sakula | 70026ec3929b27d3b7979666f6269ba6d6c5691abe9c4eb63fd04989c348f0c1

Analysis

max time kernel
123s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01/04/2024, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
67c7700fab60cf97a0ce65b9c9440fc6_JaffaCakes118.exe
Size 4.5MB
Sample240401-e5jjnade8t
SHA256 70026ec3929b27d3b7979666f6269ba6d6c5691abe9c4eb63fd04989c348f0c1
MD5 67c7700fab60cf97a0ce65b9c9440fc6
SHA1 afd6383b5e060dadb3adc7993ae52216477d797d
SHA512 38a20dbbd026276cd20d94a69b3fef0567e0026117ba7fdb38a999784c7c99e6ad7cb08237a097eb7e376e608e17fa13fa8f412d90194b51678618aa88dfaa3c
SSDEEP 24576:0+9mrnE2Zjll/6b8h3UZrgEu8CkBW+M3nXvIMfhlG144EE/f5DBMYz:0Y2ZjlkWEZw8Jk+EXvIMfP4FRaYz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula payload 1 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023202-2.dat	family_sakula

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	67c7700fab60cf97a0ce65b9c9440fc6_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3624	MediaCenter.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	67c7700fab60cf97a0ce65b9c9440fc6_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1304	PING.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	436	67c7700fab60cf97a0ce65b9c9440fc6_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 436 wrote to memory of 3624	436	67c7700fab60cf97a0ce65b9c9440fc6_JaffaCakes118.exe	85
PID 436 wrote to memory of 3624	436	67c7700fab60cf97a0ce65b9c9440fc6_JaffaCakes118.exe	85
PID 436 wrote to memory of 3624	436	67c7700fab60cf97a0ce65b9c9440fc6_JaffaCakes118.exe	85
PID 436 wrote to memory of 1652	436	67c7700fab60cf97a0ce65b9c9440fc6_JaffaCakes118.exe	94
PID 436 wrote to memory of 1652	436	67c7700fab60cf97a0ce65b9c9440fc6_JaffaCakes118.exe	94
PID 436 wrote to memory of 1652	436	67c7700fab60cf97a0ce65b9c9440fc6_JaffaCakes118.exe	94
PID 1652 wrote to memory of 1304	1652	cmd.exe	96
PID 1652 wrote to memory of 1304	1652	cmd.exe	96
PID 1652 wrote to memory of 1304	1652	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\67c7700fab60cf97a0ce65b9c9440fc6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\67c7700fab60cf97a0ce65b9c9440fc6_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:436
- C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
  C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\67c7700fab60cf97a0ce65b9c9440fc6_JaffaCakes118.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1652
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MediaCenter.exe

Path C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Size 4.5MB
SHA256 b5b2b61c09965fb2e86b4be7d8a801be45baab78b586079e0b77acdf865a0fbf
MD5 4187f6fb40cbe6937fb32ae824e399b2
SHA1 c2aaa6f4dca05a4b443ecd4052f8b528e90352b1
SHA512 14268915769974724b44676a6d565355c217f647c1d0ab443d252ad136ca230dc1a2891e382b5e24929f91b92a2503a664c5726e25638703849c506fd36134b5
SSDEEP 24576:0+9mrnE2Zjll/6b8h3UZrgEu8CkBW+M3nXvIMfhlG144EE/f5DBMYG:0Y2ZjlkWEZw8Jk+EXvIMfP4FRaYG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads