sakula | c2b7e85e10b25b7512e244c94e2d93af7d76d3d4e0abc1e220789848fc43460f

General

Target
6c5a5879f7b6a752a46403039b2bcbdc_JaffaCakes118.exe
Size 58KB
Sample240401-jv21gaha51
SHA256 c2b7e85e10b25b7512e244c94e2d93af7d76d3d4e0abc1e220789848fc43460f
MD5 6c5a5879f7b6a752a46403039b2bcbdc
SHA1 0a698f2f1800fe337801e6201061953479ff1993
SHA512 17f7646b0f912656f6e9bc33c108a8bec34f143a3ea8d6f5286cd8f079f3e7ac59ffc7b74db950e6cfc3e3388f13ae4f9f3bf1e377a86d50b6ee311c606c7d80
SSDEEP 1536:iZioIoCwbYP4nuEApQK4TQbtY2gA9DX+ytBO8c3G3eTJ/R:iEoIlwIguEA4c5DgA9DOyq0eFp
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula payload 4 IoCs

resource	yara_rule
behavioral2/memory/4008-6-0x0000000000400000-0x000000000041A000-memory.dmp	family_sakula
behavioral2/memory/3516-7-0x0000000000400000-0x000000000041A000-memory.dmp	family_sakula
behavioral2/memory/4008-12-0x0000000000400000-0x000000000041A000-memory.dmp	family_sakula
behavioral2/memory/3516-15-0x0000000000400000-0x000000000041A000-memory.dmp	family_sakula

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Control Panel\International\Geo\Nation	6c5a5879f7b6a752a46403039b2bcbdc_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3516	MediaCenter.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	6c5a5879f7b6a752a46403039b2bcbdc_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3936	PING.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4008	6c5a5879f7b6a752a46403039b2bcbdc_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4008 wrote to memory of 3516	4008	6c5a5879f7b6a752a46403039b2bcbdc_JaffaCakes118.exe	94
PID 4008 wrote to memory of 3516	4008	6c5a5879f7b6a752a46403039b2bcbdc_JaffaCakes118.exe	94
PID 4008 wrote to memory of 3516	4008	6c5a5879f7b6a752a46403039b2bcbdc_JaffaCakes118.exe	94
PID 4008 wrote to memory of 4964	4008	6c5a5879f7b6a752a46403039b2bcbdc_JaffaCakes118.exe	108
PID 4008 wrote to memory of 4964	4008	6c5a5879f7b6a752a46403039b2bcbdc_JaffaCakes118.exe	108
PID 4008 wrote to memory of 4964	4008	6c5a5879f7b6a752a46403039b2bcbdc_JaffaCakes118.exe	108
PID 4964 wrote to memory of 3936	4964	cmd.exe	110
PID 4964 wrote to memory of 3936	4964	cmd.exe	110
PID 4964 wrote to memory of 3936	4964	cmd.exe	110

C:\Users\Admin\AppData\Local\Temp\6c5a5879f7b6a752a46403039b2bcbdc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6c5a5879f7b6a752a46403039b2bcbdc_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4008
- C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
  C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\6c5a5879f7b6a752a46403039b2bcbdc_JaffaCakes118.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4964
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:3936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3996 --field-trial-handle=2228,i,17475224967547320003,13667387715861799238,262144 --variations-seed-version /prefetch:8
1⤵
PID:2176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MediaCenter.exe

Path C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Size 58KB
SHA256 8eded356f5467a865dacd451aa8668fc867f0d4b752adf74d386b3a090c9199b
MD5 348122cda34c9f201cbf0117f938d729
SHA1 b64661e709e1c6c4984d7e4cb05662a2308e099e
SHA512 e4a65d09ae89dc2907ace2efe31b65ee1f98fb7672a41d1afb119ed3dbf3b20e69218f9173b88eee1d15ff3beb9d8e1e0fc49a78ca8dc5df9fb4d70f4c5e097e
SSDEEP 1536:iZioIoCwbYP4nuEApQK4TQbtY2gA9DX+ytBO8c3G3eTJ/5:iEoIlwIguEA4c5DgA9DOyq0eFh
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3516-5-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/3516-7-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/3516-15-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/4008-0-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/4008-6-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/4008-12-0x0000000000400000-0x000000000041A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads