sakula | 18f889138a6159af9f83e8754bf8d4da67b0b00c68b3933450bd2361bc0f6152

General

Target

18f889138a6159af9f83e8754bf8d4da67b0b00c68b3933450bd2361bc0f6152.exe
Size

58KB
MD5

7f4ae3be759d7059e79cf6252d1ba703
SHA1

0b5274cb03dc0bc6342c7ee47345652f04625565
SHA256

18f889138a6159af9f83e8754bf8d4da67b0b00c68b3933450bd2361bc0f6152
SHA512

0cf56f2651ecb93af1119efeb6219308f746870b8a0be203fadfefc3f73a55ea5d11442888eb298c86e65d1ffb0987535118754a5c2433e6aac23c0ff260932d

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

944 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

620 cmd.exe

pid	process
944	MediaCenter.exe

pid	process
620	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

18f889138a6159af9f83e8754bf8d4da67b0b00c68b3933450bd2361bc0f6152.exe

pid	process
1704	18f889138a6159af9f83e8754bf8d4da67b0b00c68b3933450bd2361bc0f6152.exe
1704	18f889138a6159af9f83e8754bf8d4da67b0b00c68b3933450bd2361bc0f6152.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

18f889138a6159af9f83e8754bf8d4da67b0b00c68b3933450bd2361bc0f6152.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	18f889138a6159af9f83e8754bf8d4da67b0b00c68b3933450bd2361bc0f6152.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1872 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

18f889138a6159af9f83e8754bf8d4da67b0b00c68b3933450bd2361bc0f6152.exe

description pid process

Token: SeIncBasePriorityPrivilege 1704 18f889138a6159af9f83e8754bf8d4da67b0b00c68b3933450bd2361bc0f6152.exe

pid	process
1872	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1704	18f889138a6159af9f83e8754bf8d4da67b0b00c68b3933450bd2361bc0f6152.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

18f889138a6159af9f83e8754bf8d4da67b0b00c68b3933450bd2361bc0f6152.execmd.exe

description	pid	process	target process
PID 1704 wrote to memory of 944	1704	18f889138a6159af9f83e8754bf8d4da67b0b00c68b3933450bd2361bc0f6152.exe	MediaCenter.exe
PID 1704 wrote to memory of 944	1704	18f889138a6159af9f83e8754bf8d4da67b0b00c68b3933450bd2361bc0f6152.exe	MediaCenter.exe
PID 1704 wrote to memory of 944	1704	18f889138a6159af9f83e8754bf8d4da67b0b00c68b3933450bd2361bc0f6152.exe	MediaCenter.exe
PID 1704 wrote to memory of 944	1704	18f889138a6159af9f83e8754bf8d4da67b0b00c68b3933450bd2361bc0f6152.exe	MediaCenter.exe
PID 1704 wrote to memory of 620	1704	18f889138a6159af9f83e8754bf8d4da67b0b00c68b3933450bd2361bc0f6152.exe	cmd.exe
PID 1704 wrote to memory of 620	1704	18f889138a6159af9f83e8754bf8d4da67b0b00c68b3933450bd2361bc0f6152.exe	cmd.exe
PID 1704 wrote to memory of 620	1704	18f889138a6159af9f83e8754bf8d4da67b0b00c68b3933450bd2361bc0f6152.exe	cmd.exe
PID 1704 wrote to memory of 620	1704	18f889138a6159af9f83e8754bf8d4da67b0b00c68b3933450bd2361bc0f6152.exe	cmd.exe
PID 620 wrote to memory of 1872	620	cmd.exe	PING.EXE
PID 620 wrote to memory of 1872	620	cmd.exe	PING.EXE
PID 620 wrote to memory of 1872	620	cmd.exe	PING.EXE
PID 620 wrote to memory of 1872	620	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\18f889138a6159af9f83e8754bf8d4da67b0b00c68b3933450bd2361bc0f6152.exe
"C:\Users\Admin\AppData\Local\Temp\18f889138a6159af9f83e8754bf8d4da67b0b00c68b3933450bd2361bc0f6152.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1704

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:944

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\18f889138a6159af9f83e8754bf8d4da67b0b00c68b3933450bd2361bc0f6152.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:620

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1872

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
b2b12a46d3f483cdf09ab2ea31b974ab

SHA1
b9e6c4286d43946a8a52cead8422bfaaf5fd63c9

SHA256
78576bdd3f64a7e8cae966240063a0692a3c42deb2adce129b51886d75b6202b

SHA512
1be6f0d711fdbf35d72eed0171f5bc7b7d8405a9e35cd03b6374246e124f626ec210dfa58bd3c0957606f0bbc37e357c439cf6a4a1e0db79f49225f611101da3

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
b2b12a46d3f483cdf09ab2ea31b974ab

SHA1
b9e6c4286d43946a8a52cead8422bfaaf5fd63c9

SHA256
78576bdd3f64a7e8cae966240063a0692a3c42deb2adce129b51886d75b6202b

SHA512
1be6f0d711fdbf35d72eed0171f5bc7b7d8405a9e35cd03b6374246e124f626ec210dfa58bd3c0957606f0bbc37e357c439cf6a4a1e0db79f49225f611101da3

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
b2b12a46d3f483cdf09ab2ea31b974ab

SHA1
b9e6c4286d43946a8a52cead8422bfaaf5fd63c9

SHA256
78576bdd3f64a7e8cae966240063a0692a3c42deb2adce129b51886d75b6202b

SHA512
1be6f0d711fdbf35d72eed0171f5bc7b7d8405a9e35cd03b6374246e124f626ec210dfa58bd3c0957606f0bbc37e357c439cf6a4a1e0db79f49225f611101da3

Download Submit
memory/1704-55-0x0000000075F91000-0x0000000075F93000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads