sakula | e0d72e192f2548724d1f700184d2a6704422596b343d1e142655f99cb09ab7f9

General

Target
e0d72e192f2548724d1f700184d2a6704422596b343d1e142655f99cb09ab7f9.exe
Size 89KB
Sample220122-bv39jagha2
SHA256 e0d72e192f2548724d1f700184d2a6704422596b343d1e142655f99cb09ab7f9
MD5 96fab28f1539f3909a255436bc269062
SHA1 318b7e2141b31faaa946610723b5fbed76f75114
SHA512 f30a3be419a8f7250dac5a19f12b4a76375c7375661a10ce64f652a7324bbf12ba1622b9b5d17542b43c130a4c76123bf2f5b758f0e117f917ad2697745c61af
MD5 SHA1 SHA512

Score

10^/10

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000013225-54.dat	family_sakula
behavioral1/files/0x0007000000013225-55.dat	family_sakula

Executes dropped EXE 1 IoCs

pid	Process
308	MediaCenter.exe

Deletes itself 1 IoCs

pid	Process
452	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
976	e0d72e192f2548724d1f700184d2a6704422596b343d1e142655f99cb09ab7f9.exe

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	e0d72e192f2548724d1f700184d2a6704422596b343d1e142655f99cb09ab7f9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1084	PING.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	976	e0d72e192f2548724d1f700184d2a6704422596b343d1e142655f99cb09ab7f9.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 976 wrote to memory of 308	976	e0d72e192f2548724d1f700184d2a6704422596b343d1e142655f99cb09ab7f9.exe	27
PID 976 wrote to memory of 308	976	e0d72e192f2548724d1f700184d2a6704422596b343d1e142655f99cb09ab7f9.exe	27
PID 976 wrote to memory of 308	976	e0d72e192f2548724d1f700184d2a6704422596b343d1e142655f99cb09ab7f9.exe	27
PID 976 wrote to memory of 308	976	e0d72e192f2548724d1f700184d2a6704422596b343d1e142655f99cb09ab7f9.exe	27
PID 976 wrote to memory of 452	976	e0d72e192f2548724d1f700184d2a6704422596b343d1e142655f99cb09ab7f9.exe	30
PID 976 wrote to memory of 452	976	e0d72e192f2548724d1f700184d2a6704422596b343d1e142655f99cb09ab7f9.exe	30
PID 976 wrote to memory of 452	976	e0d72e192f2548724d1f700184d2a6704422596b343d1e142655f99cb09ab7f9.exe	30
PID 976 wrote to memory of 452	976	e0d72e192f2548724d1f700184d2a6704422596b343d1e142655f99cb09ab7f9.exe	30
PID 452 wrote to memory of 1084	452	cmd.exe	32
PID 452 wrote to memory of 1084	452	cmd.exe	32
PID 452 wrote to memory of 1084	452	cmd.exe	32
PID 452 wrote to memory of 1084	452	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\e0d72e192f2548724d1f700184d2a6704422596b343d1e142655f99cb09ab7f9.exe
"C:\Users\Admin\AppData\Local\Temp\e0d72e192f2548724d1f700184d2a6704422596b343d1e142655f99cb09ab7f9.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:976
- C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
  C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
  2⤵
  - Executes dropped EXE
  PID:308
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\e0d72e192f2548724d1f700184d2a6704422596b343d1e142655f99cb09ab7f9.exe"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:452
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1084