sakula | 37ad01900f8847e033290e6004e553b34111623d4544d58e988e681e416c0236

Analysis

max time kernel
133s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 03:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
37ad01900f8847e033290e6004e553b34111623d4544d58e988e681e416c0236.exe
Size 92KB
Sample240704-d3lesssdjj
SHA256 37ad01900f8847e033290e6004e553b34111623d4544d58e988e681e416c0236
MD5 dffd140c254e72a4ec954afd747921a0
SHA1 3f1cfb06b71c102632c78ac25956205b0803a97a
SHA512 b4b6ec2fd4486446d31aebb125fb4d345bd53a07ea34d022626479419801012e2c14c9b1ef684134b1fc7198e4b9af2331445f78cf0df0cad1a629ab685fe80f
SSDEEP 1536:TJbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtre:9bfVk29te2jqxCEtg30BS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sakula persistence rat trojan

Malware Config

Extracted

Family

sakula

www.savmpet.com

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000800000002363e-2.dat	family_sakula

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation	37ad01900f8847e033290e6004e553b34111623d4544d58e988e681e416c0236.exe

Executes dropped EXE 1 IoCs

pid	Process
3636	AdobeUpdate.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AdobeUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\AdobeUpdate.exe"	37ad01900f8847e033290e6004e553b34111623d4544d58e988e681e416c0236.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1208	PING.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	512	37ad01900f8847e033290e6004e553b34111623d4544d58e988e681e416c0236.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 512 wrote to memory of 3636	512	37ad01900f8847e033290e6004e553b34111623d4544d58e988e681e416c0236.exe	90
PID 512 wrote to memory of 3636	512	37ad01900f8847e033290e6004e553b34111623d4544d58e988e681e416c0236.exe	90
PID 512 wrote to memory of 3636	512	37ad01900f8847e033290e6004e553b34111623d4544d58e988e681e416c0236.exe	90
PID 512 wrote to memory of 2520	512	37ad01900f8847e033290e6004e553b34111623d4544d58e988e681e416c0236.exe	104
PID 512 wrote to memory of 2520	512	37ad01900f8847e033290e6004e553b34111623d4544d58e988e681e416c0236.exe	104
PID 512 wrote to memory of 2520	512	37ad01900f8847e033290e6004e553b34111623d4544d58e988e681e416c0236.exe	104
PID 2520 wrote to memory of 1208	2520	cmd.exe	106
PID 2520 wrote to memory of 1208	2520	cmd.exe	106
PID 2520 wrote to memory of 1208	2520	cmd.exe	106

C:\Users\Admin\AppData\Local\Temp\37ad01900f8847e033290e6004e553b34111623d4544d58e988e681e416c0236.exe
"C:\Users\Admin\AppData\Local\Temp\37ad01900f8847e033290e6004e553b34111623d4544d58e988e681e416c0236.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:512
- C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe
  C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\37ad01900f8847e033290e6004e553b34111623d4544d58e988e681e416c0236.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2520
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4168,i,11069752405888604640,8928124405695604965,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:8
1⤵
PID:1520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AdobeUpdate.exe

Path C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe
Size 92KB
SHA256 7475827e4cc0a83c579a3db1b8e7f1c688f4598a188127d0494fdf9adb6513ca
MD5 ecf04a94a012da684be49cab629e8ece
SHA1 6457c8948e126b321e008bb555f627bc12a01a23
SHA512 6428b4b7aa6b478b83c80d6a8b79cc156ef0113d1455262ef5aa69674662bcb0b6ae62bb7df9f11b615487c6b08d348f7c2b9cb62472d33f1846b6a9d1980195
SSDEEP 1536:TJbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtro:9bfVk29te2jqxCEtg30BM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads