sakula | 344222f5b16aa3d6dba53d46fd9264ed9fd1f3cc5800ae3a33fea675e41ea093

General

Target

344222f5b16aa3d6dba53d46fd9264ed9fd1f3cc5800ae3a33fea675e41ea093.exe
Size

89KB
MD5

388a7ae6963fd4da3ec0a4371738f4e0
SHA1

f1a0ff10024d817339030c40e7762b501f4edda8
SHA256

344222f5b16aa3d6dba53d46fd9264ed9fd1f3cc5800ae3a33fea675e41ea093
SHA512

4abf69295dc375ecdc8b85d17b864d13351eb4ec47b6fed7c38d31e37c0c0a04efab63c3c9c3749236be45eb38a5115a69eb371c0caab55509bf79ce02e6a881

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula Payload 2 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula

Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1892 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1164 cmd.exe
Loads dropped DLL 1 IoCs

Processes:

344222f5b16aa3d6dba53d46fd9264ed9fd1f3cc5800ae3a33fea675e41ea093.exe

pid process

1684 344222f5b16aa3d6dba53d46fd9264ed9fd1f3cc5800ae3a33fea675e41ea093.exe

pid	process
1892	MediaCenter.exe

pid	process
1164	cmd.exe

pid	process
1684	344222f5b16aa3d6dba53d46fd9264ed9fd1f3cc5800ae3a33fea675e41ea093.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

344222f5b16aa3d6dba53d46fd9264ed9fd1f3cc5800ae3a33fea675e41ea093.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	344222f5b16aa3d6dba53d46fd9264ed9fd1f3cc5800ae3a33fea675e41ea093.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1628 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

344222f5b16aa3d6dba53d46fd9264ed9fd1f3cc5800ae3a33fea675e41ea093.exe

description pid process

Token: SeIncBasePriorityPrivilege 1684 344222f5b16aa3d6dba53d46fd9264ed9fd1f3cc5800ae3a33fea675e41ea093.exe

pid	process
1628	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1684	344222f5b16aa3d6dba53d46fd9264ed9fd1f3cc5800ae3a33fea675e41ea093.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

344222f5b16aa3d6dba53d46fd9264ed9fd1f3cc5800ae3a33fea675e41ea093.execmd.exe

description	pid	process	target process
PID 1684 wrote to memory of 1892	1684	344222f5b16aa3d6dba53d46fd9264ed9fd1f3cc5800ae3a33fea675e41ea093.exe	MediaCenter.exe
PID 1684 wrote to memory of 1892	1684	344222f5b16aa3d6dba53d46fd9264ed9fd1f3cc5800ae3a33fea675e41ea093.exe	MediaCenter.exe
PID 1684 wrote to memory of 1892	1684	344222f5b16aa3d6dba53d46fd9264ed9fd1f3cc5800ae3a33fea675e41ea093.exe	MediaCenter.exe
PID 1684 wrote to memory of 1892	1684	344222f5b16aa3d6dba53d46fd9264ed9fd1f3cc5800ae3a33fea675e41ea093.exe	MediaCenter.exe
PID 1684 wrote to memory of 1164	1684	344222f5b16aa3d6dba53d46fd9264ed9fd1f3cc5800ae3a33fea675e41ea093.exe	cmd.exe
PID 1684 wrote to memory of 1164	1684	344222f5b16aa3d6dba53d46fd9264ed9fd1f3cc5800ae3a33fea675e41ea093.exe	cmd.exe
PID 1684 wrote to memory of 1164	1684	344222f5b16aa3d6dba53d46fd9264ed9fd1f3cc5800ae3a33fea675e41ea093.exe	cmd.exe
PID 1684 wrote to memory of 1164	1684	344222f5b16aa3d6dba53d46fd9264ed9fd1f3cc5800ae3a33fea675e41ea093.exe	cmd.exe
PID 1164 wrote to memory of 1628	1164	cmd.exe	PING.EXE
PID 1164 wrote to memory of 1628	1164	cmd.exe	PING.EXE
PID 1164 wrote to memory of 1628	1164	cmd.exe	PING.EXE
PID 1164 wrote to memory of 1628	1164	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\344222f5b16aa3d6dba53d46fd9264ed9fd1f3cc5800ae3a33fea675e41ea093.exe
"C:\Users\Admin\AppData\Local\Temp\344222f5b16aa3d6dba53d46fd9264ed9fd1f3cc5800ae3a33fea675e41ea093.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1684

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1892

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\344222f5b16aa3d6dba53d46fd9264ed9fd1f3cc5800ae3a33fea675e41ea093.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1164

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1628

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
64d874d075051994c6b60b75da46de68

SHA1
e9ce36d43295124ce47ecd15f7472d89080343c1

SHA256
ba08f8bdd18ff65b7017bd1690a2f9bbcae0d5b522cafb7544f7eccfba327d1e

SHA512
fe915e59cc5692903e35c5a593a507b4bdfe82ced4b330d8bb0d9b8bbc3bf7672956df176d467817d2bfa1cf95841f649d225563fe8282c0ff52bef7d43ad151

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
64d874d075051994c6b60b75da46de68

SHA1
e9ce36d43295124ce47ecd15f7472d89080343c1

SHA256
ba08f8bdd18ff65b7017bd1690a2f9bbcae0d5b522cafb7544f7eccfba327d1e

SHA512
fe915e59cc5692903e35c5a593a507b4bdfe82ced4b330d8bb0d9b8bbc3bf7672956df176d467817d2bfa1cf95841f649d225563fe8282c0ff52bef7d43ad151

Download Submit
memory/1684-54-0x0000000075D61000-0x0000000075D63000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads