sakula | 8d9c47fbbf2f0c967a3bb57a996234dd1a7d67d9f1aeebe4d1d55c4a932b21cd

General

Target
8d9c47fbbf2f0c967a3bb57a996234dd1a7d67d9f1aeebe4d1d55c4a932b21cd.exe
Size 36KB
Sample240317-1p4esagh78
SHA256 8d9c47fbbf2f0c967a3bb57a996234dd1a7d67d9f1aeebe4d1d55c4a932b21cd
MD5 82d5254355bbcd6c8ba7c2d9b9edcc43
SHA1 ab3af03551116accb499c0667fe95a6e6e2301ec
SHA512 4b0864ea395110862865af0da7991ba50d2ac9bedee1c4bf123baff6c8fa66c68f5c467862bdce9288ae0c6fb5c15ceca5fab9a5fb7b00dbb40a9d97b7dcd372
SSDEEP 768:lwbYGCv4nuEcJpQK4TQbtKvXwXgA9lJJea+yGCJQqeWnAEv2647Dr:lwbYP4nuEApQK4TQbtY2gA9DX+ytBO9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula payload 4 IoCs

resource	yara_rule
behavioral2/memory/2740-5-0x0000000000400000-0x000000000041A000-memory.dmp	family_sakula
behavioral2/memory/4488-6-0x0000000000400000-0x000000000041A000-memory.dmp	family_sakula
behavioral2/memory/2740-11-0x0000000000400000-0x000000000041A000-memory.dmp	family_sakula
behavioral2/memory/4488-16-0x0000000000400000-0x000000000041A000-memory.dmp	family_sakula

Detects executables built or packed with MPress PE compressor 6 IoCs

resource	yara_rule
behavioral2/memory/2740-0-0x0000000000400000-0x000000000041A000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/files/0x000d00000002313f-3.dat	INDICATOR_EXE_Packed_MPress
behavioral2/memory/2740-5-0x0000000000400000-0x000000000041A000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4488-6-0x0000000000400000-0x000000000041A000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/2740-11-0x0000000000400000-0x000000000041A000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4488-16-0x0000000000400000-0x000000000041A000-memory.dmp	INDICATOR_EXE_Packed_MPress

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	8d9c47fbbf2f0c967a3bb57a996234dd1a7d67d9f1aeebe4d1d55c4a932b21cd.exe

Executes dropped EXE 1 IoCs

pid	Process
4488	MediaCenter.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	8d9c47fbbf2f0c967a3bb57a996234dd1a7d67d9f1aeebe4d1d55c4a932b21cd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4160	PING.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2740	8d9c47fbbf2f0c967a3bb57a996234dd1a7d67d9f1aeebe4d1d55c4a932b21cd.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 4488	2740	8d9c47fbbf2f0c967a3bb57a996234dd1a7d67d9f1aeebe4d1d55c4a932b21cd.exe	88
PID 2740 wrote to memory of 4488	2740	8d9c47fbbf2f0c967a3bb57a996234dd1a7d67d9f1aeebe4d1d55c4a932b21cd.exe	88
PID 2740 wrote to memory of 4488	2740	8d9c47fbbf2f0c967a3bb57a996234dd1a7d67d9f1aeebe4d1d55c4a932b21cd.exe	88
PID 2740 wrote to memory of 3680	2740	8d9c47fbbf2f0c967a3bb57a996234dd1a7d67d9f1aeebe4d1d55c4a932b21cd.exe	103
PID 2740 wrote to memory of 3680	2740	8d9c47fbbf2f0c967a3bb57a996234dd1a7d67d9f1aeebe4d1d55c4a932b21cd.exe	103
PID 2740 wrote to memory of 3680	2740	8d9c47fbbf2f0c967a3bb57a996234dd1a7d67d9f1aeebe4d1d55c4a932b21cd.exe	103
PID 3680 wrote to memory of 4160	3680	cmd.exe	105
PID 3680 wrote to memory of 4160	3680	cmd.exe	105
PID 3680 wrote to memory of 4160	3680	cmd.exe	105

C:\Users\Admin\AppData\Local\Temp\8d9c47fbbf2f0c967a3bb57a996234dd1a7d67d9f1aeebe4d1d55c4a932b21cd.exe
"C:\Users\Admin\AppData\Local\Temp\8d9c47fbbf2f0c967a3bb57a996234dd1a7d67d9f1aeebe4d1d55c4a932b21cd.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
  C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\8d9c47fbbf2f0c967a3bb57a996234dd1a7d67d9f1aeebe4d1d55c4a932b21cd.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3680
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:4160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MediaCenter.exe

Path C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Size 36KB
SHA256 56e10b502e9d3f98c7f2ed511fa8215b2f861a32116fdabb49f0c081f0eecb39
MD5 a76e36ad021e4924d7d651036bad6248
SHA1 eaf455de541738740f2fd693bb0d060697aad76d
SHA512 3c6c7fb04c1d0c53046a8095a61822abb4ce75724d880878a39f9a121dacd96aaf7ccd93f75da31c7f6809229ed3a9f5c90e52e587f8ae938f14c77fb27e27be
SSDEEP 768:lwbYGCv4nuEcJpQK4TQbtKvXwXgA9lJJea+yGCJQqeWnAEv2647DH:lwbYP4nuEApQK4TQbtY2gA9DX+ytBOF
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2740-0-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/2740-5-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/2740-11-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/4488-6-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/4488-16-0x0000000000400000-0x000000000041A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads