sakula | 8d168092d5601ebbaed24ec3caeef7454c48cf21366cd76560755eb33aff89e9

General

Target

8d168092d5601ebbaed24ec3caeef7454c48cf21366cd76560755eb33aff89e9.exe
Size

496KB
MD5

98721c78dfbf8a45d152a888c804427c
SHA1

e8d06bd24e600f95b67786db6ff37da1c8995854
SHA256

8d168092d5601ebbaed24ec3caeef7454c48cf21366cd76560755eb33aff89e9
SHA512

5f5bf474744c715965a3fff72d5091cec45196b4c2afe44c3ae0e54e08a5a5b8c34494501961b6f2bdfa1a74f9d0b8990b09547beb34e8604ab735b944c15296

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
Executes dropped EXE 2 IoCs

Processes:

Center259387183.datMediaCenter.exe

pid process

656 Center259387183.dat
636 MediaCenter.exe

pid	process
656	Center259387183.dat
636	MediaCenter.exe

Loads dropped DLL 4 IoCs

Processes:

8d168092d5601ebbaed24ec3caeef7454c48cf21366cd76560755eb33aff89e9.exeCenter259387183.dat

pid	process
1500	8d168092d5601ebbaed24ec3caeef7454c48cf21366cd76560755eb33aff89e9.exe
1500	8d168092d5601ebbaed24ec3caeef7454c48cf21366cd76560755eb33aff89e9.exe
656	Center259387183.dat
656	Center259387183.dat

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000029a8fa03d77d0143b95f148165a5bc9200000000020000000000106600000001000020000000daf3308927bd01784af1707b5343d20ed113b9c80e2e11e066df25825b2d7723000000000e8000000002000020000000d2d2fee9ef1d65ff1c076524d10e54f9a795a4991b5037ba07b93b7a2436dafb9000000010d3d2b3670b901436de9ce73e70817113de9f799e7bc2584fa0fa17da8bb6b5b4ec5c0eb4d62e35eefeacea30c9c4ac77b591cfa544b4e1a165afc308364d666d5e9664bad760d70fe6b3238e4ead5544cb63496f725a70e874775425190b3242dd4dd8105ee1e4395515bb50a7d8c9c34875bd9d7e2ac6222c79e76db0975f6ff1968314e6be8c035f98c38bb5e2b9400000001344eaee65ee2f972c7b69db0ab51b84fa8698ca222150cbc67edf8c0cdcadfd99a8a69f7d4f802afd3dc9638a6008ad318f8211b7d33c4e89fd7d01f19f782a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B3E48C01-7B4E-11EC-94AA-F2153E37317C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c014b3925b0fd801	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "349598830"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000029a8fa03d77d0143b95f148165a5bc92000000000200000000001066000000010000200000008c76643f4ed5faaeb5df4abad9504a879f868ad00d70342c00e6d1da850a6249000000000e8000000002000020000000a9b4ae6c387cdc6afbc2d713b87879cebb06862a10bd4aa304d7eff6ce8757542000000069648fd8ad4732f86f081a9dac05c412f73f57f8acf4c03e82a55dd0c080db664000000071084345a007a137ce1b43345b7d2626a9421d1ef3a32798364e4b46f271e8f1d1e878a7985dc949cdc3e20c46158512bbd826e1be5d400493e30efdc587a2ce	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

1960 reg.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1460 PING.EXE
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

IEXPLORE.EXE

pid process

1980 IEXPLORE.EXE
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

872 iexplore.exe

pid	process
1960	reg.exe

pid	process
1460	PING.EXE

pid	process
1980	IEXPLORE.EXE

pid	process
872	iexplore.exe

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

8d168092d5601ebbaed24ec3caeef7454c48cf21366cd76560755eb33aff89e9.exeiexplore.exeIEXPLORE.EXE

pid	process
1500	8d168092d5601ebbaed24ec3caeef7454c48cf21366cd76560755eb33aff89e9.exe
1500	8d168092d5601ebbaed24ec3caeef7454c48cf21366cd76560755eb33aff89e9.exe
872	iexplore.exe
872	iexplore.exe
1980	IEXPLORE.EXE
1980	IEXPLORE.EXE
1980	IEXPLORE.EXE
1980	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

8d168092d5601ebbaed24ec3caeef7454c48cf21366cd76560755eb33aff89e9.exeCenter259387183.datcmd.exeiexplore.execmd.exe

description	pid	process	target process
PID 1500 wrote to memory of 656	1500	8d168092d5601ebbaed24ec3caeef7454c48cf21366cd76560755eb33aff89e9.exe	Center259387183.dat
PID 1500 wrote to memory of 656	1500	8d168092d5601ebbaed24ec3caeef7454c48cf21366cd76560755eb33aff89e9.exe	Center259387183.dat
PID 1500 wrote to memory of 656	1500	8d168092d5601ebbaed24ec3caeef7454c48cf21366cd76560755eb33aff89e9.exe	Center259387183.dat
PID 1500 wrote to memory of 656	1500	8d168092d5601ebbaed24ec3caeef7454c48cf21366cd76560755eb33aff89e9.exe	Center259387183.dat
PID 1500 wrote to memory of 872	1500	8d168092d5601ebbaed24ec3caeef7454c48cf21366cd76560755eb33aff89e9.exe	iexplore.exe
PID 1500 wrote to memory of 872	1500	8d168092d5601ebbaed24ec3caeef7454c48cf21366cd76560755eb33aff89e9.exe	iexplore.exe
PID 1500 wrote to memory of 872	1500	8d168092d5601ebbaed24ec3caeef7454c48cf21366cd76560755eb33aff89e9.exe	iexplore.exe
PID 1500 wrote to memory of 872	1500	8d168092d5601ebbaed24ec3caeef7454c48cf21366cd76560755eb33aff89e9.exe	iexplore.exe
PID 656 wrote to memory of 1400	656	Center259387183.dat	cmd.exe
PID 656 wrote to memory of 1400	656	Center259387183.dat	cmd.exe
PID 656 wrote to memory of 1400	656	Center259387183.dat	cmd.exe
PID 656 wrote to memory of 1400	656	Center259387183.dat	cmd.exe
PID 656 wrote to memory of 636	656	Center259387183.dat	MediaCenter.exe
PID 656 wrote to memory of 636	656	Center259387183.dat	MediaCenter.exe
PID 656 wrote to memory of 636	656	Center259387183.dat	MediaCenter.exe
PID 656 wrote to memory of 636	656	Center259387183.dat	MediaCenter.exe
PID 1400 wrote to memory of 1960	1400	cmd.exe	reg.exe
PID 1400 wrote to memory of 1960	1400	cmd.exe	reg.exe
PID 1400 wrote to memory of 1960	1400	cmd.exe	reg.exe
PID 1400 wrote to memory of 1960	1400	cmd.exe	reg.exe
PID 872 wrote to memory of 1980	872	iexplore.exe	IEXPLORE.EXE
PID 872 wrote to memory of 1980	872	iexplore.exe	IEXPLORE.EXE
PID 872 wrote to memory of 1980	872	iexplore.exe	IEXPLORE.EXE
PID 872 wrote to memory of 1980	872	iexplore.exe	IEXPLORE.EXE
PID 656 wrote to memory of 1936	656	Center259387183.dat	cmd.exe
PID 656 wrote to memory of 1936	656	Center259387183.dat	cmd.exe
PID 656 wrote to memory of 1936	656	Center259387183.dat	cmd.exe
PID 656 wrote to memory of 1936	656	Center259387183.dat	cmd.exe
PID 1936 wrote to memory of 1460	1936	cmd.exe	PING.EXE
PID 1936 wrote to memory of 1460	1936	cmd.exe	PING.EXE
PID 1936 wrote to memory of 1460	1936	cmd.exe	PING.EXE
PID 1936 wrote to memory of 1460	1936	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\8d168092d5601ebbaed24ec3caeef7454c48cf21366cd76560755eb33aff89e9.exe
"C:\Users\Admin\AppData\Local\Temp\8d168092d5601ebbaed24ec3caeef7454c48cf21366cd76560755eb33aff89e9.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1500

C:\Users\Admin\AppData\Local\Temp\Center259387183.dat
"C:\Users\Admin\AppData\Local\Temp\Center259387183.dat"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:656

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:1400

C:\Windows\SysWOW64\reg.exe
reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"
4⤵
- Adds Run key to start application
- Modifies registry key
PID:1960

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
3⤵
- Executes dropped EXE
PID:636

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\Center259387183.dat"
3⤵
- Suspicious use of WriteProcessMemory
PID:1936

