sakula | 172b4364d2cd24a356bb2c32659e0f5c2b06c3f82917f6c55746d76e08b68e74

General

Target

172b4364d2cd24a356bb2c32659e0f5c2b06c3f82917f6c55746d76e08b68e74.exe
Size

101KB
MD5

491209bf4babcd8217a1f3f63b62f413
SHA1

58e2ca4d17101170fc816f79b40f8b8795e37996
SHA256

172b4364d2cd24a356bb2c32659e0f5c2b06c3f82917f6c55746d76e08b68e74
SHA512

14a6e377256f9c1ed95c4a45a07a28d4c3404dfae2217822d04c1a046c6984759ef452f1e0e331c25f237e4dd18fd0e63aa7af5253b5511c7c37c1a0a0b34f22

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula Payload 3 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula

Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

948 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1984 cmd.exe

pid	process
948	MediaCenter.exe

pid	process
1984	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

172b4364d2cd24a356bb2c32659e0f5c2b06c3f82917f6c55746d76e08b68e74.exe

pid	process
732	172b4364d2cd24a356bb2c32659e0f5c2b06c3f82917f6c55746d76e08b68e74.exe
732	172b4364d2cd24a356bb2c32659e0f5c2b06c3f82917f6c55746d76e08b68e74.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

172b4364d2cd24a356bb2c32659e0f5c2b06c3f82917f6c55746d76e08b68e74.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	172b4364d2cd24a356bb2c32659e0f5c2b06c3f82917f6c55746d76e08b68e74.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1192 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

172b4364d2cd24a356bb2c32659e0f5c2b06c3f82917f6c55746d76e08b68e74.exe

description pid process

Token: SeIncBasePriorityPrivilege 732 172b4364d2cd24a356bb2c32659e0f5c2b06c3f82917f6c55746d76e08b68e74.exe

pid	process
1192	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	732	172b4364d2cd24a356bb2c32659e0f5c2b06c3f82917f6c55746d76e08b68e74.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

172b4364d2cd24a356bb2c32659e0f5c2b06c3f82917f6c55746d76e08b68e74.execmd.exe

description	pid	process	target process
PID 732 wrote to memory of 948	732	172b4364d2cd24a356bb2c32659e0f5c2b06c3f82917f6c55746d76e08b68e74.exe	MediaCenter.exe
PID 732 wrote to memory of 948	732	172b4364d2cd24a356bb2c32659e0f5c2b06c3f82917f6c55746d76e08b68e74.exe	MediaCenter.exe
PID 732 wrote to memory of 948	732	172b4364d2cd24a356bb2c32659e0f5c2b06c3f82917f6c55746d76e08b68e74.exe	MediaCenter.exe
PID 732 wrote to memory of 948	732	172b4364d2cd24a356bb2c32659e0f5c2b06c3f82917f6c55746d76e08b68e74.exe	MediaCenter.exe
PID 732 wrote to memory of 1984	732	172b4364d2cd24a356bb2c32659e0f5c2b06c3f82917f6c55746d76e08b68e74.exe	cmd.exe
PID 732 wrote to memory of 1984	732	172b4364d2cd24a356bb2c32659e0f5c2b06c3f82917f6c55746d76e08b68e74.exe	cmd.exe
PID 732 wrote to memory of 1984	732	172b4364d2cd24a356bb2c32659e0f5c2b06c3f82917f6c55746d76e08b68e74.exe	cmd.exe
PID 732 wrote to memory of 1984	732	172b4364d2cd24a356bb2c32659e0f5c2b06c3f82917f6c55746d76e08b68e74.exe	cmd.exe
PID 1984 wrote to memory of 1192	1984	cmd.exe	PING.EXE
PID 1984 wrote to memory of 1192	1984	cmd.exe	PING.EXE
PID 1984 wrote to memory of 1192	1984	cmd.exe	PING.EXE
PID 1984 wrote to memory of 1192	1984	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\172b4364d2cd24a356bb2c32659e0f5c2b06c3f82917f6c55746d76e08b68e74.exe
"C:\Users\Admin\AppData\Local\Temp\172b4364d2cd24a356bb2c32659e0f5c2b06c3f82917f6c55746d76e08b68e74.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:732

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:948

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\172b4364d2cd24a356bb2c32659e0f5c2b06c3f82917f6c55746d76e08b68e74.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1984

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1192

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
3071dedee99f63ceac002414c6a25a04

SHA1
0c57c87da1fbdc1a509f0879a19e50fe9e795b2d

SHA256
b9de62b0d30584a0dafb86471c72a68a09ce45d3999667af16244d5e7010bb8b

SHA512
50645b60aef0803caf8995f88795eec4c2f4f3b29c5bb820a9a82990d858dfe60df9af9d711e2dcf9ee75c760b2edbd6fa9da28b26945003d6e4e617ae9b2887

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
3071dedee99f63ceac002414c6a25a04

SHA1
0c57c87da1fbdc1a509f0879a19e50fe9e795b2d

SHA256
b9de62b0d30584a0dafb86471c72a68a09ce45d3999667af16244d5e7010bb8b

SHA512
50645b60aef0803caf8995f88795eec4c2f4f3b29c5bb820a9a82990d858dfe60df9af9d711e2dcf9ee75c760b2edbd6fa9da28b26945003d6e4e617ae9b2887

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
3071dedee99f63ceac002414c6a25a04

SHA1
0c57c87da1fbdc1a509f0879a19e50fe9e795b2d

SHA256
b9de62b0d30584a0dafb86471c72a68a09ce45d3999667af16244d5e7010bb8b

SHA512
50645b60aef0803caf8995f88795eec4c2f4f3b29c5bb820a9a82990d858dfe60df9af9d711e2dcf9ee75c760b2edbd6fa9da28b26945003d6e4e617ae9b2887

Download Submit
memory/732-55-0x0000000076B81000-0x0000000076B83000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads