sakula | 1968ea4740b45f99a34703ff6797a8338fb37e38930dc2818ff211793ed76499

General

Target

1968ea4740b45f99a34703ff6797a8338fb37e38930dc2818ff211793ed76499.exe
Size

176KB
MD5

f709326b43405c7eb7f521d9926e9086
SHA1

b257701a4a30e39ac04aaf951c8c5c85404797d1
SHA256

1968ea4740b45f99a34703ff6797a8338fb37e38930dc2818ff211793ed76499
SHA512

04f84d9471335f4dfc249d7e8baf6eceb9a4034fa7efdb270488b29a209bfb98349056cf9230da09742f961ee00d85149e72a6fe28868ee5e9c5170c97eb42d1

Score

10^/10

sakula persistence rat suricata trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula Payload 4 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
behavioral1/memory/792-59-0x0000000000400000-0x0000000000420000-memory.dmp	family_sakula
behavioral1/memory/1592-60-0x0000000000400000-0x0000000000420000-memory.dmp	family_sakula

suricata: ET MALWARE SUSPICIOUS UA (iexplore)
suricata: ET MALWARE SUSPICIOUS UA (iexplore)
suricata
suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1
suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1
suricata
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1592 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1640 cmd.exe
Loads dropped DLL 1 IoCs

Processes:

1968ea4740b45f99a34703ff6797a8338fb37e38930dc2818ff211793ed76499.exe

pid process

792 1968ea4740b45f99a34703ff6797a8338fb37e38930dc2818ff211793ed76499.exe

pid	process
1592	MediaCenter.exe

pid	process
1640	cmd.exe

pid	process
792	1968ea4740b45f99a34703ff6797a8338fb37e38930dc2818ff211793ed76499.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

1968ea4740b45f99a34703ff6797a8338fb37e38930dc2818ff211793ed76499.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	1968ea4740b45f99a34703ff6797a8338fb37e38930dc2818ff211793ed76499.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1212 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

1968ea4740b45f99a34703ff6797a8338fb37e38930dc2818ff211793ed76499.exe

description pid process

Token: SeIncBasePriorityPrivilege 792 1968ea4740b45f99a34703ff6797a8338fb37e38930dc2818ff211793ed76499.exe

pid	process
1212	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	792	1968ea4740b45f99a34703ff6797a8338fb37e38930dc2818ff211793ed76499.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

1968ea4740b45f99a34703ff6797a8338fb37e38930dc2818ff211793ed76499.execmd.exe

description	pid	process	target process
PID 792 wrote to memory of 1592	792	1968ea4740b45f99a34703ff6797a8338fb37e38930dc2818ff211793ed76499.exe	MediaCenter.exe
PID 792 wrote to memory of 1592	792	1968ea4740b45f99a34703ff6797a8338fb37e38930dc2818ff211793ed76499.exe	MediaCenter.exe
PID 792 wrote to memory of 1592	792	1968ea4740b45f99a34703ff6797a8338fb37e38930dc2818ff211793ed76499.exe	MediaCenter.exe
PID 792 wrote to memory of 1592	792	1968ea4740b45f99a34703ff6797a8338fb37e38930dc2818ff211793ed76499.exe	MediaCenter.exe
PID 792 wrote to memory of 1640	792	1968ea4740b45f99a34703ff6797a8338fb37e38930dc2818ff211793ed76499.exe	cmd.exe
PID 792 wrote to memory of 1640	792	1968ea4740b45f99a34703ff6797a8338fb37e38930dc2818ff211793ed76499.exe	cmd.exe
PID 792 wrote to memory of 1640	792	1968ea4740b45f99a34703ff6797a8338fb37e38930dc2818ff211793ed76499.exe	cmd.exe
PID 792 wrote to memory of 1640	792	1968ea4740b45f99a34703ff6797a8338fb37e38930dc2818ff211793ed76499.exe	cmd.exe
PID 1640 wrote to memory of 1212	1640	cmd.exe	PING.EXE
PID 1640 wrote to memory of 1212	1640	cmd.exe	PING.EXE
PID 1640 wrote to memory of 1212	1640	cmd.exe	PING.EXE
PID 1640 wrote to memory of 1212	1640	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\1968ea4740b45f99a34703ff6797a8338fb37e38930dc2818ff211793ed76499.exe
"C:\Users\Admin\AppData\Local\Temp\1968ea4740b45f99a34703ff6797a8338fb37e38930dc2818ff211793ed76499.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:792

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1592

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\1968ea4740b45f99a34703ff6797a8338fb37e38930dc2818ff211793ed76499.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1640

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1212

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
ecd26017965652b3e17621ebecd0d800

SHA1
af209d4360468d56d22dc7cb3936e341a66c3e5f

SHA256
b1ce358f5f61db3456c91f27acad9b523f0f9365dfa29272ec3bc6271bf0467b

SHA512
bb1a871cdcb5815e58e4be901971accc0b89e748a902aea0a0c93328119751dad686e89be0f391d5da5e7fd5b2a1faf0bfb84241c0df2e231cf8aeee4a268e3d

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
ecd26017965652b3e17621ebecd0d800

SHA1
af209d4360468d56d22dc7cb3936e341a66c3e5f

SHA256
b1ce358f5f61db3456c91f27acad9b523f0f9365dfa29272ec3bc6271bf0467b

SHA512
bb1a871cdcb5815e58e4be901971accc0b89e748a902aea0a0c93328119751dad686e89be0f391d5da5e7fd5b2a1faf0bfb84241c0df2e231cf8aeee4a268e3d

Download Submit
memory/792-55-0x0000000075321000-0x0000000075323000-memory.dmp

Filesize
8KB

Download
memory/792-59-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1592-60-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads