sakula | 16ef4d2b67c8bc6248f6de5d7323e73f00917a98fb9170ddf334a0b6124ce81d

General

Target

16ef4d2b67c8bc6248f6de5d7323e73f00917a98fb9170ddf334a0b6124ce81d.exe
Size

36KB
MD5

ecdaf920aad5c7421efab1bf87984bd5
SHA1

f67ada3cfcbb81db2019cf07970e65e6772ed12b
SHA256

16ef4d2b67c8bc6248f6de5d7323e73f00917a98fb9170ddf334a0b6124ce81d
SHA512

db0f6a28f05f8fd6ee3401a59ca9229ac1de7fd5c73dc9648a23513cd11f85c16899f1b698c382fa5b643de17a64da295524c837c6dc676d8aa18c46a64bae9d

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1028 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

808 cmd.exe

pid	process
1028	MediaCenter.exe

pid	process
808	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

16ef4d2b67c8bc6248f6de5d7323e73f00917a98fb9170ddf334a0b6124ce81d.exe

pid	process
960	16ef4d2b67c8bc6248f6de5d7323e73f00917a98fb9170ddf334a0b6124ce81d.exe
960	16ef4d2b67c8bc6248f6de5d7323e73f00917a98fb9170ddf334a0b6124ce81d.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

16ef4d2b67c8bc6248f6de5d7323e73f00917a98fb9170ddf334a0b6124ce81d.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	16ef4d2b67c8bc6248f6de5d7323e73f00917a98fb9170ddf334a0b6124ce81d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1852 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

16ef4d2b67c8bc6248f6de5d7323e73f00917a98fb9170ddf334a0b6124ce81d.exe

description pid process

Token: SeIncBasePriorityPrivilege 960 16ef4d2b67c8bc6248f6de5d7323e73f00917a98fb9170ddf334a0b6124ce81d.exe

pid	process
1852	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	960	16ef4d2b67c8bc6248f6de5d7323e73f00917a98fb9170ddf334a0b6124ce81d.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

16ef4d2b67c8bc6248f6de5d7323e73f00917a98fb9170ddf334a0b6124ce81d.execmd.exe

description	pid	process	target process
PID 960 wrote to memory of 1028	960	16ef4d2b67c8bc6248f6de5d7323e73f00917a98fb9170ddf334a0b6124ce81d.exe	MediaCenter.exe
PID 960 wrote to memory of 1028	960	16ef4d2b67c8bc6248f6de5d7323e73f00917a98fb9170ddf334a0b6124ce81d.exe	MediaCenter.exe
PID 960 wrote to memory of 1028	960	16ef4d2b67c8bc6248f6de5d7323e73f00917a98fb9170ddf334a0b6124ce81d.exe	MediaCenter.exe
PID 960 wrote to memory of 1028	960	16ef4d2b67c8bc6248f6de5d7323e73f00917a98fb9170ddf334a0b6124ce81d.exe	MediaCenter.exe
PID 960 wrote to memory of 808	960	16ef4d2b67c8bc6248f6de5d7323e73f00917a98fb9170ddf334a0b6124ce81d.exe	cmd.exe
PID 960 wrote to memory of 808	960	16ef4d2b67c8bc6248f6de5d7323e73f00917a98fb9170ddf334a0b6124ce81d.exe	cmd.exe
PID 960 wrote to memory of 808	960	16ef4d2b67c8bc6248f6de5d7323e73f00917a98fb9170ddf334a0b6124ce81d.exe	cmd.exe
PID 960 wrote to memory of 808	960	16ef4d2b67c8bc6248f6de5d7323e73f00917a98fb9170ddf334a0b6124ce81d.exe	cmd.exe
PID 808 wrote to memory of 1852	808	cmd.exe	PING.EXE
PID 808 wrote to memory of 1852	808	cmd.exe	PING.EXE
PID 808 wrote to memory of 1852	808	cmd.exe	PING.EXE
PID 808 wrote to memory of 1852	808	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\16ef4d2b67c8bc6248f6de5d7323e73f00917a98fb9170ddf334a0b6124ce81d.exe
"C:\Users\Admin\AppData\Local\Temp\16ef4d2b67c8bc6248f6de5d7323e73f00917a98fb9170ddf334a0b6124ce81d.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:960

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1028

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\16ef4d2b67c8bc6248f6de5d7323e73f00917a98fb9170ddf334a0b6124ce81d.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:808

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1852

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
4dbdd24d70ef0ee03f6d9e5277242b35

SHA1
57b81968bebe9e793bc34682b591589e6b616f23

SHA256
c70208a24a53ca126ef0cd4b55c0aac1cb244c6e88155d752b6eeeb82fdfe12a

SHA512
e0877b1b665d2a6822bf5caaf3c0abd89e7484d3a0527164815683b351f5aa4a320c75ed57b483f6f3c2f395e7e863bda825da9e5500b6cc69118e273f21ffe2

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
4dbdd24d70ef0ee03f6d9e5277242b35

SHA1
57b81968bebe9e793bc34682b591589e6b616f23

SHA256
c70208a24a53ca126ef0cd4b55c0aac1cb244c6e88155d752b6eeeb82fdfe12a

SHA512
e0877b1b665d2a6822bf5caaf3c0abd89e7484d3a0527164815683b351f5aa4a320c75ed57b483f6f3c2f395e7e863bda825da9e5500b6cc69118e273f21ffe2

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
4dbdd24d70ef0ee03f6d9e5277242b35

SHA1
57b81968bebe9e793bc34682b591589e6b616f23

SHA256
c70208a24a53ca126ef0cd4b55c0aac1cb244c6e88155d752b6eeeb82fdfe12a

SHA512
e0877b1b665d2a6822bf5caaf3c0abd89e7484d3a0527164815683b351f5aa4a320c75ed57b483f6f3c2f395e7e863bda825da9e5500b6cc69118e273f21ffe2

Download Submit
memory/960-54-0x0000000076151000-0x0000000076153000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads