sakula | d56676a1d7ac0b6a1a7615c6d0adda39d879109c323b3734ac2cf223a0dd27be

Analysis

max time kernel
172s
max time network
183s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20/12/2023, 17:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f77db66a92540bbb9b856c43e84765a3.exe
Size 4.0MB
Sample231220-v2epasaae8
SHA256 d56676a1d7ac0b6a1a7615c6d0adda39d879109c323b3734ac2cf223a0dd27be
MD5 f77db66a92540bbb9b856c43e84765a3
SHA1 6f97ba67f60ef1dc2fc761a60ea6e6273351b499
SHA512 7e07eeb351744e8b012fe13e3959d38b0ea3696af1da89d388d24918f8fafc6d4b8d662c226000777f57a4beb0c1bddf8f95c9746e2405714673f297c099f04d
SSDEEP 24576:DF9mrnE2Z1y/6oTNBZrBEu8C7jnIQCwRO/wTGS5DBMYR:DD2Z1qT3Zz888QCwRO/wT/aYR
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023239-1.dat	family_sakula
behavioral2/files/0x0007000000023239-3.dat	family_sakula

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation	f77db66a92540bbb9b856c43e84765a3.exe

Executes dropped EXE 1 IoCs

pid	Process
3044	MediaCenter.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	f77db66a92540bbb9b856c43e84765a3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
752	PING.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3328	f77db66a92540bbb9b856c43e84765a3.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3328 wrote to memory of 3044	3328	f77db66a92540bbb9b856c43e84765a3.exe	90
PID 3328 wrote to memory of 3044	3328	f77db66a92540bbb9b856c43e84765a3.exe	90
PID 3328 wrote to memory of 3044	3328	f77db66a92540bbb9b856c43e84765a3.exe	90
PID 3328 wrote to memory of 2872	3328	f77db66a92540bbb9b856c43e84765a3.exe	99
PID 3328 wrote to memory of 2872	3328	f77db66a92540bbb9b856c43e84765a3.exe	99
PID 3328 wrote to memory of 2872	3328	f77db66a92540bbb9b856c43e84765a3.exe	99
PID 2872 wrote to memory of 752	2872	cmd.exe	101
PID 2872 wrote to memory of 752	2872	cmd.exe	101
PID 2872 wrote to memory of 752	2872	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\f77db66a92540bbb9b856c43e84765a3.exe
"C:\Users\Admin\AppData\Local\Temp\f77db66a92540bbb9b856c43e84765a3.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3328
- C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
  C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\f77db66a92540bbb9b856c43e84765a3.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MediaCenter.exe

Path C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Size 78KB
SHA256 3d6929c9edf83411e56768f3e7ae965b8dcd6dd4ddb28561b9d64c05bcebfb23
MD5 984658d566d1274c10f8728c0f504fdc
SHA1 4c40735290f710a15923aa068446bbb019b96308
SHA512 9e6b90f3aa729a7b5781ea5454b8dc1ace47781d7e23089f65e3f42a70187eb69a93a9ef2c2de62b5d5dd89aefc4697dbc56932c4158d4f09c4f99a3f5a076c5
SSDEEP 768:bWlxK9QR/zuwcjFvhJL5bRPg9tTfhqMWUsLCboaleTBzbCGhgpOo7h0XQ72Pff3:/oaj1hJL1S9t0MIeboal8bCKxo7h0RPH
MD5 SHA1 SHA512 SSDEEP

Submit Download

MediaCenter.exe

Path C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Size 1.5MB
SHA256 3e7de25fffdabae852459d881371ee5cb6ad4a7504788c6ead0569eb58665dd4
MD5 896f7f446acbf7a1fdbe86934cfba1f1
SHA1 314e76869d898c2125fcd561d16de5e1195b84ae
SHA512 c10ce8648b86017b08517519db484cfc81bee7ad80921fa149a6d537c456bd6ebb16c0883f144ff7685bf8dbb7eb6f3d4f45f19591bbe056a299957fe7854701
SSDEEP 12288:A0U6v9MsLXr9AK3cyNmPrY+roZtkZy724Gfk+Mpsw/oHoTyeu5+nH4uaJNg:DF9mrnE2Z1y/6oTNf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads