sakula | 3d874f888bd422c9512999146ce5f2339136a88a77de4a64ef55931e004ca5db

Analysis

max time kernel
161s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19-12-2023 20:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

92cc325fdb0744d07fe7ae950bf7deca.exe
Size

4.5MB
MD5

92cc325fdb0744d07fe7ae950bf7deca
SHA1

1d0386591f232f21fadaec5d57fe940dd75914c1
SHA256

3d874f888bd422c9512999146ce5f2339136a88a77de4a64ef55931e004ca5db
SHA512

d2ce15f6005be64fd3060f1e2a47453976d78a1e23c09f8734b827d168ba631dee2a6a6221938b04372c226389142730bb85c4361b943be92b943df3ee5ff449
SSDEEP

24576:0+9mrnE2Zjll/6b8h3UZrgEu8CkBW+M3nXvIMfhlG144EE/f5DBMY9:0Y2ZjlkWEZw8Jk+EXvIMfP4FRaY9

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula payload 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

92cc325fdb0744d07fe7ae950bf7deca.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	92cc325fdb0744d07fe7ae950bf7deca.exe

Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

2972 MediaCenter.exe

pid	process
2972	MediaCenter.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

92cc325fdb0744d07fe7ae950bf7deca.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	92cc325fdb0744d07fe7ae950bf7deca.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2484 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

92cc325fdb0744d07fe7ae950bf7deca.exe

description pid process

Token: SeIncBasePriorityPrivilege 3012 92cc325fdb0744d07fe7ae950bf7deca.exe

pid	process
2484	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	3012	92cc325fdb0744d07fe7ae950bf7deca.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

92cc325fdb0744d07fe7ae950bf7deca.execmd.exe

description	pid	process	target process
PID 3012 wrote to memory of 2972	3012	92cc325fdb0744d07fe7ae950bf7deca.exe	MediaCenter.exe
PID 3012 wrote to memory of 2972	3012	92cc325fdb0744d07fe7ae950bf7deca.exe	MediaCenter.exe
PID 3012 wrote to memory of 2972	3012	92cc325fdb0744d07fe7ae950bf7deca.exe	MediaCenter.exe
PID 3012 wrote to memory of 4284	3012	92cc325fdb0744d07fe7ae950bf7deca.exe	cmd.exe
PID 3012 wrote to memory of 4284	3012	92cc325fdb0744d07fe7ae950bf7deca.exe	cmd.exe
PID 3012 wrote to memory of 4284	3012	92cc325fdb0744d07fe7ae950bf7deca.exe	cmd.exe
PID 4284 wrote to memory of 2484	4284	cmd.exe	PING.EXE
PID 4284 wrote to memory of 2484	4284	cmd.exe	PING.EXE
PID 4284 wrote to memory of 2484	4284	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\92cc325fdb0744d07fe7ae950bf7deca.exe
"C:\Users\Admin\AppData\Local\Temp\92cc325fdb0744d07fe7ae950bf7deca.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3012

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:2972

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\92cc325fdb0744d07fe7ae950bf7deca.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:4284

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:2484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Filesize
4.5MB

MD5
76ab086fcfed5e25ba08c5081d87c8bd

SHA1
5a9159c58d4bae80ab2f0670faf21785fe7e0ff0

SHA256
03ee2a1a300ebb273b505eb25d08d1333903b5a22d89bf3ecc66445a238b5f8e

SHA512
b823236c39df3cdb5c9b63948d9da5b0b1bdfb788d9ef54b0d9d663ba4b793e02e6104106ea847dd2ef0b929a5fefdc6d6b82be48ca29491481e71534e351168

Download Submit