sakula | 614125d2854a27a069d9d47eb0ae7632ba254939dbd05675554c19b142181e36

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
31/03/2024, 18:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5ad898a4daa12b6eafc0da90dd849338_JaffaCakes118.exe
Size 36KB
Sample240331-w7aszahd27
SHA256 614125d2854a27a069d9d47eb0ae7632ba254939dbd05675554c19b142181e36
MD5 5ad898a4daa12b6eafc0da90dd849338
SHA1 6107896e7e768e48040bccf98cb591718178bbd6
SHA512 cead1e9ecfc11b791db67fb89f09fb307640357f8c41cfcdb7ca20012ddf8858cf70a5217a50da2e4c6e76d69e22a14977933ed5b7de76e5c3124a406fd17167
SSDEEP 768:H1xwbYGCv4nuEcJpQK4TQbtKvXwXgA9lJJea+yGCJQqeWnAEv26S7Dm:nwbYP4nuEApQK4TQbtY2gA9DX+ytBOy
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula payload 5 IoCs

resource	yara_rule
behavioral2/memory/220-5-0x0000000000400000-0x000000000041A000-memory.dmp	family_sakula
behavioral2/memory/4108-6-0x0000000000400000-0x000000000041A000-memory.dmp	family_sakula
behavioral2/memory/220-7-0x0000000000400000-0x000000000041A000-memory.dmp	family_sakula
behavioral2/memory/4108-12-0x0000000000400000-0x000000000041A000-memory.dmp	family_sakula
behavioral2/memory/220-17-0x0000000000400000-0x000000000041A000-memory.dmp	family_sakula

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation	5ad898a4daa12b6eafc0da90dd849338_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
220	MediaCenter.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	5ad898a4daa12b6eafc0da90dd849338_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1596	PING.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4108	5ad898a4daa12b6eafc0da90dd849338_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4108 wrote to memory of 220	4108	5ad898a4daa12b6eafc0da90dd849338_JaffaCakes118.exe	86
PID 4108 wrote to memory of 220	4108	5ad898a4daa12b6eafc0da90dd849338_JaffaCakes118.exe	86
PID 4108 wrote to memory of 220	4108	5ad898a4daa12b6eafc0da90dd849338_JaffaCakes118.exe	86
PID 4108 wrote to memory of 3904	4108	5ad898a4daa12b6eafc0da90dd849338_JaffaCakes118.exe	99
PID 4108 wrote to memory of 3904	4108	5ad898a4daa12b6eafc0da90dd849338_JaffaCakes118.exe	99
PID 4108 wrote to memory of 3904	4108	5ad898a4daa12b6eafc0da90dd849338_JaffaCakes118.exe	99
PID 3904 wrote to memory of 1596	3904	cmd.exe	101
PID 3904 wrote to memory of 1596	3904	cmd.exe	101
PID 3904 wrote to memory of 1596	3904	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\5ad898a4daa12b6eafc0da90dd849338_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5ad898a4daa12b6eafc0da90dd849338_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
  C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\5ad898a4daa12b6eafc0da90dd849338_JaffaCakes118.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3904
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MediaCenter.exe

Path C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Size 36KB
SHA256 f7ab32eef20a4045bdeb5a0c1162f425530508c133b1bc841cf8406dc3de00b0
MD5 1791b0abb9286a332feea32a75f71c96
SHA1 24345aa84ca9c7158ce4c9e1db39f3cbfeb743b4
SHA512 b3abd36d64035a4c294f589949e269946960fd2c6fd01c5f7b43768933f24ee14e67074a6f6b045c1207e72d42fbe7ed1d93eb548e171ed9c80e4aa5f1a389b7
SSDEEP 768:H1xwbYGCv4nuEcJpQK4TQbtKvXwXgA9lJJea+yGCJQqeWnAEv26S7Dk:nwbYP4nuEApQK4TQbtY2gA9DX+ytBOQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/220-5-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/220-7-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/220-17-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/4108-0-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/4108-6-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/4108-12-0x0000000000400000-0x000000000041A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads