sakula | 37bfb1bb651a33e2d01536c458c5292efad6cdc3be5a9d5b48d9d2814f16a569

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
23-06-2024 04:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

37bfb1bb651a33e2d01536c458c5292efad6cdc3be5a9d5b48d9d2814f16a569_NeikiAnalytics.exe
Size

108KB
MD5

e5a69f50a63733fa0c227bbf4688ede0
SHA1

8e05806721534921480587367c230cc329d6bd43
SHA256

37bfb1bb651a33e2d01536c458c5292efad6cdc3be5a9d5b48d9d2814f16a569
SHA512

58ea035e7fd288025b17e870e6500990256ae6dcb4ba53c8da33b9dae4406eaf177f1c07e1e712363bbd35745c7936520965ea4148d8d714955caebbb94a330a
SSDEEP

1536:oQFl29mEkE0L1rDEKrxZKF2zf9g2Pl7W/MwbxMX+8es52z30rtr0izbR9Xwz1:329DkEGRQixVSjLwes5G30BfPvwx

Score

10^/10

sakula persistence rat trojan

Malware Config

Extracted

Family

sakula

www.polarroute.com

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/752-0-0x0000000000400000-0x0000000000420000-memory.dmp	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
behavioral2/memory/3952-5-0x0000000000400000-0x0000000000420000-memory.dmp	family_sakula
behavioral2/memory/752-6-0x0000000000400000-0x0000000000420000-memory.dmp	family_sakula

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

37bfb1bb651a33e2d01536c458c5292efad6cdc3be5a9d5b48d9d2814f16a569_NeikiAnalytics.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	37bfb1bb651a33e2d01536c458c5292efad6cdc3be5a9d5b48d9d2814f16a569_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

3952 MediaCenter.exe

pid	process
3952	MediaCenter.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

37bfb1bb651a33e2d01536c458c5292efad6cdc3be5a9d5b48d9d2814f16a569_NeikiAnalytics.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	37bfb1bb651a33e2d01536c458c5292efad6cdc3be5a9d5b48d9d2814f16a569_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1156 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

37bfb1bb651a33e2d01536c458c5292efad6cdc3be5a9d5b48d9d2814f16a569_NeikiAnalytics.exe

description pid process

Token: SeIncBasePriorityPrivilege 752 37bfb1bb651a33e2d01536c458c5292efad6cdc3be5a9d5b48d9d2814f16a569_NeikiAnalytics.exe

pid	process
1156	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	752	37bfb1bb651a33e2d01536c458c5292efad6cdc3be5a9d5b48d9d2814f16a569_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

37bfb1bb651a33e2d01536c458c5292efad6cdc3be5a9d5b48d9d2814f16a569_NeikiAnalytics.execmd.exe

description	pid	process	target process
PID 752 wrote to memory of 3952	752	37bfb1bb651a33e2d01536c458c5292efad6cdc3be5a9d5b48d9d2814f16a569_NeikiAnalytics.exe	MediaCenter.exe
PID 752 wrote to memory of 3952	752	37bfb1bb651a33e2d01536c458c5292efad6cdc3be5a9d5b48d9d2814f16a569_NeikiAnalytics.exe	MediaCenter.exe
PID 752 wrote to memory of 3952	752	37bfb1bb651a33e2d01536c458c5292efad6cdc3be5a9d5b48d9d2814f16a569_NeikiAnalytics.exe	MediaCenter.exe
PID 752 wrote to memory of 1532	752	37bfb1bb651a33e2d01536c458c5292efad6cdc3be5a9d5b48d9d2814f16a569_NeikiAnalytics.exe	cmd.exe
PID 752 wrote to memory of 1532	752	37bfb1bb651a33e2d01536c458c5292efad6cdc3be5a9d5b48d9d2814f16a569_NeikiAnalytics.exe	cmd.exe
PID 752 wrote to memory of 1532	752	37bfb1bb651a33e2d01536c458c5292efad6cdc3be5a9d5b48d9d2814f16a569_NeikiAnalytics.exe	cmd.exe
PID 1532 wrote to memory of 1156	1532	cmd.exe	PING.EXE
PID 1532 wrote to memory of 1156	1532	cmd.exe	PING.EXE
PID 1532 wrote to memory of 1156	1532	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\37bfb1bb651a33e2d01536c458c5292efad6cdc3be5a9d5b48d9d2814f16a569_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\37bfb1bb651a33e2d01536c458c5292efad6cdc3be5a9d5b48d9d2814f16a569_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:752

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:3952

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\37bfb1bb651a33e2d01536c458c5292efad6cdc3be5a9d5b48d9d2814f16a569_NeikiAnalytics.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1532

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1156

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Filesize
108KB

MD5
37c37b41c7e278d21a6788a0d09f28ee

SHA1
3314ec69b22319eaa243af0800d8180c4c3359f4

SHA256
5a51f2f825b28365a9a4d8d4585c1778d46a47c1d488ee821e6a65826c8d2ed0

SHA512
c49cde630a5e74928779f7ce8ce8cdbee35cecf6a303be7cc8ab3aca395575b1584883b87bde5d95f3b683300080a460e4ddb796b560012d53eac019ffaa5fb7

Download Submit
memory/752-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/752-6-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3952-5-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download