sakula | ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8

General

Target

ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe
Size

58KB
MD5

7b8c14f1210289bf0c8507de3376630c
SHA1

b11d1caa3152f51b1a9062b44f2d1b208cf970c3
SHA256

ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8
SHA512

fbdf647679bd09159c5f337da9f5157edc997445f48ecea5aa5d14ed66efdd6a4d8cb9bc2f2f5fd8d1ec5a6118386647b744e7f2f0e19d02e91b098358f725e2

Score

10^/10

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Executes dropped EXE 1 IoCs

pid	Process
1648	MediaCenter.exe

Deletes itself 1 IoCs

pid	Process
1456	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
1076	ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe
1076	ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1372	PING.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1076	ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 1648	1076	ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe	25
PID 1076 wrote to memory of 1648	1076	ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe	25
PID 1076 wrote to memory of 1648	1076	ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe	25
PID 1076 wrote to memory of 1648	1076	ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe	25
PID 1076 wrote to memory of 1456	1076	ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe	30
PID 1076 wrote to memory of 1456	1076	ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe	30
PID 1076 wrote to memory of 1456	1076	ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe	30
PID 1076 wrote to memory of 1456	1076	ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe	30
PID 1456 wrote to memory of 1372	1456	cmd.exe	32
PID 1456 wrote to memory of 1372	1456	cmd.exe	32
PID 1456 wrote to memory of 1372	1456	cmd.exe	32
PID 1456 wrote to memory of 1372	1456	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe
"C:\Users\Admin\AppData\Local\Temp\ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
  C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:1456
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1372