sakula | 33c8ace830117c2b62deb9447d1319803cd82cf996213fd2dd7bb6c99933b346

Analysis

max time kernel
123s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20/12/2023, 12:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b513e34939f4c8db1c0a0043aca5ee50.exe
Size 304KB
Sample231220-p5e7cafdb2
SHA256 33c8ace830117c2b62deb9447d1319803cd82cf996213fd2dd7bb6c99933b346
MD5 b513e34939f4c8db1c0a0043aca5ee50
SHA1 204659586b81770e2e967ee13e7d43d2c61b377f
SHA512 81b7c0ab70ea0e630e9a85b39e5237b26efddc7098ebbc0acbcc16070b8d0e74383d4526c0c5cda0213f0f97c8a413abb01b3cf3169de2cde87bc8ca4ea456a9
SSDEEP 6144:M29qRfVSndj30B3wBxE1+ijiBKk3etdgI2MyzNORQtOfl1qNVo7R+S+N/B:0RfQn+w8EYiBld
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sakula persistence rat trojan

Malware Config

Extracted

Family

sakula

www.polarroute.com

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula payload 4 IoCs

resource	yara_rule
behavioral2/memory/1564-0-0x0000000000400000-0x0000000000420000-memory.dmp	family_sakula
behavioral2/files/0x000900000002320b-3.dat	family_sakula
behavioral2/memory/432-5-0x0000000000400000-0x0000000000420000-memory.dmp	family_sakula
behavioral2/memory/1564-6-0x0000000000400000-0x0000000000420000-memory.dmp	family_sakula

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	b513e34939f4c8db1c0a0043aca5ee50.exe

Executes dropped EXE 1 IoCs

pid	Process
432	MediaCenter.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	b513e34939f4c8db1c0a0043aca5ee50.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3300	PING.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1564	b513e34939f4c8db1c0a0043aca5ee50.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1564 wrote to memory of 432	1564	b513e34939f4c8db1c0a0043aca5ee50.exe	87
PID 1564 wrote to memory of 432	1564	b513e34939f4c8db1c0a0043aca5ee50.exe	87
PID 1564 wrote to memory of 432	1564	b513e34939f4c8db1c0a0043aca5ee50.exe	87
PID 1564 wrote to memory of 4252	1564	b513e34939f4c8db1c0a0043aca5ee50.exe	93
PID 1564 wrote to memory of 4252	1564	b513e34939f4c8db1c0a0043aca5ee50.exe	93
PID 1564 wrote to memory of 4252	1564	b513e34939f4c8db1c0a0043aca5ee50.exe	93
PID 4252 wrote to memory of 3300	4252	cmd.exe	95
PID 4252 wrote to memory of 3300	4252	cmd.exe	95
PID 4252 wrote to memory of 3300	4252	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\b513e34939f4c8db1c0a0043aca5ee50.exe
"C:\Users\Admin\AppData\Local\Temp\b513e34939f4c8db1c0a0043aca5ee50.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
  C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\b513e34939f4c8db1c0a0043aca5ee50.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4252
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:3300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MediaCenter.exe

Path C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Size 304KB
SHA256 b5915fc749753003b168e41fd3ffdc98abe18b9ca4b19c0cd9f41bb9253e3e12
MD5 f05b25a2d75c8379faf9635b42a6ac7e
SHA1 a16a43b7b84ed95b9cf17b3592c365433880015f
SHA512 211527ec74fa2f1829d80dbdb0cd59f943141602d62f2b24a1867e1cf38b5445e63257c8a3a66838e1edea11567f03024d01400886b9c7eb7ff2caa47311bc1e
SSDEEP 6144:M29qRfVSndj30B3wBxE1+ijiBKk3etdgI2MyzNORQtOfl1qNVo7R+S+N/V:0RfQn+w8EYiBl5
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/432-5-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/1564-0-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/1564-6-0x0000000000400000-0x0000000000420000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads