sakula | 190b0ee88e4f242de9bb1702809a17954a7b2195c4c8157e169acbd7ab32eab1

General

Target

190b0ee88e4f242de9bb1702809a17954a7b2195c4c8157e169acbd7ab32eab1.exe
Size

36KB
MD5

fda028804ee89f5ada1bd4cb33d242c6
SHA1

dc04f95be741ce51e16523fe0733426871f53279
SHA256

190b0ee88e4f242de9bb1702809a17954a7b2195c4c8157e169acbd7ab32eab1
SHA512

6a2fb247164c81a0ecc1cefab03ff88f8054039b354b7cfdb95fdd60861655f73c3081394280da29d66e7101ebfeb942b4d45dab1b8e88583d17a96a85f3e312

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1656 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

784 cmd.exe

pid	process
1656	MediaCenter.exe

pid	process
784	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

190b0ee88e4f242de9bb1702809a17954a7b2195c4c8157e169acbd7ab32eab1.exe

pid	process
1188	190b0ee88e4f242de9bb1702809a17954a7b2195c4c8157e169acbd7ab32eab1.exe
1188	190b0ee88e4f242de9bb1702809a17954a7b2195c4c8157e169acbd7ab32eab1.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

190b0ee88e4f242de9bb1702809a17954a7b2195c4c8157e169acbd7ab32eab1.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	190b0ee88e4f242de9bb1702809a17954a7b2195c4c8157e169acbd7ab32eab1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1956 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

190b0ee88e4f242de9bb1702809a17954a7b2195c4c8157e169acbd7ab32eab1.exe

description pid process

Token: SeIncBasePriorityPrivilege 1188 190b0ee88e4f242de9bb1702809a17954a7b2195c4c8157e169acbd7ab32eab1.exe

pid	process
1956	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1188	190b0ee88e4f242de9bb1702809a17954a7b2195c4c8157e169acbd7ab32eab1.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

190b0ee88e4f242de9bb1702809a17954a7b2195c4c8157e169acbd7ab32eab1.execmd.exe

description	pid	process	target process
PID 1188 wrote to memory of 1656	1188	190b0ee88e4f242de9bb1702809a17954a7b2195c4c8157e169acbd7ab32eab1.exe	MediaCenter.exe
PID 1188 wrote to memory of 1656	1188	190b0ee88e4f242de9bb1702809a17954a7b2195c4c8157e169acbd7ab32eab1.exe	MediaCenter.exe
PID 1188 wrote to memory of 1656	1188	190b0ee88e4f242de9bb1702809a17954a7b2195c4c8157e169acbd7ab32eab1.exe	MediaCenter.exe
PID 1188 wrote to memory of 1656	1188	190b0ee88e4f242de9bb1702809a17954a7b2195c4c8157e169acbd7ab32eab1.exe	MediaCenter.exe
PID 1188 wrote to memory of 784	1188	190b0ee88e4f242de9bb1702809a17954a7b2195c4c8157e169acbd7ab32eab1.exe	cmd.exe
PID 1188 wrote to memory of 784	1188	190b0ee88e4f242de9bb1702809a17954a7b2195c4c8157e169acbd7ab32eab1.exe	cmd.exe
PID 1188 wrote to memory of 784	1188	190b0ee88e4f242de9bb1702809a17954a7b2195c4c8157e169acbd7ab32eab1.exe	cmd.exe
PID 1188 wrote to memory of 784	1188	190b0ee88e4f242de9bb1702809a17954a7b2195c4c8157e169acbd7ab32eab1.exe	cmd.exe
PID 784 wrote to memory of 1956	784	cmd.exe	PING.EXE
PID 784 wrote to memory of 1956	784	cmd.exe	PING.EXE
PID 784 wrote to memory of 1956	784	cmd.exe	PING.EXE
PID 784 wrote to memory of 1956	784	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\190b0ee88e4f242de9bb1702809a17954a7b2195c4c8157e169acbd7ab32eab1.exe
"C:\Users\Admin\AppData\Local\Temp\190b0ee88e4f242de9bb1702809a17954a7b2195c4c8157e169acbd7ab32eab1.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1188

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1656

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\190b0ee88e4f242de9bb1702809a17954a7b2195c4c8157e169acbd7ab32eab1.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:784

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1956

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
11bf2c10b02347d4080cc7f3f8b506c2

SHA1
e59b400de2998ecdc84ca0f365a166d2c9292e2b

SHA256
f02d9628525205dd3fb11158f411b2e4f88e22bc549263628b8f658e391346bc

SHA512
9debf7a8dba1d523403d95307ab727f05ec05c5d6a344a3c4c4e0c87e2bcd0ce61e681ca173acd0cb410a581053305f4cce1e9a5da8139de5465736303f0d092

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
11bf2c10b02347d4080cc7f3f8b506c2

SHA1
e59b400de2998ecdc84ca0f365a166d2c9292e2b

SHA256
f02d9628525205dd3fb11158f411b2e4f88e22bc549263628b8f658e391346bc

SHA512
9debf7a8dba1d523403d95307ab727f05ec05c5d6a344a3c4c4e0c87e2bcd0ce61e681ca173acd0cb410a581053305f4cce1e9a5da8139de5465736303f0d092

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
11bf2c10b02347d4080cc7f3f8b506c2

SHA1
e59b400de2998ecdc84ca0f365a166d2c9292e2b

SHA256
f02d9628525205dd3fb11158f411b2e4f88e22bc549263628b8f658e391346bc

SHA512
9debf7a8dba1d523403d95307ab727f05ec05c5d6a344a3c4c4e0c87e2bcd0ce61e681ca173acd0cb410a581053305f4cce1e9a5da8139de5465736303f0d092

Download Submit
memory/1188-55-0x0000000074EC1000-0x0000000074EC3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads