05f787267d5ac3401a6e6057d9d8a7bbac291a630e461
MD5 7363969e07c5afc7379ff67198f3e8f0
SHA1 ee19383f75aa878e75373c32ddeada2fe13478e4
SHA512 833fa21d6a8e846027706cc96a3468bbdf9f135eb9cbb23939b7925342410553e3049aacd6b759b1ef3d5b0169d452ef929d93f0d9697f07cf6941135a568583
SSDEEP 768:GhSksandb4GgyMsw4hyYtoVxYMcm1oUt1vnhBo:GTsGpjhyYtkYMRyUF+
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/180-0-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/180-2-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/2224-6-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/2224-7-0x0000000000400000-0x000000000040B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads