sakula | f04d0a101eb79d7d065c7921fa22849b8f060bde7ae350b0746d422f5eb99b73

Analysis

max time kernel
136s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20-12-2023 14:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c6a39b44ecdb5f32e9b9081ce3556ab5.exe
Size

321KB
MD5

c6a39b44ecdb5f32e9b9081ce3556ab5
SHA1

0a26d32fcb9ccad529df099652a4bdee5457942a
SHA256

f04d0a101eb79d7d065c7921fa22849b8f060bde7ae350b0746d422f5eb99b73
SHA512

b5fe29fb559d3c2939ffe4ec7932705001f46f832818fab56fdb3b11f8fb55afc3430fab12a8fcc982fbd1b88c60ed950c18782c374492b84f1eb4925cd83169
SSDEEP

1536:aoaj1hJL1S9t0MIeboal8bCKxo7h0RP0jwHVz30rtroZeBsCXKTnhxJv:F0hpgz6xGhTjwHN30BE8BsZhX

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

c6a39b44ecdb5f32e9b9081ce3556ab5.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	c6a39b44ecdb5f32e9b9081ce3556ab5.exe

Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

208 MediaCenter.exe

pid	process
208	MediaCenter.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

c6a39b44ecdb5f32e9b9081ce3556ab5.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	c6a39b44ecdb5f32e9b9081ce3556ab5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

3480 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

c6a39b44ecdb5f32e9b9081ce3556ab5.exe

description pid process

Token: SeIncBasePriorityPrivilege 2312 c6a39b44ecdb5f32e9b9081ce3556ab5.exe

pid	process
3480	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	2312	c6a39b44ecdb5f32e9b9081ce3556ab5.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

c6a39b44ecdb5f32e9b9081ce3556ab5.execmd.exe

description	pid	process	target process
PID 2312 wrote to memory of 208	2312	c6a39b44ecdb5f32e9b9081ce3556ab5.exe	MediaCenter.exe
PID 2312 wrote to memory of 208	2312	c6a39b44ecdb5f32e9b9081ce3556ab5.exe	MediaCenter.exe
PID 2312 wrote to memory of 208	2312	c6a39b44ecdb5f32e9b9081ce3556ab5.exe	MediaCenter.exe
PID 2312 wrote to memory of 3464	2312	c6a39b44ecdb5f32e9b9081ce3556ab5.exe	cmd.exe
PID 2312 wrote to memory of 3464	2312	c6a39b44ecdb5f32e9b9081ce3556ab5.exe	cmd.exe
PID 2312 wrote to memory of 3464	2312	c6a39b44ecdb5f32e9b9081ce3556ab5.exe	cmd.exe
PID 3464 wrote to memory of 3480	3464	cmd.exe	PING.EXE
PID 3464 wrote to memory of 3480	3464	cmd.exe	PING.EXE
PID 3464 wrote to memory of 3480	3464	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\c6a39b44ecdb5f32e9b9081ce3556ab5.exe
"C:\Users\Admin\AppData\Local\Temp\c6a39b44ecdb5f32e9b9081ce3556ab5.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2312

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:208

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\c6a39b44ecdb5f32e9b9081ce3556ab5.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:3464

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:3480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Filesize
29KB

MD5
018dc52a3ef2de4a76bf89624deff218

SHA1
b9a0fe2994f56a040beb1b7ca2d950bd9b4a97df

SHA256
de0c9213c67649951fc8a118dce108c3b842f6377c67a8a8e11d2d052c9afe4b

SHA512
5aaa143de2b9335761f0c4776e43603f163d591a8eead276c7ff80d9d3a51a017d2711e92ca64742d9b75b25aad18194e15337b2f9866e872ccf85ea103a141e

Download Submit
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Filesize
5KB

MD5
4ec1e67b219a23b00230d8062513e5d9

SHA1
f7b5d6e39f5ee69a5038ceb67020f9403f6b98ac

SHA256
a0d6909510d198181d904e040d98ec270ae299a48424898f11dac4012849bc13

SHA512
b798d7ecacc1191a45f6f10b8b2ddde1012df93178a9af368fe9240a09681b34f959e402d9c9c006131c6cd3e47d243108323d391471df51bd16c2afe64777b2

Download Submit