sakula | 72cf8d30db4d3625c158fa8d9c57187cd50fdbe31c41592fde5126f3170bd277

General

Target

72cf8d30db4d3625c158fa8d9c57187cd50fdbe31c41592fde5126f3170bd277.exe
Size

89KB
MD5

a33c6daba951f7c9a30d69b5e1e58af9
SHA1

1513023202ef672c565f14b98c48ea79bb57e881
SHA256

72cf8d30db4d3625c158fa8d9c57187cd50fdbe31c41592fde5126f3170bd277
SHA512

20458f88c5735f76aa0ed95de6753acd41d7630e62cd89d0f9c9c9ea7e3e9f15d1e0dad642ff15d6ac0969ccc6393f1c6f9409d0c272de4b114a3b7c5aabf985

Score

10^/10

sakula persistence rat suricata trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula Payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula

suricata: ET MALWARE SUSPICIOUS UA (iexplore)
suricata: ET MALWARE SUSPICIOUS UA (iexplore)
suricata
suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1
suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1
suricata
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

3916 MediaCenter.exe

pid	process
3916	MediaCenter.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

72cf8d30db4d3625c158fa8d9c57187cd50fdbe31c41592fde5126f3170bd277.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	72cf8d30db4d3625c158fa8d9c57187cd50fdbe31c41592fde5126f3170bd277.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1600 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

72cf8d30db4d3625c158fa8d9c57187cd50fdbe31c41592fde5126f3170bd277.exe

description pid process

Token: SeIncBasePriorityPrivilege 2744 72cf8d30db4d3625c158fa8d9c57187cd50fdbe31c41592fde5126f3170bd277.exe

pid	process
1600	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	2744	72cf8d30db4d3625c158fa8d9c57187cd50fdbe31c41592fde5126f3170bd277.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

72cf8d30db4d3625c158fa8d9c57187cd50fdbe31c41592fde5126f3170bd277.execmd.exe

description	pid	process	target process
PID 2744 wrote to memory of 3916	2744	72cf8d30db4d3625c158fa8d9c57187cd50fdbe31c41592fde5126f3170bd277.exe	MediaCenter.exe
PID 2744 wrote to memory of 3916	2744	72cf8d30db4d3625c158fa8d9c57187cd50fdbe31c41592fde5126f3170bd277.exe	MediaCenter.exe
PID 2744 wrote to memory of 3916	2744	72cf8d30db4d3625c158fa8d9c57187cd50fdbe31c41592fde5126f3170bd277.exe	MediaCenter.exe
PID 2744 wrote to memory of 492	2744	72cf8d30db4d3625c158fa8d9c57187cd50fdbe31c41592fde5126f3170bd277.exe	cmd.exe
PID 2744 wrote to memory of 492	2744	72cf8d30db4d3625c158fa8d9c57187cd50fdbe31c41592fde5126f3170bd277.exe	cmd.exe
PID 2744 wrote to memory of 492	2744	72cf8d30db4d3625c158fa8d9c57187cd50fdbe31c41592fde5126f3170bd277.exe	cmd.exe
PID 492 wrote to memory of 1600	492	cmd.exe	PING.EXE
PID 492 wrote to memory of 1600	492	cmd.exe	PING.EXE
PID 492 wrote to memory of 1600	492	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\72cf8d30db4d3625c158fa8d9c57187cd50fdbe31c41592fde5126f3170bd277.exe
"C:\Users\Admin\AppData\Local\Temp\72cf8d30db4d3625c158fa8d9c57187cd50fdbe31c41592fde5126f3170bd277.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2744

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:3916

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\72cf8d30db4d3625c158fa8d9c57187cd50fdbe31c41592fde5126f3170bd277.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:492

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1600

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
103357b068176c91010b8c608cf13d82

SHA1
2545d20a2214bbeec1ccdaddf95add0b772acd76

SHA256
1f0c11884d26d3d3cd5a6ffed4ad286d52c7a82fe25ebaeecfd832eb05d9c74b

SHA512
926487e9f2310cb245560a2048ea848695800ad43998700649cd5956eace72f1846540027c02841b45710592c99adc8375e2399487ca4a82aada50db28704707

Download Submit
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
103357b068176c91010b8c608cf13d82

SHA1
2545d20a2214bbeec1ccdaddf95add0b772acd76

SHA256
1f0c11884d26d3d3cd5a6ffed4ad286d52c7a82fe25ebaeecfd832eb05d9c74b

SHA512
926487e9f2310cb245560a2048ea848695800ad43998700649cd5956eace72f1846540027c02841b45710592c99adc8375e2399487ca4a82aada50db28704707

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads