sakula | ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8

General

Target

ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe
Size

58KB
MD5

7b8c14f1210289bf0c8507de3376630c
SHA1

b11d1caa3152f51b1a9062b44f2d1b208cf970c3
SHA256

ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8
SHA512

fbdf647679bd09159c5f337da9f5157edc997445f48ecea5aa5d14ed66efdd6a4d8cb9bc2f2f5fd8d1ec5a6118386647b744e7f2f0e19d02e91b098358f725e2

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

4144 MediaCenter.exe

pid	process
4144	MediaCenter.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

748 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe

description pid process

Token: SeIncBasePriorityPrivilege 3596 ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe

pid	process
748	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	3596	ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.execmd.exe

description	pid	process	target process
PID 3596 wrote to memory of 4144	3596	ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe	MediaCenter.exe
PID 3596 wrote to memory of 4144	3596	ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe	MediaCenter.exe
PID 3596 wrote to memory of 4144	3596	ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe	MediaCenter.exe
PID 3596 wrote to memory of 3864	3596	ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe	cmd.exe
PID 3596 wrote to memory of 3864	3596	ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe	cmd.exe
PID 3596 wrote to memory of 3864	3596	ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe	cmd.exe
PID 3864 wrote to memory of 748	3864	cmd.exe	PING.EXE
PID 3864 wrote to memory of 748	3864	cmd.exe	PING.EXE
PID 3864 wrote to memory of 748	3864	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe
"C:\Users\Admin\AppData\Local\Temp\ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3596

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:4144

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\ef395c961e8ce30b98b00741b255f1807ee77eb6c95b7b066b42578b792e30a8.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:3864

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:748

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
f824f94fca29a41fd3ee6b219ec494fd

SHA1
37141575010890c54a8664d96608d586bd5e2054

SHA256
3cb947e9f91aefbb41537daa4832591237e8291253d1558f888e7d92f7dcc230

SHA512
ae74df95c13b617ca733baf22c8914ede55d105b7edcab63450dbf0bf49c68d0460ca65ca6d7fb0dafe74ba02ae6ba71d470f2c9a56694bbd6f8ee77728b9659

Download Submit
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
f824f94fca29a41fd3ee6b219ec494fd

SHA1
37141575010890c54a8664d96608d586bd5e2054

SHA256
3cb947e9f91aefbb41537daa4832591237e8291253d1558f888e7d92f7dcc230

SHA512
ae74df95c13b617ca733baf22c8914ede55d105b7edcab63450dbf0bf49c68d0460ca65ca6d7fb0dafe74ba02ae6ba71d470f2c9a56694bbd6f8ee77728b9659

Download Submit
memory/748-119-0x0000000000000000-mapping.dmp

Download
memory/3864-118-0x0000000000000000-mapping.dmp

Download
memory/4144-115-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing