sakula | ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8

Analysis

max time kernel
138s
max time network
146s
platform
windows10_x64
resource
win10-en-20210920
submitted
24-09-2021 06:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe
Size

58KB
MD5

7b8c14f1210289bf0c8507de3376630c
SHA1

b11d1caa3152f51b1a9062b44f2d1b208cf970c3
SHA256

ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8
SHA512

fbdf647679bd09159c5f337da9f5157edc997445f48ecea5aa5d14ed66efdd6a4d8cb9bc2f2f5fd8d1ec5a6118386647b744e7f2f0e19d02e91b098358f725e2

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Executes dropped EXE 1 IoCs

pid	Process
4144	MediaCenter.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
748	PING.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3596	ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3596 wrote to memory of 4144	3596	ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe	70
PID 3596 wrote to memory of 4144	3596	ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe	70
PID 3596 wrote to memory of 4144	3596	ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe	70
PID 3596 wrote to memory of 3864	3596	ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe	71
PID 3596 wrote to memory of 3864	3596	ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe	71
PID 3596 wrote to memory of 3864	3596	ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe	71
PID 3864 wrote to memory of 748	3864	cmd.exe	73
PID 3864 wrote to memory of 748	3864	cmd.exe	73
PID 3864 wrote to memory of 748	3864	cmd.exe	73

C:\Users\Admin\AppData\Local\Temp\ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe
"C:\Users\Admin\AppData\Local\Temp\ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3596
- C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
  C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
  2⤵
  - Executes dropped EXE
  PID:4144
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3864
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:748

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads