sakula | 094e52199914e48af79620b38e2561d25e2ae6cad155c20dc25ba904c02bbaeb

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 16:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b933b44c5a0ab28ce50d5bfe6ad735c0_NEIKI.exe
Size 332KB
Sample240508-vac2dsgd87
SHA256 094e52199914e48af79620b38e2561d25e2ae6cad155c20dc25ba904c02bbaeb
MD5 b933b44c5a0ab28ce50d5bfe6ad735c0
SHA1 b745072e5e6dc0bc6f844d08f832ca732eff1497
SHA512 3d278648445efb9377ca0a968a0016430967dda9129734ca8d3e32b9c25cf5798a3da51f1f7779111d9d289726c6ffa4701513b03ff664b15491acf0ee7bdf42
SSDEEP 6144:Nj9c2WYd30BKmiPVpU3ypIPr3D3StNynyS/S:NSI2H+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sakula persistence rat trojan

Malware Config

Extracted

Family

sakula

www.savmpet.com

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula payload 1 IoCs

resource	yara_rule
behavioral2/files/0x00090000000233bb-2.dat	family_sakula

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	b933b44c5a0ab28ce50d5bfe6ad735c0_NEIKI.exe

Executes dropped EXE 1 IoCs

pid	Process
2336	AdobeUpdate.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AdobeUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\AdobeUpdate.exe"	b933b44c5a0ab28ce50d5bfe6ad735c0_NEIKI.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1908	PING.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1456	b933b44c5a0ab28ce50d5bfe6ad735c0_NEIKI.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 2336	1456	b933b44c5a0ab28ce50d5bfe6ad735c0_NEIKI.exe	79
PID 1456 wrote to memory of 2336	1456	b933b44c5a0ab28ce50d5bfe6ad735c0_NEIKI.exe	79
PID 1456 wrote to memory of 2336	1456	b933b44c5a0ab28ce50d5bfe6ad735c0_NEIKI.exe	79
PID 1456 wrote to memory of 4520	1456	b933b44c5a0ab28ce50d5bfe6ad735c0_NEIKI.exe	80
PID 1456 wrote to memory of 4520	1456	b933b44c5a0ab28ce50d5bfe6ad735c0_NEIKI.exe	80
PID 1456 wrote to memory of 4520	1456	b933b44c5a0ab28ce50d5bfe6ad735c0_NEIKI.exe	80
PID 4520 wrote to memory of 1908	4520	cmd.exe	82
PID 4520 wrote to memory of 1908	4520	cmd.exe	82
PID 4520 wrote to memory of 1908	4520	cmd.exe	82

C:\Users\Admin\AppData\Local\Temp\b933b44c5a0ab28ce50d5bfe6ad735c0_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\b933b44c5a0ab28ce50d5bfe6ad735c0_NEIKI.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe
  C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\b933b44c5a0ab28ce50d5bfe6ad735c0_NEIKI.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4520
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AdobeUpdate.exe

Path C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe
Size 332KB
SHA256 464aeaeb55a30d8268aff4ed8c190e6d2b9339de980d61c3b041f44c9289b206
MD5 2c4faf3fc9257bb0b837b82031232017
SHA1 e4eff06e6dbe68dacc3a6314b26fc78fa568ad1b
SHA512 ed7ddff7e09a362f39f3fe5a2770d8cc64a51c90f54f9b15355cb201d82976d78cb1bf2255ddfe9400032c6ce2e081bbc0701a4ff3a658d6fbb245fa7a19d9f9
SSDEEP 6144:Nj9c2WYd30BKmiPVpU3ypIPr3D3StNynyS/A:NSI2Hs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads