sakula | 18efc4c294b7fdaac217fd737d88f5f147d27485ddc0e1329d991aa582402e79

General

Target

18efc4c294b7fdaac217fd737d88f5f147d27485ddc0e1329d991aa582402e79.exe
Size

104KB
MD5

84d33da1d936581fdcbb25f44b236e4d
SHA1

cccaa62c4696fc89d00ab5ee90770d3cac553f70
SHA256

18efc4c294b7fdaac217fd737d88f5f147d27485ddc0e1329d991aa582402e79
SHA512

490bd175614faab2b5a5864fe4928824d4e5e94f23fc62497f2dbf11eb0eb6db3bd37335f923a2edee8e7c10226a4fe63913bea28a8ae9126fe55eefff74ab2c

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula Payload 3 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula

Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1564 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

588 cmd.exe

pid	process
1564	MediaCenter.exe

pid	process
588	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

18efc4c294b7fdaac217fd737d88f5f147d27485ddc0e1329d991aa582402e79.exe

pid	process
972	18efc4c294b7fdaac217fd737d88f5f147d27485ddc0e1329d991aa582402e79.exe
972	18efc4c294b7fdaac217fd737d88f5f147d27485ddc0e1329d991aa582402e79.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

18efc4c294b7fdaac217fd737d88f5f147d27485ddc0e1329d991aa582402e79.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	18efc4c294b7fdaac217fd737d88f5f147d27485ddc0e1329d991aa582402e79.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1164 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

18efc4c294b7fdaac217fd737d88f5f147d27485ddc0e1329d991aa582402e79.exe

description pid process

Token: SeIncBasePriorityPrivilege 972 18efc4c294b7fdaac217fd737d88f5f147d27485ddc0e1329d991aa582402e79.exe

pid	process
1164	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	972	18efc4c294b7fdaac217fd737d88f5f147d27485ddc0e1329d991aa582402e79.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

18efc4c294b7fdaac217fd737d88f5f147d27485ddc0e1329d991aa582402e79.execmd.exe

description	pid	process	target process
PID 972 wrote to memory of 1564	972	18efc4c294b7fdaac217fd737d88f5f147d27485ddc0e1329d991aa582402e79.exe	MediaCenter.exe
PID 972 wrote to memory of 1564	972	18efc4c294b7fdaac217fd737d88f5f147d27485ddc0e1329d991aa582402e79.exe	MediaCenter.exe
PID 972 wrote to memory of 1564	972	18efc4c294b7fdaac217fd737d88f5f147d27485ddc0e1329d991aa582402e79.exe	MediaCenter.exe
PID 972 wrote to memory of 1564	972	18efc4c294b7fdaac217fd737d88f5f147d27485ddc0e1329d991aa582402e79.exe	MediaCenter.exe
PID 972 wrote to memory of 588	972	18efc4c294b7fdaac217fd737d88f5f147d27485ddc0e1329d991aa582402e79.exe	cmd.exe
PID 972 wrote to memory of 588	972	18efc4c294b7fdaac217fd737d88f5f147d27485ddc0e1329d991aa582402e79.exe	cmd.exe
PID 972 wrote to memory of 588	972	18efc4c294b7fdaac217fd737d88f5f147d27485ddc0e1329d991aa582402e79.exe	cmd.exe
PID 972 wrote to memory of 588	972	18efc4c294b7fdaac217fd737d88f5f147d27485ddc0e1329d991aa582402e79.exe	cmd.exe
PID 588 wrote to memory of 1164	588	cmd.exe	PING.EXE
PID 588 wrote to memory of 1164	588	cmd.exe	PING.EXE
PID 588 wrote to memory of 1164	588	cmd.exe	PING.EXE
PID 588 wrote to memory of 1164	588	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\18efc4c294b7fdaac217fd737d88f5f147d27485ddc0e1329d991aa582402e79.exe
"C:\Users\Admin\AppData\Local\Temp\18efc4c294b7fdaac217fd737d88f5f147d27485ddc0e1329d991aa582402e79.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:972

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1564

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\18efc4c294b7fdaac217fd737d88f5f147d27485ddc0e1329d991aa582402e79.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:588

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1164

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
39dfef91a2c740fe881cf53016fd2075

SHA1
f0a56817decf970435d6f5c57449863d710d3503

SHA256
f0c44d595775ee057a9f1716d1d68f7fa2153bf7b320f907a0a5bb1096519d6e

SHA512
1697ffbe3e7f377b3899f046613b58054796d506a117873f3d30ea1debe24d8e1beb3757a66a36bc3db9fa2a69ad100f9a89083079a9ad55fd60fade3b9c2fbb

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
39dfef91a2c740fe881cf53016fd2075

SHA1
f0a56817decf970435d6f5c57449863d710d3503

SHA256
f0c44d595775ee057a9f1716d1d68f7fa2153bf7b320f907a0a5bb1096519d6e

SHA512
1697ffbe3e7f377b3899f046613b58054796d506a117873f3d30ea1debe24d8e1beb3757a66a36bc3db9fa2a69ad100f9a89083079a9ad55fd60fade3b9c2fbb

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
39dfef91a2c740fe881cf53016fd2075

SHA1
f0a56817decf970435d6f5c57449863d710d3503

SHA256
f0c44d595775ee057a9f1716d1d68f7fa2153bf7b320f907a0a5bb1096519d6e

SHA512
1697ffbe3e7f377b3899f046613b58054796d506a117873f3d30ea1debe24d8e1beb3757a66a36bc3db9fa2a69ad100f9a89083079a9ad55fd60fade3b9c2fbb

Download Submit
memory/972-55-0x00000000756C1000-0x00000000756C3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads