sakula | 51fe6e36cc11720e5d5d2b11993175fd7b95de6a28ecb58deb783e1a4ef0f758

General

Target

51fe6e36cc11720e5d5d2b11993175fd7b95de6a28ecb58deb783e1a4ef0f758.exe
Size

79KB
MD5

116dbfd8f5b6c5a5522d3b83a3821268
SHA1

a87e52e413a3407dc5284e090a636680979592cc
SHA256

51fe6e36cc11720e5d5d2b11993175fd7b95de6a28ecb58deb783e1a4ef0f758
SHA512

471bad05c24db39ffa336f2c8f32c255af07ec754020eb7759df3660bd85b855cc75db18b7053a2e9ae9cb6c59bfa889ba97956d62a50a81287ae35e846a7f58

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula Payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula

Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

4208 MediaCenter.exe

pid	process
4208	MediaCenter.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

51fe6e36cc11720e5d5d2b11993175fd7b95de6a28ecb58deb783e1a4ef0f758.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	51fe6e36cc11720e5d5d2b11993175fd7b95de6a28ecb58deb783e1a4ef0f758.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

4332 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

51fe6e36cc11720e5d5d2b11993175fd7b95de6a28ecb58deb783e1a4ef0f758.exe

description pid process

Token: SeIncBasePriorityPrivilege 4232 51fe6e36cc11720e5d5d2b11993175fd7b95de6a28ecb58deb783e1a4ef0f758.exe

pid	process
4332	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	4232	51fe6e36cc11720e5d5d2b11993175fd7b95de6a28ecb58deb783e1a4ef0f758.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

51fe6e36cc11720e5d5d2b11993175fd7b95de6a28ecb58deb783e1a4ef0f758.execmd.exe

description	pid	process	target process
PID 4232 wrote to memory of 4208	4232	51fe6e36cc11720e5d5d2b11993175fd7b95de6a28ecb58deb783e1a4ef0f758.exe	MediaCenter.exe
PID 4232 wrote to memory of 4208	4232	51fe6e36cc11720e5d5d2b11993175fd7b95de6a28ecb58deb783e1a4ef0f758.exe	MediaCenter.exe
PID 4232 wrote to memory of 4208	4232	51fe6e36cc11720e5d5d2b11993175fd7b95de6a28ecb58deb783e1a4ef0f758.exe	MediaCenter.exe
PID 4232 wrote to memory of 4440	4232	51fe6e36cc11720e5d5d2b11993175fd7b95de6a28ecb58deb783e1a4ef0f758.exe	cmd.exe
PID 4232 wrote to memory of 4440	4232	51fe6e36cc11720e5d5d2b11993175fd7b95de6a28ecb58deb783e1a4ef0f758.exe	cmd.exe
PID 4232 wrote to memory of 4440	4232	51fe6e36cc11720e5d5d2b11993175fd7b95de6a28ecb58deb783e1a4ef0f758.exe	cmd.exe
PID 4440 wrote to memory of 4332	4440	cmd.exe	PING.EXE
PID 4440 wrote to memory of 4332	4440	cmd.exe	PING.EXE
PID 4440 wrote to memory of 4332	4440	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\51fe6e36cc11720e5d5d2b11993175fd7b95de6a28ecb58deb783e1a4ef0f758.exe
"C:\Users\Admin\AppData\Local\Temp\51fe6e36cc11720e5d5d2b11993175fd7b95de6a28ecb58deb783e1a4ef0f758.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4232

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:4208

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\51fe6e36cc11720e5d5d2b11993175fd7b95de6a28ecb58deb783e1a4ef0f758.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:4440

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:4332

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
284cecacbdea49c37e5c2a3ebde7a419

SHA1
be5a9519624c0144380d5350a9efcd879e27cfef

SHA256
fd4351e24c81592e37de98f5dac120d0250d09a11b8259d51d3727c200e52660

SHA512
4fa788f881ef41b2436bb41fa88e45367f81fde82036df7459748045b38c269e79e0d5a73097ea21ee74a9fee2480ade39827b05a3d001103efb278f9bd4e743

Download Submit
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
284cecacbdea49c37e5c2a3ebde7a419

SHA1
be5a9519624c0144380d5350a9efcd879e27cfef

SHA256
fd4351e24c81592e37de98f5dac120d0250d09a11b8259d51d3727c200e52660

SHA512
4fa788f881ef41b2436bb41fa88e45367f81fde82036df7459748045b38c269e79e0d5a73097ea21ee74a9fee2480ade39827b05a3d001103efb278f9bd4e743

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads