Malware Analysis Report

2025-01-02 02:51

Sample ID 241203-w21r7sxncy
Target 5c9e0d143bb0c52d97d3e3e26ad8dc83914f4ce8b43c262c77f21002e11ca3c2N.exe
SHA256 5c9e0d143bb0c52d97d3e3e26ad8dc83914f4ce8b43c262c77f21002e11ca3c2
Tags
sakula discovery persistence rat trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

5c9e0d143bb0c52d97d3e3e26ad8dc83914f4ce8b43c262c77f21002e11ca3c2

Threat Level: Known bad

The file 5c9e0d143bb0c52d97d3e3e26ad8dc83914f4ce8b43c262c77f21002e11ca3c2N.exe was found to be: Known bad.

Malicious Activity Summary

sakula discovery persistence rat trojan upx

Sakula payload

Sakula family

Sakula

Deletes itself

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Adds Run key to start application

UPX packed file

Enumerates physical storage devices

System Network Configuration Discovery: Internet Connection Discovery

System Location Discovery: System Language Discovery

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Runs ping.exe

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-12-03 18:25

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-12-03 18:25

Reported

2024-12-03 18:27

Platform

win7-20240903-en

Max time kernel

110s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5c9e0d143bb0c52d97d3e3e26ad8dc83914f4ce8b43c262c77f21002e11ca3c2N.exe"

Signatures

Sakula

trojan rat sakula

Sakula family

sakula

Sakula payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" C:\Users\Admin\AppData\Local\Temp\5c9e0d143bb0c52d97d3e3e26ad8dc83914f4ce8b43c262c77f21002e11ca3c2N.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\5c9e0d143bb0c52d97d3e3e26ad8dc83914f4ce8b43c262c77f21002e11ca3c2N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\PING.EXE N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\5c9e0d143bb0c52d97d3e3e26ad8dc83914f4ce8b43c262c77f21002e11ca3c2N.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2648 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\5c9e0d143bb0c52d97d3e3e26ad8dc83914f4ce8b43c262c77f21002e11ca3c2N.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 2648 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\5c9e0d143bb0c52d97d3e3e26ad8dc83914f4ce8b43c262c77f21002e11ca3c2N.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 2648 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\5c9e0d143bb0c52d97d3e3e26ad8dc83914f4ce8b43c262c77f21002e11ca3c2N.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 2648 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\5c9e0d143bb0c52d97d3e3e26ad8dc83914f4ce8b43c262c77f21002e11ca3c2N.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 2648 wrote to memory of 2980 N/A C:\Users\Admin\AppData\Local\Temp\5c9e0d143bb0c52d97d3e3e26ad8dc83914f4ce8b43c262c77f21002e11ca3c2N.exe C:\Windows\SysWOW64\cmd.exe
PID 2648 wrote to memory of 2980 N/A C:\Users\Admin\AppData\Local\Temp\5c9e0d143bb0c52d97d3e3e26ad8dc83914f4ce8b43c262c77f21002e11ca3c2N.exe C:\Windows\SysWOW64\cmd.exe
PID 2648 wrote to memory of 2980 N/A C:\Users\Admin\AppData\Local\Temp\5c9e0d143bb0c52d97d3e3e26ad8dc83914f4ce8b43c262c77f21002e11ca3c2N.exe C:\Windows\SysWOW64\cmd.exe
PID 2648 wrote to memory of 2980 N/A C:\Users\Admin\AppData\Local\Temp\5c9e0d143bb0c52d97d3e3e26ad8dc83914f4ce8b43c262c77f21002e11ca3c2N.exe C:\Windows\SysWOW64\cmd.exe
PID 2980 wrote to memory of 1476 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2980 wrote to memory of 1476 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2980 wrote to memory of 1476 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2980 wrote to memory of 1476 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\5c9e0d143bb0c52d97d3e3e26ad8dc83914f4ce8b43c262c77f21002e11ca3c2N.exe

"C:\Users\Admin\AppData\Local\Temp\5c9e0d143bb0c52d97d3e3e26ad8dc83914f4ce8b43c262c77f21002e11ca3c2N.exe"

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\5c9e0d143bb0c52d97d3e3e26ad8dc83914f4ce8b43c262c77f21002e11ca3c2N.exe"

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1

Network

Country Destination Domain Proto
US 8.8.8.8:53 citrix.vipreclod.com udp
TH 184.22.175.13:80 tcp
TH 184.22.175.13:80 tcp

Files

memory/2648-0-0x0000000000A10000-0x0000000000A2F000-memory.dmp

\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 1cd3a6cbefdd3588bbb15ccff40d2287
SHA1 76352429ebf212f77b4e9d5de0afd13248f930e8
SHA256 c33e0d642ceb69f5132f222e37467bdd401a07609e19c81368a497a115a4d84a
SHA512 bce72ea20934cd94fcab288d3c414ae1c18628bdb534973e304ad0855697d328e24af032d63fc60d93906075d0aa15de11b87b3540519dab566004ddd89d17f4

memory/2648-3-0x0000000000070000-0x000000000008F000-memory.dmp

memory/2664-10-0x00000000013C0000-0x00000000013DF000-memory.dmp

memory/2648-11-0x0000000000A10000-0x0000000000A2F000-memory.dmp

memory/2664-13-0x00000000013C0000-0x00000000013DF000-memory.dmp

memory/2648-19-0x0000000000A10000-0x0000000000A2F000-memory.dmp

memory/2664-25-0x00000000013C0000-0x00000000013DF000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-12-03 18:25

Reported

2024-12-03 18:27

Platform

win10v2004-20241007-en

Max time kernel

111s

Max time network

99s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5c9e0d143bb0c52d97d3e3e26ad8dc83914f4ce8b43c262c77f21002e11ca3c2N.exe"

Signatures

Sakula

trojan rat sakula

Sakula family

sakula

Sakula payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\5c9e0d143bb0c52d97d3e3e26ad8dc83914f4ce8b43c262c77f21002e11ca3c2N.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" C:\Users\Admin\AppData\Local\Temp\5c9e0d143bb0c52d97d3e3e26ad8dc83914f4ce8b43c262c77f21002e11ca3c2N.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\5c9e0d143bb0c52d97d3e3e26ad8dc83914f4ce8b43c262c77f21002e11ca3c2N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\PING.EXE N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\5c9e0d143bb0c52d97d3e3e26ad8dc83914f4ce8b43c262c77f21002e11ca3c2N.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\5c9e0d143bb0c52d97d3e3e26ad8dc83914f4ce8b43c262c77f21002e11ca3c2N.exe

"C:\Users\Admin\AppData\Local\Temp\5c9e0d143bb0c52d97d3e3e26ad8dc83914f4ce8b43c262c77f21002e11ca3c2N.exe"

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\5c9e0d143bb0c52d97d3e3e26ad8dc83914f4ce8b43c262c77f21002e11ca3c2N.exe"

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1

Network

Country Destination Domain Proto
US 8.8.8.8:53 citrix.vipreclod.com udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 citrix.vipreclod.com udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 107.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 citrix.vipreclod.com udp
US 8.8.8.8:53 citrix.vipreclod.com udp
TH 184.22.175.13:80 tcp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp

Files

memory/3836-0-0x0000000000A70000-0x0000000000A8F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 a79a665cb4447018a99280880aa6898e
SHA1 84e9f1a1f8b76cefc7d9493f478efbc32e8d9c7e
SHA256 02e9d0100f65138e9d1cb6349e90708783f46dd443d2d288744efe1cfa3e44e8
SHA512 4cd610005de93006e26948e367c1d5e6c3a2afc29d41c7c03ed259e502367e9a356a1b616cc32476c7614fec749406a10afc996c51fe4d6d1fd62d9e7c15993f

memory/2312-4-0x0000000000EC0000-0x0000000000EDF000-memory.dmp

memory/3836-6-0x0000000000A70000-0x0000000000A8F000-memory.dmp

memory/2312-8-0x0000000000EC0000-0x0000000000EDF000-memory.dmp

memory/3836-14-0x0000000000A70000-0x0000000000A8F000-memory.dmp

memory/2312-20-0x0000000000EC0000-0x0000000000EDF000-memory.dmp