sakula | cdb0162646b46be52283b7e92715a7c075e29754160b2c8a454a40d12f7b8986

Analysis

max time kernel
135s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
31/03/2024, 13:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
56365f2fb93bffdcde57469a848a1ae1_JaffaCakes118.exe
Size 392KB
Sample240331-q7a6vach3z
SHA256 cdb0162646b46be52283b7e92715a7c075e29754160b2c8a454a40d12f7b8986
MD5 56365f2fb93bffdcde57469a848a1ae1
SHA1 4a6c86cb593b2558939ab38cafb6fef61698bdd3
SHA512 2b08dbcc63287ad752111a22d685be77e914ddd3711ccf4197cd90947248e635b7c8f971174dc55d0e8a2c6ae4e74ba7a3ee55351afdf4a9819d3b9cb0b5a4e9
SSDEEP 6144:M29qRfVSndj30B3wBxE1+ijiBKk3etdgI2MyzNORQtOfl1qNVo7R+S+N/TU7kn5s:0RfQn+w8EYiBlMkn5f9J105V
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sakula persistence rat trojan

Malware Config

Extracted

Family

sakula

www.polarroute.com

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula payload 4 IoCs

resource	yara_rule
behavioral2/memory/1684-0-0x0000000000400000-0x0000000000420000-memory.dmp	family_sakula
behavioral2/files/0x000a0000000231a5-3.dat	family_sakula
behavioral2/memory/3704-5-0x0000000000400000-0x0000000000420000-memory.dmp	family_sakula
behavioral2/memory/1684-6-0x0000000000400000-0x0000000000420000-memory.dmp	family_sakula

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	56365f2fb93bffdcde57469a848a1ae1_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3704	MediaCenter.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	56365f2fb93bffdcde57469a848a1ae1_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2044	PING.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1684	56365f2fb93bffdcde57469a848a1ae1_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 3704	1684	56365f2fb93bffdcde57469a848a1ae1_JaffaCakes118.exe	85
PID 1684 wrote to memory of 3704	1684	56365f2fb93bffdcde57469a848a1ae1_JaffaCakes118.exe	85
PID 1684 wrote to memory of 3704	1684	56365f2fb93bffdcde57469a848a1ae1_JaffaCakes118.exe	85
PID 1684 wrote to memory of 2496	1684	56365f2fb93bffdcde57469a848a1ae1_JaffaCakes118.exe	97
PID 1684 wrote to memory of 2496	1684	56365f2fb93bffdcde57469a848a1ae1_JaffaCakes118.exe	97
PID 1684 wrote to memory of 2496	1684	56365f2fb93bffdcde57469a848a1ae1_JaffaCakes118.exe	97
PID 2496 wrote to memory of 2044	2496	cmd.exe	99
PID 2496 wrote to memory of 2044	2496	cmd.exe	99
PID 2496 wrote to memory of 2044	2496	cmd.exe	99

C:\Users\Admin\AppData\Local\Temp\56365f2fb93bffdcde57469a848a1ae1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\56365f2fb93bffdcde57469a848a1ae1_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
  C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\56365f2fb93bffdcde57469a848a1ae1_JaffaCakes118.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2496
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MediaCenter.exe

Path C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Size 392KB
SHA256 088f8f9041db5df07f0cfe680b678e6a89a9c4a545b10ab60e8c7940bc2625ad
MD5 996c3e3620072a866ed4f2da931b453e
SHA1 d52ac244821cd49fec3adb1ed7d3849363d5a476
SHA512 460ec3dd20ccafc92f836f20337433cdd501776c21a50b364030ce3e3482212ff65d02947c151e04a56ded99b1234ea8335734d6b2f68996ef294694a5609f69
SSDEEP 6144:M29qRfVSndj30B3wBxE1+ijiBKk3etdgI2MyzNORQtOfl1qNVo7R+S+N/TU7kn5/:0RfQn+w8EYiBlMkn5f9J105y
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1684-0-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/1684-6-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/3704-5-0x0000000000400000-0x0000000000420000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads