sakula | ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8

General

Target

ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe
Size

58KB
MD5

7b8c14f1210289bf0c8507de3376630c
SHA1

b11d1caa3152f51b1a9062b44f2d1b208cf970c3
SHA256

ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8
SHA512

fbdf647679bd09159c5f337da9f5157edc997445f48ecea5aa5d14ed66efdd6a4d8cb9bc2f2f5fd8d1ec5a6118386647b744e7f2f0e19d02e91b098358f725e2

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1648 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1456 cmd.exe

pid	process
1648	MediaCenter.exe

pid	process
1456	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe

pid	process
1076	ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe
1076	ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1372 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe

description pid process

Token: SeIncBasePriorityPrivilege 1076 ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe

pid	process
1372	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1076	ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.execmd.exe

description	pid	process	target process
PID 1076 wrote to memory of 1648	1076	ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe	MediaCenter.exe
PID 1076 wrote to memory of 1648	1076	ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe	MediaCenter.exe
PID 1076 wrote to memory of 1648	1076	ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe	MediaCenter.exe
PID 1076 wrote to memory of 1648	1076	ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe	MediaCenter.exe
PID 1076 wrote to memory of 1456	1076	ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe	cmd.exe
PID 1076 wrote to memory of 1456	1076	ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe	cmd.exe
PID 1076 wrote to memory of 1456	1076	ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe	cmd.exe
PID 1076 wrote to memory of 1456	1076	ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe	cmd.exe
PID 1456 wrote to memory of 1372	1456	cmd.exe	PING.EXE
PID 1456 wrote to memory of 1372	1456	cmd.exe	PING.EXE
PID 1456 wrote to memory of 1372	1456	cmd.exe	PING.EXE
PID 1456 wrote to memory of 1372	1456	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe
"C:\Users\Admin\AppData\Local\Temp\ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1076

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1648

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1456

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1372

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
ad5174eea8e76acc51104268632fa66e

SHA1
557d5ec5a88dd9c061f39ef28ba641a4320f9ec0

SHA256
c9146fed8d259f08eebaf9c1bcfb757f2a5edddbc798e162bb5d7e91464ab99a

SHA512
bf3f9bc938ec4ae60d443f5f8af32baf9e10c4ff8043079fa4c13469457962392790b5a3dd343820f81425b5c49796712aad2a2da37ce7642a64e2f25b6f8001

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
ad5174eea8e76acc51104268632fa66e

SHA1
557d5ec5a88dd9c061f39ef28ba641a4320f9ec0

SHA256
c9146fed8d259f08eebaf9c1bcfb757f2a5edddbc798e162bb5d7e91464ab99a

SHA512
bf3f9bc938ec4ae60d443f5f8af32baf9e10c4ff8043079fa4c13469457962392790b5a3dd343820f81425b5c49796712aad2a2da37ce7642a64e2f25b6f8001

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
ad5174eea8e76acc51104268632fa66e

SHA1
557d5ec5a88dd9c061f39ef28ba641a4320f9ec0

SHA256
c9146fed8d259f08eebaf9c1bcfb757f2a5edddbc798e162bb5d7e91464ab99a

SHA512
bf3f9bc938ec4ae60d443f5f8af32baf9e10c4ff8043079fa4c13469457962392790b5a3dd343820f81425b5c49796712aad2a2da37ce7642a64e2f25b6f8001

Download Submit
memory/1076-59-0x0000000075AA1000-0x0000000075AA3000-memory.dmp

Filesize
8KB

Download
memory/1372-66-0x0000000000000000-mapping.dmp

Download
memory/1456-65-0x0000000000000000-mapping.dmp

Download
memory/1648-62-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads