sakula | 649c2ef6b04787808f2bb095ba64ad8d91d11cc9fa4c35a6ece16d6ccf6fd1f2

Analysis

max time kernel
138s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20/12/2023, 13:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bf867e69a0281772a1cb85e0a566ad34.exe
Size 4.5MB
Sample231220-rahebsdccl
SHA256 649c2ef6b04787808f2bb095ba64ad8d91d11cc9fa4c35a6ece16d6ccf6fd1f2
MD5 bf867e69a0281772a1cb85e0a566ad34
SHA1 f14483457c82a40c34a2876b56331477b1beca25
SHA512 3c114090a9c1654c1e67d7f5bb2be4d3856a0db8eb84903bb171284667817ab314cbebb59710fcee54c8ede0831437efcb7dba0f086905c2ac7b01f5912de37d
SSDEEP 24576:0+9mrnE2Zjll/6b8h3UZrgEu8CkBW+M3nXvIMfhlG144EE/f5DBMYp:0Y2ZjlkWEZw8Jk+EXvIMfP4FRaYp
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000600000002321b-3.dat	family_sakula
behavioral2/files/0x000600000002321b-2.dat	family_sakula

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	bf867e69a0281772a1cb85e0a566ad34.exe

Executes dropped EXE 1 IoCs

pid	Process
2828	MediaCenter.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	bf867e69a0281772a1cb85e0a566ad34.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2908	PING.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4020	bf867e69a0281772a1cb85e0a566ad34.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4020 wrote to memory of 2828	4020	bf867e69a0281772a1cb85e0a566ad34.exe	92
PID 4020 wrote to memory of 2828	4020	bf867e69a0281772a1cb85e0a566ad34.exe	92
PID 4020 wrote to memory of 2828	4020	bf867e69a0281772a1cb85e0a566ad34.exe	92
PID 4020 wrote to memory of 3464	4020	bf867e69a0281772a1cb85e0a566ad34.exe	97
PID 4020 wrote to memory of 3464	4020	bf867e69a0281772a1cb85e0a566ad34.exe	97
PID 4020 wrote to memory of 3464	4020	bf867e69a0281772a1cb85e0a566ad34.exe	97
PID 3464 wrote to memory of 2908	3464	cmd.exe	99
PID 3464 wrote to memory of 2908	3464	cmd.exe	99
PID 3464 wrote to memory of 2908	3464	cmd.exe	99

C:\Users\Admin\AppData\Local\Temp\bf867e69a0281772a1cb85e0a566ad34.exe
"C:\Users\Admin\AppData\Local\Temp\bf867e69a0281772a1cb85e0a566ad34.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4020
- C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
  C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\bf867e69a0281772a1cb85e0a566ad34.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3464
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MediaCenter.exe

Path C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Size 1.8MB
SHA256 2548ef61ec5c49457f925ab714979690fcad2af806b08244a97744917ebc282f
MD5 022cf97b22cadb72e3b9b923679c8640
SHA1 40ef55d68699f55a7e568220e7eeedca05a194bb
SHA512 870fb0990a837a8203ccbe4e670b7d4ed6ee547151a437cba15ff10ce4bd82979699e7f5830ace5c6b406f76d1dcd223b34a6167cf18ed7750a1b4fa000deaca
SSDEEP 12288:+0U6v0+Xr9AK3cyNmPrY+roZtkZPE88KhTE72XG14/oHb8h3CUuZrgfEu8Ck0sDN:0+9mrnE2Zjll/6b8h3UZrgEu8Ckp
MD5 SHA1 SHA512 SSDEEP

Submit Download

MediaCenter.exe

Path C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Size 1.4MB
SHA256 aa3d3b71e47ff4fdfeab21cf7a2ba6724b5197cc5b0f497462af68215eba4b98
MD5 bd89ae131767bbcb0d95dc905b111285
SHA1 e2f20d97b1fad9b64234eae924b25e81e652fb18
SHA512 39c27092e65b541464e46329e4464cd1955d9815d87d7e479282cbf5f4c172fbcbba72913682aabde22341ad382541132d9b2c46c359d129fc41479aaef45bba
SSDEEP 12288:+0U6v0+Xr9AK3cyNmPrY+roZtkZPE88KhTE72XG14/oH4:0+9mrnE2Zjll/64
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads