sakula | 51fe6e36cc11720e5d5d2b11993175fd7b95de6a28ecb58deb783e1a4ef0f758

General

Target

51fe6e36cc11720e5d5d2b11993175fd7b95de6a28ecb58deb783e1a4ef0f758.exe
Size

79KB
MD5

116dbfd8f5b6c5a5522d3b83a3821268
SHA1

a87e52e413a3407dc5284e090a636680979592cc
SHA256

51fe6e36cc11720e5d5d2b11993175fd7b95de6a28ecb58deb783e1a4ef0f758
SHA512

471bad05c24db39ffa336f2c8f32c255af07ec754020eb7759df3660bd85b855cc75db18b7053a2e9ae9cb6c59bfa889ba97956d62a50a81287ae35e846a7f58

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula Payload 3 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula

Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1636 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

604 cmd.exe

pid	process
1636	MediaCenter.exe

pid	process
604	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

51fe6e36cc11720e5d5d2b11993175fd7b95de6a28ecb58deb783e1a4ef0f758.exe

pid	process
1224	51fe6e36cc11720e5d5d2b11993175fd7b95de6a28ecb58deb783e1a4ef0f758.exe
1224	51fe6e36cc11720e5d5d2b11993175fd7b95de6a28ecb58deb783e1a4ef0f758.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

51fe6e36cc11720e5d5d2b11993175fd7b95de6a28ecb58deb783e1a4ef0f758.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	51fe6e36cc11720e5d5d2b11993175fd7b95de6a28ecb58deb783e1a4ef0f758.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1992 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

51fe6e36cc11720e5d5d2b11993175fd7b95de6a28ecb58deb783e1a4ef0f758.exe

description pid process

Token: SeIncBasePriorityPrivilege 1224 51fe6e36cc11720e5d5d2b11993175fd7b95de6a28ecb58deb783e1a4ef0f758.exe

pid	process
1992	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1224	51fe6e36cc11720e5d5d2b11993175fd7b95de6a28ecb58deb783e1a4ef0f758.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

51fe6e36cc11720e5d5d2b11993175fd7b95de6a28ecb58deb783e1a4ef0f758.execmd.exe

description	pid	process	target process
PID 1224 wrote to memory of 1636	1224	51fe6e36cc11720e5d5d2b11993175fd7b95de6a28ecb58deb783e1a4ef0f758.exe	MediaCenter.exe
PID 1224 wrote to memory of 1636	1224	51fe6e36cc11720e5d5d2b11993175fd7b95de6a28ecb58deb783e1a4ef0f758.exe	MediaCenter.exe
PID 1224 wrote to memory of 1636	1224	51fe6e36cc11720e5d5d2b11993175fd7b95de6a28ecb58deb783e1a4ef0f758.exe	MediaCenter.exe
PID 1224 wrote to memory of 1636	1224	51fe6e36cc11720e5d5d2b11993175fd7b95de6a28ecb58deb783e1a4ef0f758.exe	MediaCenter.exe
PID 1224 wrote to memory of 604	1224	51fe6e36cc11720e5d5d2b11993175fd7b95de6a28ecb58deb783e1a4ef0f758.exe	cmd.exe
PID 1224 wrote to memory of 604	1224	51fe6e36cc11720e5d5d2b11993175fd7b95de6a28ecb58deb783e1a4ef0f758.exe	cmd.exe
PID 1224 wrote to memory of 604	1224	51fe6e36cc11720e5d5d2b11993175fd7b95de6a28ecb58deb783e1a4ef0f758.exe	cmd.exe
PID 1224 wrote to memory of 604	1224	51fe6e36cc11720e5d5d2b11993175fd7b95de6a28ecb58deb783e1a4ef0f758.exe	cmd.exe
PID 604 wrote to memory of 1992	604	cmd.exe	PING.EXE
PID 604 wrote to memory of 1992	604	cmd.exe	PING.EXE
PID 604 wrote to memory of 1992	604	cmd.exe	PING.EXE
PID 604 wrote to memory of 1992	604	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\51fe6e36cc11720e5d5d2b11993175fd7b95de6a28ecb58deb783e1a4ef0f758.exe
"C:\Users\Admin\AppData\Local\Temp\51fe6e36cc11720e5d5d2b11993175fd7b95de6a28ecb58deb783e1a4ef0f758.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1224

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1636

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\51fe6e36cc11720e5d5d2b11993175fd7b95de6a28ecb58deb783e1a4ef0f758.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:604

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1992

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
42ef37d89f19e099f4bd2dc4c4a1819b

SHA1
6e4c13c7d2496e16f180fd5a39099671c4461caa

SHA256
05a19cecada2123e168bc4fe4983de779a0a9814e8f8e92c76707f4c92a38c95

SHA512
3048c26e86b4793d02d5b6fe3aabb287c620e2ce3e5ccf4f42eb8d8908deccb1b3e8ace49221313c6b17ddcbdc23617af7fb56aa53a4c603feb17d5ba54e9ed4

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
42ef37d89f19e099f4bd2dc4c4a1819b

SHA1
6e4c13c7d2496e16f180fd5a39099671c4461caa

SHA256
05a19cecada2123e168bc4fe4983de779a0a9814e8f8e92c76707f4c92a38c95

SHA512
3048c26e86b4793d02d5b6fe3aabb287c620e2ce3e5ccf4f42eb8d8908deccb1b3e8ace49221313c6b17ddcbdc23617af7fb56aa53a4c603feb17d5ba54e9ed4

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
42ef37d89f19e099f4bd2dc4c4a1819b

SHA1
6e4c13c7d2496e16f180fd5a39099671c4461caa

SHA256
05a19cecada2123e168bc4fe4983de779a0a9814e8f8e92c76707f4c92a38c95

SHA512
3048c26e86b4793d02d5b6fe3aabb287c620e2ce3e5ccf4f42eb8d8908deccb1b3e8ace49221313c6b17ddcbdc23617af7fb56aa53a4c603feb17d5ba54e9ed4

Download Submit
memory/1224-55-0x0000000075421000-0x0000000075423000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads