sakula | d8ef2a8d6a5be2ee473cfffc9ff2caf8f8e7d31c8f9f228174e5bd8c3544bbf6

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24/03/2024, 01:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d8ef2a8d6a5be2ee473cfffc9ff2caf8f8e7d31c8f9f228174e5bd8c3544bbf6.exe
Size 101KB
Sample240324-bpcjmaab3y
SHA256 d8ef2a8d6a5be2ee473cfffc9ff2caf8f8e7d31c8f9f228174e5bd8c3544bbf6
MD5 5d49673181ec2ef4326a832426b09a4b
SHA1 447ae72d5a418f738d33d9840d39418ef145550c
SHA512 945ca2ce8c5c769fbfa9e0ebffa5f27158d84518241929962a1387b0e56299a35632e99a312152659774bdb809ca4065c6643dc97b92b83e258b7aeaeb4dfa32
SSDEEP 1536:zJbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtrXv/z:dbfVk29te2jqxCEtg30BP
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sakula persistence rat trojan

Malware Config

Extracted

Family

sakula

www.savmpet.com

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula payload 1 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023208-3.dat	family_sakula

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	d8ef2a8d6a5be2ee473cfffc9ff2caf8f8e7d31c8f9f228174e5bd8c3544bbf6.exe

Executes dropped EXE 1 IoCs

pid	Process
2124	AdobeUpdate.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AdobeUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\AdobeUpdate.exe"	d8ef2a8d6a5be2ee473cfffc9ff2caf8f8e7d31c8f9f228174e5bd8c3544bbf6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2020	PING.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1860	d8ef2a8d6a5be2ee473cfffc9ff2caf8f8e7d31c8f9f228174e5bd8c3544bbf6.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 2124	1860	d8ef2a8d6a5be2ee473cfffc9ff2caf8f8e7d31c8f9f228174e5bd8c3544bbf6.exe	90
PID 1860 wrote to memory of 2124	1860	d8ef2a8d6a5be2ee473cfffc9ff2caf8f8e7d31c8f9f228174e5bd8c3544bbf6.exe	90
PID 1860 wrote to memory of 2124	1860	d8ef2a8d6a5be2ee473cfffc9ff2caf8f8e7d31c8f9f228174e5bd8c3544bbf6.exe	90
PID 1860 wrote to memory of 1680	1860	d8ef2a8d6a5be2ee473cfffc9ff2caf8f8e7d31c8f9f228174e5bd8c3544bbf6.exe	104
PID 1860 wrote to memory of 1680	1860	d8ef2a8d6a5be2ee473cfffc9ff2caf8f8e7d31c8f9f228174e5bd8c3544bbf6.exe	104
PID 1860 wrote to memory of 1680	1860	d8ef2a8d6a5be2ee473cfffc9ff2caf8f8e7d31c8f9f228174e5bd8c3544bbf6.exe	104
PID 1680 wrote to memory of 2020	1680	cmd.exe	106
PID 1680 wrote to memory of 2020	1680	cmd.exe	106
PID 1680 wrote to memory of 2020	1680	cmd.exe	106

C:\Users\Admin\AppData\Local\Temp\d8ef2a8d6a5be2ee473cfffc9ff2caf8f8e7d31c8f9f228174e5bd8c3544bbf6.exe
"C:\Users\Admin\AppData\Local\Temp\d8ef2a8d6a5be2ee473cfffc9ff2caf8f8e7d31c8f9f228174e5bd8c3544bbf6.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe
  C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\d8ef2a8d6a5be2ee473cfffc9ff2caf8f8e7d31c8f9f228174e5bd8c3544bbf6.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1680
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AdobeUpdate.exe

Path C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe
Size 101KB
SHA256 ec86e6052a3f08a46fb1ed8ee06545cfb4a1ca13f93bcf9e73fb94bc639b6bea
MD5 636335845ea0408a29b9d8c471928afb
SHA1 8077afe0e3fa1ec0f7b6cd7f6825c8b18f2851f3
SHA512 f2da53aebcd1e21d0d45cfa63374285773d075ff503afc285033aaae07a9478fd1e82d71b771ca108d22a521de8efccbda382de9bf4ff8c7dfc2af0852b12fcd
SSDEEP 1536:zJbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtrXv/m:dbfVk29te2jqxCEtg30Bi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads