sakula | 8e26bd2a3f142ee7042483930f5ab49ed67dbde2f2a74b97a3bd1a03cf718eb6

General

Target
8e26bd2a3f142ee7042483930f5ab49ed67dbde2f2a74b97a3bd1a03cf718eb6.exe
Size 79KB
Sample220130-2rt5kabfbl
SHA256 8e26bd2a3f142ee7042483930f5ab49ed67dbde2f2a74b97a3bd1a03cf718eb6
MD5 b4958424c5db8b0eca61ce836b81d192
SHA1 11964209ef14ff3e54f15bc00a2cf87563b02226
SHA512 413aaf9bb6180c8b9d417e22f0c286463109ab84b42613ba4c9cc289b831ad852f98fe4c0c22fb8535699752f75be34646e0a3018a1b0e427fd6c84ca19f3dbc
MD5 SHA1 SHA512

Score

10^/10

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000700000001ab34-118.dat	family_sakula
behavioral2/files/0x000700000001ab34-119.dat	family_sakula

Executes dropped EXE 1 IoCs

pid	Process
652	MediaCenter.exe

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	8e26bd2a3f142ee7042483930f5ab49ed67dbde2f2a74b97a3bd1a03cf718eb6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
3340	PING.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4056	8e26bd2a3f142ee7042483930f5ab49ed67dbde2f2a74b97a3bd1a03cf718eb6.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4056 wrote to memory of 652	4056	8e26bd2a3f142ee7042483930f5ab49ed67dbde2f2a74b97a3bd1a03cf718eb6.exe	68
PID 4056 wrote to memory of 652	4056	8e26bd2a3f142ee7042483930f5ab49ed67dbde2f2a74b97a3bd1a03cf718eb6.exe	68
PID 4056 wrote to memory of 652	4056	8e26bd2a3f142ee7042483930f5ab49ed67dbde2f2a74b97a3bd1a03cf718eb6.exe	68
PID 4056 wrote to memory of 1584	4056	8e26bd2a3f142ee7042483930f5ab49ed67dbde2f2a74b97a3bd1a03cf718eb6.exe	71
PID 4056 wrote to memory of 1584	4056	8e26bd2a3f142ee7042483930f5ab49ed67dbde2f2a74b97a3bd1a03cf718eb6.exe	71
PID 4056 wrote to memory of 1584	4056	8e26bd2a3f142ee7042483930f5ab49ed67dbde2f2a74b97a3bd1a03cf718eb6.exe	71
PID 1584 wrote to memory of 3340	1584	cmd.exe	73
PID 1584 wrote to memory of 3340	1584	cmd.exe	73
PID 1584 wrote to memory of 3340	1584	cmd.exe	73

C:\Users\Admin\AppData\Local\Temp\8e26bd2a3f142ee7042483930f5ab49ed67dbde2f2a74b97a3bd1a03cf718eb6.exe
"C:\Users\Admin\AppData\Local\Temp\8e26bd2a3f142ee7042483930f5ab49ed67dbde2f2a74b97a3bd1a03cf718eb6.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4056
- C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
  C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
  2⤵
  - Executes dropped EXE
  PID:652
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\8e26bd2a3f142ee7042483930f5ab49ed67dbde2f2a74b97a3bd1a03cf718eb6.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1584
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:3340