Malware Analysis Report

2025-01-02 02:49

Sample ID 241127-yb9njaxkdz
Target 8de5850dc4e1f158c0a651c8c8559d725cc2e069bcdd577c162d785a3182d4e6.exe
SHA256 8de5850dc4e1f158c0a651c8c8559d725cc2e069bcdd577c162d785a3182d4e6
Tags
sakula discovery persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

8de5850dc4e1f158c0a651c8c8559d725cc2e069bcdd577c162d785a3182d4e6

Threat Level: Known bad

The file 8de5850dc4e1f158c0a651c8c8559d725cc2e069bcdd577c162d785a3182d4e6.exe was found to be: Known bad.

Malicious Activity Summary

sakula discovery persistence rat trojan

Sakula

Sakula family

Sakula payload

Deletes itself

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Adds Run key to start application

Enumerates physical storage devices

System Location Discovery: System Language Discovery

System Network Configuration Discovery: Internet Connection Discovery

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Runs ping.exe

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-27 19:37

Signatures

Sakula family

sakula

Sakula payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-27 19:37

Reported

2024-11-27 19:39

Platform

win7-20240903-en

Max time kernel

98s

Max time network

99s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8de5850dc4e1f158c0a651c8c8559d725cc2e069bcdd577c162d785a3182d4e6.exe"

Signatures

Sakula

trojan rat sakula

Sakula family

sakula

Sakula payload

Description Indicator Process Target
N/A N/A N/A N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AdobeUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\AdobeUpdate.exe" C:\Users\Admin\AppData\Local\Temp\8de5850dc4e1f158c0a651c8c8559d725cc2e069bcdd577c162d785a3182d4e6.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\PING.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\8de5850dc4e1f158c0a651c8c8559d725cc2e069bcdd577c162d785a3182d4e6.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8de5850dc4e1f158c0a651c8c8559d725cc2e069bcdd577c162d785a3182d4e6.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1832 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\8de5850dc4e1f158c0a651c8c8559d725cc2e069bcdd577c162d785a3182d4e6.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe
PID 1832 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\8de5850dc4e1f158c0a651c8c8559d725cc2e069bcdd577c162d785a3182d4e6.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe
PID 1832 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\8de5850dc4e1f158c0a651c8c8559d725cc2e069bcdd577c162d785a3182d4e6.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe
PID 1832 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\8de5850dc4e1f158c0a651c8c8559d725cc2e069bcdd577c162d785a3182d4e6.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe
PID 1832 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\8de5850dc4e1f158c0a651c8c8559d725cc2e069bcdd577c162d785a3182d4e6.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe
PID 1832 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\8de5850dc4e1f158c0a651c8c8559d725cc2e069bcdd577c162d785a3182d4e6.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe
PID 1832 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\8de5850dc4e1f158c0a651c8c8559d725cc2e069bcdd577c162d785a3182d4e6.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe
PID 1832 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\8de5850dc4e1f158c0a651c8c8559d725cc2e069bcdd577c162d785a3182d4e6.exe C:\Windows\SysWOW64\cmd.exe
PID 1832 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\8de5850dc4e1f158c0a651c8c8559d725cc2e069bcdd577c162d785a3182d4e6.exe C:\Windows\SysWOW64\cmd.exe
PID 1832 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\8de5850dc4e1f158c0a651c8c8559d725cc2e069bcdd577c162d785a3182d4e6.exe C:\Windows\SysWOW64\cmd.exe
PID 1832 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\8de5850dc4e1f158c0a651c8c8559d725cc2e069bcdd577c162d785a3182d4e6.exe C:\Windows\SysWOW64\cmd.exe
PID 2808 wrote to memory of 2848 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2808 wrote to memory of 2848 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2808 wrote to memory of 2848 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2808 wrote to memory of 2848 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\8de5850dc4e1f158c0a651c8c8559d725cc2e069bcdd577c162d785a3182d4e6.exe

