sakula | 173870c436ec833d06af153e9ad054fbaed6b2a7c096972e9b992de09b826950

General

Target

173870c436ec833d06af153e9ad054fbaed6b2a7c096972e9b992de09b826950.exe
Size

60KB
MD5

99ec4574c74cf455f584bf0ea6f81c78
SHA1

b8e894d3818ce77e6707a4859b07947ee4bbe72a
SHA256

173870c436ec833d06af153e9ad054fbaed6b2a7c096972e9b992de09b826950
SHA512

66d044c48545379be71795da7c4f10da6c1c4be61de9941379b4f61166316013b8d512e897aff1cfe02f359c7d40f2d633a83f9459047fb15d71f25e1433593b

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1664 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

392 cmd.exe

pid	process
1664	MediaCenter.exe

pid	process
392	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

173870c436ec833d06af153e9ad054fbaed6b2a7c096972e9b992de09b826950.exe

pid	process
288	173870c436ec833d06af153e9ad054fbaed6b2a7c096972e9b992de09b826950.exe
288	173870c436ec833d06af153e9ad054fbaed6b2a7c096972e9b992de09b826950.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

173870c436ec833d06af153e9ad054fbaed6b2a7c096972e9b992de09b826950.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	173870c436ec833d06af153e9ad054fbaed6b2a7c096972e9b992de09b826950.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1992 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

173870c436ec833d06af153e9ad054fbaed6b2a7c096972e9b992de09b826950.exe

description pid process

Token: SeIncBasePriorityPrivilege 288 173870c436ec833d06af153e9ad054fbaed6b2a7c096972e9b992de09b826950.exe

pid	process
1992	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	288	173870c436ec833d06af153e9ad054fbaed6b2a7c096972e9b992de09b826950.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

173870c436ec833d06af153e9ad054fbaed6b2a7c096972e9b992de09b826950.execmd.exe

description	pid	process	target process
PID 288 wrote to memory of 1664	288	173870c436ec833d06af153e9ad054fbaed6b2a7c096972e9b992de09b826950.exe	MediaCenter.exe
PID 288 wrote to memory of 1664	288	173870c436ec833d06af153e9ad054fbaed6b2a7c096972e9b992de09b826950.exe	MediaCenter.exe
PID 288 wrote to memory of 1664	288	173870c436ec833d06af153e9ad054fbaed6b2a7c096972e9b992de09b826950.exe	MediaCenter.exe
PID 288 wrote to memory of 1664	288	173870c436ec833d06af153e9ad054fbaed6b2a7c096972e9b992de09b826950.exe	MediaCenter.exe
PID 288 wrote to memory of 392	288	173870c436ec833d06af153e9ad054fbaed6b2a7c096972e9b992de09b826950.exe	cmd.exe
PID 288 wrote to memory of 392	288	173870c436ec833d06af153e9ad054fbaed6b2a7c096972e9b992de09b826950.exe	cmd.exe
PID 288 wrote to memory of 392	288	173870c436ec833d06af153e9ad054fbaed6b2a7c096972e9b992de09b826950.exe	cmd.exe
PID 288 wrote to memory of 392	288	173870c436ec833d06af153e9ad054fbaed6b2a7c096972e9b992de09b826950.exe	cmd.exe
PID 392 wrote to memory of 1992	392	cmd.exe	PING.EXE
PID 392 wrote to memory of 1992	392	cmd.exe	PING.EXE
PID 392 wrote to memory of 1992	392	cmd.exe	PING.EXE
PID 392 wrote to memory of 1992	392	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\173870c436ec833d06af153e9ad054fbaed6b2a7c096972e9b992de09b826950.exe
"C:\Users\Admin\AppData\Local\Temp\173870c436ec833d06af153e9ad054fbaed6b2a7c096972e9b992de09b826950.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:288

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1664

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\173870c436ec833d06af153e9ad054fbaed6b2a7c096972e9b992de09b826950.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:392

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1992

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
320b3266d30d25d079bde24631efdbf6

SHA1
7883af9dd5b85e04e886ad23b27a70bd87af6649

SHA256
43dbca9d87c04c7029962463b0af6eeca8bca4cea538a7aeb3ce13d8bbf60855

SHA512
9d8e518e5c398e2a1f409a1b1c4ab4ddb857ad30e9e196e4edf43e40b4bd833aee080b20eefc262224d90073378d5520dc58eae761bb7d0f7e4dcd36d6d588d2

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
320b3266d30d25d079bde24631efdbf6

SHA1
7883af9dd5b85e04e886ad23b27a70bd87af6649

SHA256
43dbca9d87c04c7029962463b0af6eeca8bca4cea538a7aeb3ce13d8bbf60855

SHA512
9d8e518e5c398e2a1f409a1b1c4ab4ddb857ad30e9e196e4edf43e40b4bd833aee080b20eefc262224d90073378d5520dc58eae761bb7d0f7e4dcd36d6d588d2

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
320b3266d30d25d079bde24631efdbf6

SHA1
7883af9dd5b85e04e886ad23b27a70bd87af6649

SHA256
43dbca9d87c04c7029962463b0af6eeca8bca4cea538a7aeb3ce13d8bbf60855

SHA512
9d8e518e5c398e2a1f409a1b1c4ab4ddb857ad30e9e196e4edf43e40b4bd833aee080b20eefc262224d90073378d5520dc58eae761bb7d0f7e4dcd36d6d588d2

Download Submit
memory/288-54-0x0000000075D61000-0x0000000075D63000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads