sakula | 7f6b5f681f1d51021517b4406e5477bb196a49469846422e760adaa5ffb29790

Analysis

max time kernel
144s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19-12-2023 20:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

912b0c8d59b80434cc62948de13a14ab.exe
Size

321KB
MD5

912b0c8d59b80434cc62948de13a14ab
SHA1

6654e387088d0400d91041069af6424691e32d08
SHA256

7f6b5f681f1d51021517b4406e5477bb196a49469846422e760adaa5ffb29790
SHA512

dd5e0d0ea285796ace9a6a25caa758391f9893d5fa214d8e0288f5974216dab8fe7109a9dd3b34ea75e4d42f1d2f975c6ba5b9a50f600ce5bbb7739a6191dc30
SSDEEP

1536:aoaj1hJL1S9t0MIeboal8bCKxo7h0RP0jwHVz30rtroZeBsCXKTnhxJX:F0hpgz6xGhTjwHN30BE8BsZhf

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula payload 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

912b0c8d59b80434cc62948de13a14ab.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	912b0c8d59b80434cc62948de13a14ab.exe

Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

4716 MediaCenter.exe

pid	process
4716	MediaCenter.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

912b0c8d59b80434cc62948de13a14ab.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	912b0c8d59b80434cc62948de13a14ab.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1640 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

912b0c8d59b80434cc62948de13a14ab.exe

description pid process

Token: SeIncBasePriorityPrivilege 3836 912b0c8d59b80434cc62948de13a14ab.exe

pid	process
1640	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	3836	912b0c8d59b80434cc62948de13a14ab.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

912b0c8d59b80434cc62948de13a14ab.execmd.exe

description	pid	process	target process
PID 3836 wrote to memory of 4716	3836	912b0c8d59b80434cc62948de13a14ab.exe	MediaCenter.exe
PID 3836 wrote to memory of 4716	3836	912b0c8d59b80434cc62948de13a14ab.exe	MediaCenter.exe
PID 3836 wrote to memory of 4716	3836	912b0c8d59b80434cc62948de13a14ab.exe	MediaCenter.exe
PID 3836 wrote to memory of 2752	3836	912b0c8d59b80434cc62948de13a14ab.exe	cmd.exe
PID 3836 wrote to memory of 2752	3836	912b0c8d59b80434cc62948de13a14ab.exe	cmd.exe
PID 3836 wrote to memory of 2752	3836	912b0c8d59b80434cc62948de13a14ab.exe	cmd.exe
PID 2752 wrote to memory of 1640	2752	cmd.exe	PING.EXE
PID 2752 wrote to memory of 1640	2752	cmd.exe	PING.EXE
PID 2752 wrote to memory of 1640	2752	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\912b0c8d59b80434cc62948de13a14ab.exe
"C:\Users\Admin\AppData\Local\Temp\912b0c8d59b80434cc62948de13a14ab.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3836

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:4716

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\912b0c8d59b80434cc62948de13a14ab.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2752

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Filesize
321KB

MD5
afbb162174ce126dc10082e446a5eb34

SHA1
c7e6c712a7b41b0c7e269c47986c04455bc684b6

SHA256
1cea0183790d2c2272786a255468d5fc6b54f7b6ddd756cd3ab8687ce4c46022

SHA512
a1fefd59f7553ca850ae0fe0ef3070807395948bf2ab78d605c67298d837a5166a61bdd9d32f6b1570214969a44167293866eb08b4027120e52e901e494c92a6

Download Submit