"C:\Users\Admin\AppData\Local\Temp\8de5850dc4e1f158c0a651c8c8559d725cc2e069bcdd577c162d785a3182d4e6.exe"

C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe

C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\8de5850dc4e1f158c0a651c8c8559d725cc2e069bcdd577c162d785a3182d4e6.exe"

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.savmpet.com udp
US 52.34.198.229:80 www.savmpet.com tcp
US 52.34.198.229:80 www.savmpet.com tcp
US 52.34.198.229:80 www.savmpet.com tcp
US 52.34.198.229:80 www.savmpet.com tcp
US 52.34.198.229:80 www.savmpet.com tcp
US 52.34.198.229:80 www.savmpet.com tcp
US 52.34.198.229:80 www.savmpet.com tcp
US 52.34.198.229:80 www.savmpet.com tcp

Files

\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe

MD5 67c87c0438a4eabb4ca3c0164e514e59
SHA1 028cc63d1c9515e4eeab75efa54fa5c4586fc1b7
SHA256 e39b085c3bb30846dcfce862306049763299bafb4f440e3336d114fa676b8ba3
SHA512 bad2da99bee3b2a281c3756bdc11ec8e7b78170a56199867e355b5ef4e6e8956f52a277ec9589ed8dac9c03bdc343b6346dcf94db78c7e99d5b89f780a403ffe

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-27 19:37

Reported

2024-11-27 19:39

Platform

win10v2004-20241007-en

Max time kernel

103s

Max time network

106s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8de5850dc4e1f158c0a651c8c8559d725cc2e069bcdd577c162d785a3182d4e6.exe"

Signatures

Sakula

trojan rat sakula

Sakula family

sakula

Sakula payload

Description Indicator Process Target
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\8de5850dc4e1f158c0a651c8c8559d725cc2e069bcdd577c162d785a3182d4e6.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AdobeUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\AdobeUpdate.exe" C:\Users\Admin\AppData\Local\Temp\8de5850dc4e1f158c0a651c8c8559d725cc2e069bcdd577c162d785a3182d4e6.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\8de5850dc4e1f158c0a651c8c8559d725cc2e069bcdd577c162d785a3182d4e6.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\PING.EXE N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8de5850dc4e1f158c0a651c8c8559d725cc2e069bcdd577c162d785a3182d4e6.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\8de5850dc4e1f158c0a651c8c8559d725cc2e069bcdd577c162d785a3182d4e6.exe

"C:\Users\Admin\AppData\Local\Temp\8de5850dc4e1f158c0a651c8c8559d725cc2e069bcdd577c162d785a3182d4e6.exe"

C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe

C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\8de5850dc4e1f158c0a651c8c8559d725cc2e069bcdd577c162d785a3182d4e6.exe"

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 www.savmpet.com udp
US 52.34.198.229:80 www.savmpet.com tcp
US 8.8.8.8:53 229.198.34.52.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 52.34.198.229:80 www.savmpet.com tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 52.34.198.229:80 www.savmpet.com tcp
US 52.34.198.229:80 www.savmpet.com tcp
US 8.8.8.8:53 181.178.17.96.in-addr.arpa udp
US 52.34.198.229:80 www.savmpet.com tcp
US 52.34.198.229:80 www.savmpet.com tcp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 52.34.198.229:80 www.savmpet.com tcp
US 52.34.198.229:80 www.savmpet.com tcp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe

MD5 9ef21a9e78ee13039220747bf7a88d5d
SHA1 e0240ff25f9428fc2ccd471ad83656d9a4aca43c
SHA256 880273b51dc34892305a6c66f57a4c2409f8a251bffe9b0df741d6da005ac0f7
SHA512 84cf4b5c94c34949ddbce53df6963ec347fe88e3839fa90b2d6bd503c1963c78ad2ae5ae85e2f7e64f4bb3a5d112c69c11cb9d2ab9f3b4eea5e968ef97e39f53