sakula | 179ded5b9770bda8925eb98ed58c25f672cdfe2b435227fe1e646cd5827f5713

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
31/03/2024, 00:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4889443e1899077b93dc8af4a117580e_JaffaCakes118.exe
Size 35KB
Sample240331-ax9zesah98
SHA256 179ded5b9770bda8925eb98ed58c25f672cdfe2b435227fe1e646cd5827f5713
MD5 4889443e1899077b93dc8af4a117580e
SHA1 63f2bdd9f5a7d0f51a12a11b171a41bfdae2599c
SHA512 23e3ccacf6820f514021eeb2582ff2603d06adeee4a32a14780b985a5c229a7f0157b6a146499e579266d3180ae4d6d2b3caa4ba67230535722a29b203ee4d2a
SSDEEP 768:TwbYGCv4nuEcJpQK4TQbtKvXwXgA9lJJea+yGCJQqeWnAEv2647D5:TwbYP4nuEApQK4TQbtY2gA9DX+ytBOv
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula payload 4 IoCs

resource	yara_rule
behavioral2/memory/2936-6-0x0000000000400000-0x000000000041A000-memory.dmp	family_sakula
behavioral2/memory/3616-7-0x0000000000400000-0x000000000041A000-memory.dmp	family_sakula
behavioral2/memory/2936-12-0x0000000000400000-0x000000000041A000-memory.dmp	family_sakula
behavioral2/memory/3616-16-0x0000000000400000-0x000000000041A000-memory.dmp	family_sakula

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation	4889443e1899077b93dc8af4a117580e_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3616	MediaCenter.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	4889443e1899077b93dc8af4a117580e_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2884	PING.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2936	4889443e1899077b93dc8af4a117580e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 3616	2936	4889443e1899077b93dc8af4a117580e_JaffaCakes118.exe	85
PID 2936 wrote to memory of 3616	2936	4889443e1899077b93dc8af4a117580e_JaffaCakes118.exe	85
PID 2936 wrote to memory of 3616	2936	4889443e1899077b93dc8af4a117580e_JaffaCakes118.exe	85
PID 2936 wrote to memory of 5108	2936	4889443e1899077b93dc8af4a117580e_JaffaCakes118.exe	97
PID 2936 wrote to memory of 5108	2936	4889443e1899077b93dc8af4a117580e_JaffaCakes118.exe	97
PID 2936 wrote to memory of 5108	2936	4889443e1899077b93dc8af4a117580e_JaffaCakes118.exe	97
PID 5108 wrote to memory of 2884	5108	cmd.exe	99
PID 5108 wrote to memory of 2884	5108	cmd.exe	99
PID 5108 wrote to memory of 2884	5108	cmd.exe	99

C:\Users\Admin\AppData\Local\Temp\4889443e1899077b93dc8af4a117580e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4889443e1899077b93dc8af4a117580e_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
  C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\4889443e1899077b93dc8af4a117580e_JaffaCakes118.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5108
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MediaCenter.exe

Path C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Size 35KB
SHA256 9745e66ddf77a93ffc6ed7ac82c10e6b58f9edcfb9c024e99aacac7d78808874
MD5 ebe63736154890a6689095bfd2ed2525
SHA1 51c2ca08ef510a4eb6c43f7d2a27c8db2db4b143
SHA512 2c10d8d1d099131160444d1b1c34e6d0f84b211770eef7b2e78438b22e701bd40750b3a9da28ab36cf42c47972f9df5499c6ec64c0b85c32f7cf98617f9249c3
SSDEEP 768:TwbYGCv4nuEcJpQK4TQbtKvXwXgA9lJJea+yGCJQqeWnAEv2647Dc:TwbYP4nuEApQK4TQbtY2gA9DX+ytBOO
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2936-0-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/2936-6-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/2936-12-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/3616-5-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/3616-7-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/3616-16-0x0000000000400000-0x000000000041A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads