sakula | a74a8a94326bd707cba89a7a03b99496fc2ec1e58fd577ad8074e6ceedb0d32e

General

Target
a74a8a94326bd707cba89a7a03b99496fc2ec1e58fd577ad8074e6ceedb0d32eN.exe
Size 92KB
Sample240927-wfn7aatalq
SHA256 a74a8a94326bd707cba89a7a03b99496fc2ec1e58fd577ad8074e6ceedb0d32e
MD5 2cb0e2b3cec695a8c4e0bc57a6034bf0
SHA1 43f9a9b94cea750bbe988697765d7d28c5727dee
SHA512 9123a03d6c7311b68131c27e375539663e2c42f34bda0ce7b9314e6e7e20240c1829220400630fdf761b3c330e83ca6dbbf4a50c6e6672c282ec44465d90fdd2
SSDEEP 1536:TJbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtru:9bfVk29te2jqxCEtg30B6
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sakula discovery persistence rat trojan

Malware Config

Extracted

Family

sakula

C2

www.savmpet.com

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000800000002342a-2.dat	family_sakula

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	a74a8a94326bd707cba89a7a03b99496fc2ec1e58fd577ad8074e6ceedb0d32eN.exe

Executes dropped EXE 1 IoCs

pid	Process
1332	AdobeUpdate.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AdobeUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\AdobeUpdate.exe"	a74a8a94326bd707cba89a7a03b99496fc2ec1e58fd577ad8074e6ceedb0d32eN.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a74a8a94326bd707cba89a7a03b99496fc2ec1e58fd577ad8074e6ceedb0d32eN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3968	cmd.exe
864	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
864	PING.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2804	a74a8a94326bd707cba89a7a03b99496fc2ec1e58fd577ad8074e6ceedb0d32eN.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 1332	2804	a74a8a94326bd707cba89a7a03b99496fc2ec1e58fd577ad8074e6ceedb0d32eN.exe	82
PID 2804 wrote to memory of 1332	2804	a74a8a94326bd707cba89a7a03b99496fc2ec1e58fd577ad8074e6ceedb0d32eN.exe	82
PID 2804 wrote to memory of 1332	2804	a74a8a94326bd707cba89a7a03b99496fc2ec1e58fd577ad8074e6ceedb0d32eN.exe	82
PID 2804 wrote to memory of 3968	2804	a74a8a94326bd707cba89a7a03b99496fc2ec1e58fd577ad8074e6ceedb0d32eN.exe	91
PID 2804 wrote to memory of 3968	2804	a74a8a94326bd707cba89a7a03b99496fc2ec1e58fd577ad8074e6ceedb0d32eN.exe	91
PID 2804 wrote to memory of 3968	2804	a74a8a94326bd707cba89a7a03b99496fc2ec1e58fd577ad8074e6ceedb0d32eN.exe	91
PID 3968 wrote to memory of 864	3968	cmd.exe	93
PID 3968 wrote to memory of 864	3968	cmd.exe	93
PID 3968 wrote to memory of 864	3968	cmd.exe	93

C:\Users\Admin\AppData\Local\Temp\a74a8a94326bd707cba89a7a03b99496fc2ec1e58fd577ad8074e6ceedb0d32eN.exe
"C:\Users\Admin\AppData\Local\Temp\a74a8a94326bd707cba89a7a03b99496fc2ec1e58fd577ad8074e6ceedb0d32eN.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe
  C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1332
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\a74a8a94326bd707cba89a7a03b99496fc2ec1e58fd577ad8074e6ceedb0d32eN.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:3968
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AdobeUpdate.exe

Path C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe
Size 92KB
SHA256 4e82c056c74750f06b17f0b896ff93f18a6134a62cba23b1850451ee24bc0203
MD5 6ce4865e7d2e0ad75cba2215f2a9527e
SHA1 e805abc3ce3f7c405421da4f4b36d0cd473bbf65
SHA512 31a4b9d9fa4a3b7e313f7b989b316b4c64a8903cf40cb1e1d48dccc147f84b9b3559de9edf37e00faf4ba68da6130f0213aa9a519f0461871e86013a83f7e38d
SSDEEP 1536:TJbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtrv:9bfVk29te2jqxCEtg30BL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads