sakula | 99dec7f15c42e3a4eba016c7aeef0d445fd51b846c44605410cbfbf6ab9f797d | Triage

Analysis

max time kernel
150s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2023 01:01

Sharing

Report Analysis Logs

General

Target

NEAS.1cda4f8e37fdb18c80fcd172695abe00.exe
Size

40KB
MD5

1cda4f8e37fdb18c80fcd172695abe00
SHA1

cf3f8ba744c9440f65bdc4aa1e5c18351fdb99a9
SHA256

99dec7f15c42e3a4eba016c7aeef0d445fd51b846c44605410cbfbf6ab9f797d
SHA512

367ccad1491d325f4865428abff92ce192f13b7be9625f2742796fdd61b13aae9cfa154811ca344599810c89ecdb236f2e7927592dc2e8a9a363fefe2c978319
SSDEEP

768:q29Pf5I14hyYtoVxYG9mHfCBJTAIO3Ot:F7thyYtkYX/CPnO3

Score

10^/10

sakula rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

64 1108 WerFault.exe NEAS.1cda4f8e37fdb18c80fcd172695abe00.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.1cda4f8e37fdb18c80fcd172695abe00.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.1cda4f8e37fdb18c80fcd172695abe00.exe"
1⤵
PID:1108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1108 -s 224
2⤵
- Program crash
PID:64

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1108 -ip 1108
1⤵
PID:1948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1108-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download