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
4⤵
- Runs ping.exe
PID:1460

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://extcitrix.we11point.com/vpn/index.php?ref=1
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:872

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:872 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1980

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Center259387183.dat

MD5
cb56b1fc08451d1f56481a29bd1047e9

SHA1
c01fbb52a7a188c4f7441a808b153a34ec753a2d

SHA256
3e2805c14a8ec785a36022218a37a235abe4548baf1bde50aa05dc5692f01ed1

SHA512
b088e9d5b28727c23f54e84cffc5f249ddeb00cb0ce97c3776c3195d2a46e000b90690b17882110ed5d60b8184b0d77f8659b72608dc78899a1dcab582f55eb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Center259387183.dat

MD5
cb56b1fc08451d1f56481a29bd1047e9

SHA1
c01fbb52a7a188c4f7441a808b153a34ec753a2d

SHA256
3e2805c14a8ec785a36022218a37a235abe4548baf1bde50aa05dc5692f01ed1

SHA512
b088e9d5b28727c23f54e84cffc5f249ddeb00cb0ce97c3776c3195d2a46e000b90690b17882110ed5d60b8184b0d77f8659b72608dc78899a1dcab582f55eb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
4ef2f78ba07d3ecfd30997617520a6aa

SHA1
eb5a61ffa0f209e2362318e16f08580964981c49

SHA256
ede2962b66c3b771f887fdebea517d09576bdf897d778e24a8769b8485045c65

SHA512
3679e70c7f976fd7486e2921b111f77c9691e784dbbdb619a805328bf8ac69546ff4a184c37d0a06717a014476db759db507abd7e3b754e1aeec8ddf46b909c7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\CRI8OCT3.txt

MD5
4ee915258c0c58d807e32b9f5c153c8c

SHA1
1fbad516f6dd437509eb2fbda29a619a3a1d1179

SHA256
11a259e09e060db82dbadaa534eb5437febb071fe06504bbd27edbc5fa53d78c

SHA512
93fadb831860306c8e9fddbe2e98aeb3ef547f94ed68749320ce8a55a5edabaebcab69279b251b20bd6a0336fb9714cf6cfeb243c14adec7e062fd53ea05d7db

Download Submit
\Users\Admin\AppData\Local\Temp\Center259387183.dat

MD5
cb56b1fc08451d1f56481a29bd1047e9

SHA1
c01fbb52a7a188c4f7441a808b153a34ec753a2d

SHA256
3e2805c14a8ec785a36022218a37a235abe4548baf1bde50aa05dc5692f01ed1

SHA512
b088e9d5b28727c23f54e84cffc5f249ddeb00cb0ce97c3776c3195d2a46e000b90690b17882110ed5d60b8184b0d77f8659b72608dc78899a1dcab582f55eb8

Download Submit
\Users\Admin\AppData\Local\Temp\Center259387183.dat

MD5
cb56b1fc08451d1f56481a29bd1047e9

SHA1
c01fbb52a7a188c4f7441a808b153a34ec753a2d

SHA256
3e2805c14a8ec785a36022218a37a235abe4548baf1bde50aa05dc5692f01ed1

SHA512
b088e9d5b28727c23f54e84cffc5f249ddeb00cb0ce97c3776c3195d2a46e000b90690b17882110ed5d60b8184b0d77f8659b72608dc78899a1dcab582f55eb8

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
4ef2f78ba07d3ecfd30997617520a6aa

SHA1
eb5a61ffa0f209e2362318e16f08580964981c49

SHA256
ede2962b66c3b771f887fdebea517d09576bdf897d778e24a8769b8485045c65

SHA512
3679e70c7f976fd7486e2921b111f77c9691e784dbbdb619a805328bf8ac69546ff4a184c37d0a06717a014476db759db507abd7e3b754e1aeec8ddf46b909c7

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
4ef2f78ba07d3ecfd30997617520a6aa

SHA1
eb5a61ffa0f209e2362318e16f08580964981c49

SHA256
ede2962b66c3b771f887fdebea517d09576bdf897d778e24a8769b8485045c65

SHA512
3679e70c7f976fd7486e2921b111f77c9691e784dbbdb619a805328bf8ac69546ff4a184c37d0a06717a014476db759db507abd7e3b754e1aeec8ddf46b909c7

Download Submit
memory/1500-53-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads