Malware Analysis Report

2024-12-07 22:04

Sample ID 241120-yh42ma1gmb
Target b1e7be2bb326144fb528f105795e4c3b602b3c28db7a3a0fd8cf5487938ec137.exe
SHA256 b1e7be2bb326144fb528f105795e4c3b602b3c28db7a3a0fd8cf5487938ec137
Tags
sakula discovery persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b1e7be2bb326144fb528f105795e4c3b602b3c28db7a3a0fd8cf5487938ec137

Threat Level: Known bad

The file b1e7be2bb326144fb528f105795e4c3b602b3c28db7a3a0fd8cf5487938ec137.exe was found to be: Known bad.

Malicious Activity Summary

sakula discovery persistence rat trojan

Sakula family

Sakula

Sakula payload

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Deletes itself

Adds Run key to start application

System Network Configuration Discovery: Internet Connection Discovery

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Unsigned PE

Runs ping.exe

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-20 19:48

Signatures

Sakula family

sakula

Sakula payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-20 19:48

Reported

2024-11-20 19:50

Platform

win10v2004-20241007-en

Max time kernel

106s

Max time network

108s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b1e7be2bb326144fb528f105795e4c3b602b3c28db7a3a0fd8cf5487938ec137.exe"

Signatures

Sakula

trojan rat sakula

Sakula family

sakula

Sakula payload

Description Indicator Process Target
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\b1e7be2bb326144fb528f105795e4c3b602b3c28db7a3a0fd8cf5487938ec137.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" C:\Users\Admin\AppData\Local\Temp\b1e7be2bb326144fb528f105795e4c3b602b3c28db7a3a0fd8cf5487938ec137.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\b1e7be2bb326144fb528f105795e4c3b602b3c28db7a3a0fd8cf5487938ec137.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\PING.EXE N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b1e7be2bb326144fb528f105795e4c3b602b3c28db7a3a0fd8cf5487938ec137.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\b1e7be2bb326144fb528f105795e4c3b602b3c28db7a3a0fd8cf5487938ec137.exe

"C:\Users\Admin\AppData\Local\Temp\b1e7be2bb326144fb528f105795e4c3b602b3c28db7a3a0fd8cf5487938ec137.exe"

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\b1e7be2bb326144fb528f105795e4c3b602b3c28db7a3a0fd8cf5487938ec137.exe"

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.polarroute.com udp
US 76.223.54.146:80 www.polarroute.com tcp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 145.136.73.23.in-addr.arpa udp
US 8.8.8.8:53 146.54.223.76.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 76.223.54.146:80 www.polarroute.com tcp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 76.223.54.146:80 www.polarroute.com tcp
US 8.8.8.8:53 106.209.201.84.in-addr.arpa udp
US 76.223.54.146:80 www.polarroute.com tcp
US 8.8.8.8:53 www.northpoleroute.com udp
US 8.8.8.8:53 www.northpoleroute.com udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 www.northpoleroute.com udp

Files

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 4c7c07eaabe9455d2cfe77ef94784c1f
SHA1 0949fa6b7fc02f970a7112ad84228a5f094c0d42
SHA256 1086114231362b1539d44892dc8c4289a8d24514b051d9b7361cf351725c9d59
SHA512 bc6acb6b4d77342436d871858037543a9eec2d051373e56ce045d6a4241ea7193c4fd8fc378e38ed5297575d43d4ccb97cfeda2afae65cdd1d91ca7224034af3

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-20 19:48

Reported

2024-11-20 19:50

Platform

win7-20240903-en

Max time kernel

96s

Max time network

78s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b1e7be2bb326144fb528f105795e4c3b602b3c28db7a3a0fd8cf5487938ec137.exe"

Signatures

Sakula

trojan rat sakula

Sakula family

sakula

Sakula payload

Description Indicator Process Target
N/A N/A N/A N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" C:\Users\Admin\AppData\Local\Temp\b1e7be2bb326144fb528f105795e4c3b602b3c28db7a3a0fd8cf5487938ec137.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\PING.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\b1e7be2bb326144fb528f105795e4c3b602b3c28db7a3a0fd8cf5487938ec137.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b1e7be2bb326144fb528f105795e4c3b602b3c28db7a3a0fd8cf5487938ec137.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1444 wrote to memory of 352 N/A C:\Users\Admin\AppData\Local\Temp\b1e7be2bb326144fb528f105795e4c3b602b3c28db7a3a0fd8cf5487938ec137.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 1444 wrote to memory of 352 N/A C:\Users\Admin\AppData\Local\Temp\b1e7be2bb326144fb528f105795e4c3b602b3c28db7a3a0fd8cf5487938ec137.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 1444 wrote to memory of 352 N/A C:\Users\Admin\AppData\Local\Temp\b1e7be2bb326144fb528f105795e4c3b602b3c28db7a3a0fd8cf5487938ec137.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 1444 wrote to memory of 352 N/A C:\Users\Admin\AppData\Local\Temp\b1e7be2bb326144fb528f105795e4c3b602b3c28db7a3a0fd8cf5487938ec137.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 1444 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\b1e7be2bb326144fb528f105795e4c3b602b3c28db7a3a0fd8cf5487938ec137.exe C:\Windows\SysWOW64\cmd.exe
PID 1444 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\b1e7be2bb326144fb528f105795e4c3b602b3c28db7a3a0fd8cf5487938ec137.exe C:\Windows\SysWOW64\cmd.exe
PID 1444 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\b1e7be2bb326144fb528f105795e4c3b602b3c28db7a3a0fd8cf5487938ec137.exe C:\Windows\SysWOW64\cmd.exe
PID 1444 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\b1e7be2bb326144fb528f105795e4c3b602b3c28db7a3a0fd8cf5487938ec137.exe C:\Windows\SysWOW64\cmd.exe
PID 2588 wrote to memory of 2700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2588 wrote to memory of 2700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2588 wrote to memory of 2700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2588 wrote to memory of 2700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\b1e7be2bb326144fb528f105795e4c3b602b3c28db7a3a0fd8cf5487938ec137.exe

"C:\Users\Admin\AppData\Local\Temp\b1e7be2bb326144fb528f105795e4c3b602b3c28db7a3a0fd8cf5487938ec137.exe"

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\b1e7be2bb326144fb528f105795e4c3b602b3c28db7a3a0fd8cf5487938ec137.exe"

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.polarroute.com udp
US 76.223.54.146:80 www.polarroute.com tcp
US 76.223.54.146:80 www.polarroute.com tcp
US 76.223.54.146:80 www.polarroute.com tcp
US 76.223.54.146:80 www.polarroute.com tcp
US 8.8.8.8:53 www.northpoleroute.com udp

Files

\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 e4eab529c2ab1b871193a3eec8b108e6
SHA1 9dce3106eab32050645d628c13859cd6d0fc2c65
SHA256 dea52b393db07efce06cf6428963157ad332dcacf8a73b0b3cab992ecfed5aff
SHA512 3a0f4866b85b6b03c241a1157a31201aaf5d37f89374426898314792572f4a06f4042a032eaa891c663007629df11cccc9b656e39cf12e80746a45470ab6a8aa