sakula | 518707434ba01c53a40928e45f1ce8ddef92b4b6c910fd46bac8528020100b5c

General

Target
518707434ba01c53a40928e45f1ce8ddef92b4b6c910fd46bac8528020100b5c.exe
Size 79KB
Sample220130-2ry4hsbfbn
SHA256 518707434ba01c53a40928e45f1ce8ddef92b4b6c910fd46bac8528020100b5c
MD5 b38c4766ec0c5fb9b9e70af0b7414e78
SHA1 dd28c979bfa39a9aae496930f3604852fabf1505
SHA512 57ce3838b16bdcddc07e5bf37a71a7f1a86c7ac3ad83fc1bbebc848a912bbf634afb932fb179a2ddcdca97df1aa0f6ef29b23cfd92a3feac559393613c95e111
MD5 SHA1 SHA512

Score

10^/10

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000700000001ab1f-118.dat	family_sakula
behavioral2/files/0x000700000001ab1f-119.dat	family_sakula

Executes dropped EXE 1 IoCs

pid	Process
1172	MediaCenter.exe

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	518707434ba01c53a40928e45f1ce8ddef92b4b6c910fd46bac8528020100b5c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
900	PING.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	384	518707434ba01c53a40928e45f1ce8ddef92b4b6c910fd46bac8528020100b5c.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 384 wrote to memory of 1172	384	518707434ba01c53a40928e45f1ce8ddef92b4b6c910fd46bac8528020100b5c.exe	69
PID 384 wrote to memory of 1172	384	518707434ba01c53a40928e45f1ce8ddef92b4b6c910fd46bac8528020100b5c.exe	69
PID 384 wrote to memory of 1172	384	518707434ba01c53a40928e45f1ce8ddef92b4b6c910fd46bac8528020100b5c.exe	69
PID 384 wrote to memory of 4088	384	518707434ba01c53a40928e45f1ce8ddef92b4b6c910fd46bac8528020100b5c.exe	70
PID 384 wrote to memory of 4088	384	518707434ba01c53a40928e45f1ce8ddef92b4b6c910fd46bac8528020100b5c.exe	70
PID 384 wrote to memory of 4088	384	518707434ba01c53a40928e45f1ce8ddef92b4b6c910fd46bac8528020100b5c.exe	70
PID 4088 wrote to memory of 900	4088	cmd.exe	72
PID 4088 wrote to memory of 900	4088	cmd.exe	72
PID 4088 wrote to memory of 900	4088	cmd.exe	72

C:\Users\Admin\AppData\Local\Temp\518707434ba01c53a40928e45f1ce8ddef92b4b6c910fd46bac8528020100b5c.exe
"C:\Users\Admin\AppData\Local\Temp\518707434ba01c53a40928e45f1ce8ddef92b4b6c910fd46bac8528020100b5c.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:384
- C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
  C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\518707434ba01c53a40928e45f1ce8ddef92b4b6c910fd46bac8528020100b5c.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4088
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:900