sakula | e0d72e192f2548724d1f700184d2a6704422596b343d1e142655f99cb09ab7f9

General

Target
e0d72e192f2548724d1f700184d2a6704422596b343d1e142655f99cb09ab7f9.exe
Size 89KB
Sample220122-bv39jagha2
SHA256 e0d72e192f2548724d1f700184d2a6704422596b343d1e142655f99cb09ab7f9
MD5 96fab28f1539f3909a255436bc269062
SHA1 318b7e2141b31faaa946610723b5fbed76f75114
SHA512 f30a3be419a8f7250dac5a19f12b4a76375c7375661a10ce64f652a7324bbf12ba1622b9b5d17542b43c130a4c76123bf2f5b758f0e117f917ad2697745c61af
MD5 SHA1 SHA512

Score

10^/10

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000700000001ab23-118.dat	family_sakula
behavioral2/files/0x000700000001ab23-119.dat	family_sakula

Executes dropped EXE 1 IoCs

pid	Process
3808	MediaCenter.exe

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	e0d72e192f2548724d1f700184d2a6704422596b343d1e142655f99cb09ab7f9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
4388	PING.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3436	e0d72e192f2548724d1f700184d2a6704422596b343d1e142655f99cb09ab7f9.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3436 wrote to memory of 3808	3436	e0d72e192f2548724d1f700184d2a6704422596b343d1e142655f99cb09ab7f9.exe	68
PID 3436 wrote to memory of 3808	3436	e0d72e192f2548724d1f700184d2a6704422596b343d1e142655f99cb09ab7f9.exe	68
PID 3436 wrote to memory of 3808	3436	e0d72e192f2548724d1f700184d2a6704422596b343d1e142655f99cb09ab7f9.exe	68
PID 3436 wrote to memory of 4356	3436	e0d72e192f2548724d1f700184d2a6704422596b343d1e142655f99cb09ab7f9.exe	70
PID 3436 wrote to memory of 4356	3436	e0d72e192f2548724d1f700184d2a6704422596b343d1e142655f99cb09ab7f9.exe	70
PID 3436 wrote to memory of 4356	3436	e0d72e192f2548724d1f700184d2a6704422596b343d1e142655f99cb09ab7f9.exe	70
PID 4356 wrote to memory of 4388	4356	cmd.exe	72
PID 4356 wrote to memory of 4388	4356	cmd.exe	72
PID 4356 wrote to memory of 4388	4356	cmd.exe	72

C:\Users\Admin\AppData\Local\Temp\e0d72e192f2548724d1f700184d2a6704422596b343d1e142655f99cb09ab7f9.exe
"C:\Users\Admin\AppData\Local\Temp\e0d72e192f2548724d1f700184d2a6704422596b343d1e142655f99cb09ab7f9.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3436
- C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
  C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
  2⤵
  - Executes dropped EXE
  PID:3808
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\e0d72e192f2548724d1f700184d2a6704422596b343d1e142655f99cb09ab7f9.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4356
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:4388