sakula | 98945ccba2ec01720150ec37790fd4dddd587913d51dabeb5cdf1e0352f404e6

Analysis

max time kernel
140s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 16:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1c6ae1b420ca068d9db110c29e6414e0_NeikiAnalytics.exe
Size 58KB
Sample240510-tp941ahe38
SHA256 98945ccba2ec01720150ec37790fd4dddd587913d51dabeb5cdf1e0352f404e6
MD5 1c6ae1b420ca068d9db110c29e6414e0
SHA1 d2f1586913692fbb2c09217351f4b317516b3779
SHA512 27d4b765d47323f2d029f2579c91cbfc2e5b4426b3e4d208221d79f353f0a4a149f25a827d59af3299817b70c6e2983b8147fac1406d034b709ebce41b2204da
SSDEEP 1536:iZioIoCwbYP4nuEApQK4TQbtY2gA9DX+ytBO8c3G3eTJ/6:iEoIlwIguEA4c5DgA9DOyq0eFS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula payload 4 IoCs

resource	yara_rule
behavioral2/memory/4392-6-0x0000000000400000-0x000000000041A000-memory.dmp	family_sakula
behavioral2/memory/2788-7-0x0000000000400000-0x000000000041A000-memory.dmp	family_sakula
behavioral2/memory/4392-12-0x0000000000400000-0x000000000041A000-memory.dmp	family_sakula
behavioral2/memory/2788-17-0x0000000000400000-0x000000000041A000-memory.dmp	family_sakula

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	1c6ae1b420ca068d9db110c29e6414e0_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
2788	MediaCenter.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	1c6ae1b420ca068d9db110c29e6414e0_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4148	PING.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4392	1c6ae1b420ca068d9db110c29e6414e0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4392 wrote to memory of 2788	4392	1c6ae1b420ca068d9db110c29e6414e0_NeikiAnalytics.exe	80
PID 4392 wrote to memory of 2788	4392	1c6ae1b420ca068d9db110c29e6414e0_NeikiAnalytics.exe	80
PID 4392 wrote to memory of 2788	4392	1c6ae1b420ca068d9db110c29e6414e0_NeikiAnalytics.exe	80
PID 4392 wrote to memory of 1168	4392	1c6ae1b420ca068d9db110c29e6414e0_NeikiAnalytics.exe	83
PID 4392 wrote to memory of 1168	4392	1c6ae1b420ca068d9db110c29e6414e0_NeikiAnalytics.exe	83
PID 4392 wrote to memory of 1168	4392	1c6ae1b420ca068d9db110c29e6414e0_NeikiAnalytics.exe	83
PID 1168 wrote to memory of 4148	1168	cmd.exe	85
PID 1168 wrote to memory of 4148	1168	cmd.exe	85
PID 1168 wrote to memory of 4148	1168	cmd.exe	85

C:\Users\Admin\AppData\Local\Temp\1c6ae1b420ca068d9db110c29e6414e0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1c6ae1b420ca068d9db110c29e6414e0_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4392
- C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
  C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\1c6ae1b420ca068d9db110c29e6414e0_NeikiAnalytics.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1168
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:4148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MediaCenter.exe

Path C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Size 58KB
SHA256 a4e391474e52379eb7633b8dbd775dc989dea2f1d09f9d3b71b9a28f8bd8a83d
MD5 47fa33155d4f2a08ecd8b7a9ff65e573
SHA1 35365e3afcf6492af866ab81912e50a36794dc52
SHA512 1a5297bad7d007d6048f0fe31e86af08396baab3be7d0b6473702931770219fdcfa9fb55d1dcaeaf1493acc4b796d7d8d3b93f2a83505c9ad833e7d53c4b8159
SSDEEP 1536:iZioIoCwbYP4nuEApQK4TQbtY2gA9DX+ytBO8c3G3eTJ/j:iEoIlwIguEA4c5DgA9DOyq0eF7
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2788-5-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/2788-7-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/2788-17-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/4392-0-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/4392-6-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/4392-12-0x0000000000400000-0x000000000041A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads