sakula | b466638aefdb02d527d4f93be21b221d6bdcb8431257bcc2a2c74cabda291e72

Analysis

max time kernel
142s
max time network
143s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 03:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

71b3bf62e56f6f0dea60c36192ef88e0_NeikiAnalytics.exe
Size

383KB
MD5

71b3bf62e56f6f0dea60c36192ef88e0
SHA1

ff108fc1cce699b7702a88e73c128873dc15ce4c
SHA256

b466638aefdb02d527d4f93be21b221d6bdcb8431257bcc2a2c74cabda291e72
SHA512

1a4a7f15ec3cb9fe1303961f55f41bae9a564d2f642f5efd32b02e10f05103f7e6fe998077e4a0d885beebd2a2cb1d25b2ca0713862956a67bc87eada16429ee
SSDEEP

6144:l29q46VSndj30BwwBxE1+ijiBKk3etdgI2MyzNORQtOfl1qNVo7R+S+N/TU7Q:d46QnRw8EYiBlMQ

Score

10^/10

sakula persistence rat trojan

Malware Config

Extracted

Family

sakula

www.polarroute.com

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula payload 4 IoCs

resource	yara_rule
behavioral1/memory/2416-0-0x0000000000400000-0x0000000000425000-memory.dmp	family_sakula
behavioral1/files/0x0036000000015cb8-2.dat	family_sakula
behavioral1/memory/2204-7-0x0000000000400000-0x0000000000425000-memory.dmp	family_sakula
behavioral1/memory/2416-8-0x0000000000400000-0x0000000000425000-memory.dmp	family_sakula

Deletes itself 1 IoCs

pid	Process
2892	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2204	MediaCenter.exe

Loads dropped DLL 1 IoCs

pid	Process
2416	71b3bf62e56f6f0dea60c36192ef88e0_NeikiAnalytics.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	71b3bf62e56f6f0dea60c36192ef88e0_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2704	PING.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2416	71b3bf62e56f6f0dea60c36192ef88e0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2204	2416	71b3bf62e56f6f0dea60c36192ef88e0_NeikiAnalytics.exe	28
PID 2416 wrote to memory of 2204	2416	71b3bf62e56f6f0dea60c36192ef88e0_NeikiAnalytics.exe	28
PID 2416 wrote to memory of 2204	2416	71b3bf62e56f6f0dea60c36192ef88e0_NeikiAnalytics.exe	28
PID 2416 wrote to memory of 2204	2416	71b3bf62e56f6f0dea60c36192ef88e0_NeikiAnalytics.exe	28
PID 2416 wrote to memory of 2892	2416	71b3bf62e56f6f0dea60c36192ef88e0_NeikiAnalytics.exe	30
PID 2416 wrote to memory of 2892	2416	71b3bf62e56f6f0dea60c36192ef88e0_NeikiAnalytics.exe	30
PID 2416 wrote to memory of 2892	2416	71b3bf62e56f6f0dea60c36192ef88e0_NeikiAnalytics.exe	30
PID 2416 wrote to memory of 2892	2416	71b3bf62e56f6f0dea60c36192ef88e0_NeikiAnalytics.exe	30
PID 2892 wrote to memory of 2704	2892	cmd.exe	32
PID 2892 wrote to memory of 2704	2892	cmd.exe	32
PID 2892 wrote to memory of 2704	2892	cmd.exe	32
PID 2892 wrote to memory of 2704	2892	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\71b3bf62e56f6f0dea60c36192ef88e0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\71b3bf62e56f6f0dea60c36192ef88e0_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
  C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\71b3bf62e56f6f0dea60c36192ef88e0_NeikiAnalytics.exe"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

Filesize
383KB

MD5
ec7185f01f32a6070b78ead12f927d04

SHA1
d6c9aa36539f493f9dde771f3b86649cb66a9eab

SHA256
e96f7aad2be6156f0456a8106d8b94cb9433ed81d50e590cc78f18d656eaa465

SHA512
b6c420d07447653f3460fc261afa44071f2e66cc3381e89a7785ae4e62908e323c3b7d11e3fcec153d8f66794b2b01de5d5e398083d3a4a02da015f40c6a8961

Download Submit
memory/2204-7-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2416-0-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2416-6-0x0000000000230000-0x0000000000255000-memory.dmp

Filesize
148KB

Download
memory/2416-8-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads