Malware Analysis Report

2025-01-02 02:49

Sample ID 241123-qscq5avrdv
Target de13a9f169eec46d904ad15ab11e06bc497334415c033edcd0f5d790b979ea04N.exe
SHA256 de13a9f169eec46d904ad15ab11e06bc497334415c033edcd0f5d790b979ea04
Tags
sakula discovery persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

de13a9f169eec46d904ad15ab11e06bc497334415c033edcd0f5d790b979ea04

Threat Level: Known bad

The file de13a9f169eec46d904ad15ab11e06bc497334415c033edcd0f5d790b979ea04N.exe was found to be: Known bad.

Malicious Activity Summary

sakula discovery persistence rat trojan

Sakula

Sakula family

Sakula payload

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Deletes itself

Adds Run key to start application

System Network Configuration Discovery: Internet Connection Discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Runs ping.exe

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-23 13:31

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-23 13:31

Reported

2024-11-23 13:33

Platform

win10v2004-20241007-en

Max time kernel

111s

Max time network

94s

Command Line

"C:\Users\Admin\AppData\Local\Temp\de13a9f169eec46d904ad15ab11e06bc497334415c033edcd0f5d790b979ea04N.exe"

Signatures

Sakula

trojan rat sakula

Sakula family

sakula

Sakula payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\de13a9f169eec46d904ad15ab11e06bc497334415c033edcd0f5d790b979ea04N.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" C:\Users\Admin\AppData\Local\Temp\de13a9f169eec46d904ad15ab11e06bc497334415c033edcd0f5d790b979ea04N.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\de13a9f169eec46d904ad15ab11e06bc497334415c033edcd0f5d790b979ea04N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\PING.EXE N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de13a9f169eec46d904ad15ab11e06bc497334415c033edcd0f5d790b979ea04N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\de13a9f169eec46d904ad15ab11e06bc497334415c033edcd0f5d790b979ea04N.exe

"C:\Users\Admin\AppData\Local\Temp\de13a9f169eec46d904ad15ab11e06bc497334415c033edcd0f5d790b979ea04N.exe"

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\de13a9f169eec46d904ad15ab11e06bc497334415c033edcd0f5d790b979ea04N.exe"

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1

Network

Country Destination Domain Proto
US 8.8.8.8:53 citrix.vipreclod.com udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 citrix.vipreclod.com udp
US 8.8.8.8:53 citrix.vipreclod.com udp
US 8.8.8.8:53 135.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 citrix.vipreclod.com udp
TH 184.22.175.13:80 tcp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp

Files

memory/4024-0-0x0000000000400000-0x000000000041A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 8a67f023969f76a04ecb1a39b6c38c6f
SHA1 f2d3bb283b662c18eef9e087fb58639677dc9670
SHA256 d42b53ec8d19c7b6bfd6e3d44c86fa3149586042b625d200b08f8c3e1d99f1f8
SHA512 ed8de9221d8ac600848a2cba7753e01d3592196a0ddddbd899ea10298b5eb63e93de978999a107b13a17412cdd8599f532549fac7c16c74b4aeb0ea02ad714ad

memory/4868-4-0x0000000000400000-0x000000000041A000-memory.dmp

memory/4024-6-0x0000000000400000-0x000000000041A000-memory.dmp

memory/4868-8-0x0000000000400000-0x000000000041A000-memory.dmp

memory/4024-13-0x0000000000400000-0x000000000041A000-memory.dmp

memory/4868-17-0x0000000000400000-0x000000000041A000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-23 13:31

Reported

2024-11-23 13:33

Platform

win7-20241023-en

Max time kernel

118s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\de13a9f169eec46d904ad15ab11e06bc497334415c033edcd0f5d790b979ea04N.exe"

Signatures

Sakula

trojan rat sakula

Sakula family

sakula

Sakula payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" C:\Users\Admin\AppData\Local\Temp\de13a9f169eec46d904ad15ab11e06bc497334415c033edcd0f5d790b979ea04N.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\de13a9f169eec46d904ad15ab11e06bc497334415c033edcd0f5d790b979ea04N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\PING.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\de13a9f169eec46d904ad15ab11e06bc497334415c033edcd0f5d790b979ea04N.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2136 wrote to memory of 2336 N/A C:\Users\Admin\AppData\Local\Temp\de13a9f169eec46d904ad15ab11e06bc497334415c033edcd0f5d790b979ea04N.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 2136 wrote to memory of 2336 N/A C:\Users\Admin\AppData\Local\Temp\de13a9f169eec46d904ad15ab11e06bc497334415c033edcd0f5d790b979ea04N.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 2136 wrote to memory of 2336 N/A C:\Users\Admin\AppData\Local\Temp\de13a9f169eec46d904ad15ab11e06bc497334415c033edcd0f5d790b979ea04N.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 2136 wrote to memory of 2336 N/A C:\Users\Admin\AppData\Local\Temp\de13a9f169eec46d904ad15ab11e06bc497334415c033edcd0f5d790b979ea04N.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 2136 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\de13a9f169eec46d904ad15ab11e06bc497334415c033edcd0f5d790b979ea04N.exe C:\Windows\SysWOW64\cmd.exe
PID 2136 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\de13a9f169eec46d904ad15ab11e06bc497334415c033edcd0f5d790b979ea04N.exe C:\Windows\SysWOW64\cmd.exe
PID 2136 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\de13a9f169eec46d904ad15ab11e06bc497334415c033edcd0f5d790b979ea04N.exe C:\Windows\SysWOW64\cmd.exe
PID 2136 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Local\Temp\de13a9f169eec46d904ad15ab11e06bc497334415c033edcd0f5d790b979ea04N.exe C:\Windows\SysWOW64\cmd.exe
PID 2984 wrote to memory of 2732 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2984 wrote to memory of 2732 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2984 wrote to memory of 2732 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2984 wrote to memory of 2732 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\de13a9f169eec46d904ad15ab11e06bc497334415c033edcd0f5d790b979ea04N.exe

"C:\Users\Admin\AppData\Local\Temp\de13a9f169eec46d904ad15ab11e06bc497334415c033edcd0f5d790b979ea04N.exe"

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\de13a9f169eec46d904ad15ab11e06bc497334415c033edcd0f5d790b979ea04N.exe"

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1

Network

Country Destination Domain Proto
US 8.8.8.8:53 citrix.vipreclod.com udp
TH 184.22.175.13:80 tcp
TH 184.22.175.13:80 tcp

Files

memory/2136-0-0x0000000000400000-0x000000000041A000-memory.dmp

\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 68550e39f25fb5df231ee2c9e5e942db
SHA1 9f73645a5fd73279448af7d9525a023be71c81a4
SHA256 70a5c9cb48be68950d7b321243719e1fc511c65724241dff21955603fa2db020
SHA512 8e01ad616bc428b98e59004f475f3add56132096b8469fee358af09091914231aaf85b9c23002f4e1304cc1360aed7c8d67edc81aff9811d83feed88bc936d27

memory/2136-9-0x0000000000220000-0x000000000023A000-memory.dmp

memory/2336-11-0x0000000000400000-0x000000000041A000-memory.dmp

memory/2136-10-0x0000000000220000-0x000000000023A000-memory.dmp

memory/2136-12-0x0000000000400000-0x000000000041A000-memory.dmp

memory/2136-13-0x0000000000220000-0x000000000023A000-memory.dmp

memory/2336-14-0x0000000000400000-0x000000000041A000-memory.dmp

memory/2136-22-0x0000000000400000-0x000000000041A000-memory.dmp

memory/2336-27-0x0000000000400000-0x000000000041A000-memory.dmp