sakula | 18e723d7990c3e4db6e8376064f7bff494754ace03f104c58a0ca18f83ac252d

General

Target

18e723d7990c3e4db6e8376064f7bff494754ace03f104c58a0ca18f83ac252d.exe
Size

58KB
MD5

fd9dc5b8fa418f96c34d31639851ed29
SHA1

1375a117559a9e6c8db10555f77c43f0501d8837
SHA256

18e723d7990c3e4db6e8376064f7bff494754ace03f104c58a0ca18f83ac252d
SHA512

834331b80daaa3fea4a66eade9c020d754a1923cc8c8164422c44d7a77302a295b52dcd931ba19f76f9e73f92358e4c4f1f293e489bb8fd700f7f0db091142df

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1740 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1792 cmd.exe

pid	process
1740	MediaCenter.exe

pid	process
1792	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

18e723d7990c3e4db6e8376064f7bff494754ace03f104c58a0ca18f83ac252d.exe

pid	process
1652	18e723d7990c3e4db6e8376064f7bff494754ace03f104c58a0ca18f83ac252d.exe
1652	18e723d7990c3e4db6e8376064f7bff494754ace03f104c58a0ca18f83ac252d.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

18e723d7990c3e4db6e8376064f7bff494754ace03f104c58a0ca18f83ac252d.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	18e723d7990c3e4db6e8376064f7bff494754ace03f104c58a0ca18f83ac252d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

920 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

18e723d7990c3e4db6e8376064f7bff494754ace03f104c58a0ca18f83ac252d.exe

description pid process

Token: SeIncBasePriorityPrivilege 1652 18e723d7990c3e4db6e8376064f7bff494754ace03f104c58a0ca18f83ac252d.exe

pid	process
920	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1652	18e723d7990c3e4db6e8376064f7bff494754ace03f104c58a0ca18f83ac252d.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

18e723d7990c3e4db6e8376064f7bff494754ace03f104c58a0ca18f83ac252d.execmd.exe

description	pid	process	target process
PID 1652 wrote to memory of 1740	1652	18e723d7990c3e4db6e8376064f7bff494754ace03f104c58a0ca18f83ac252d.exe	MediaCenter.exe
PID 1652 wrote to memory of 1740	1652	18e723d7990c3e4db6e8376064f7bff494754ace03f104c58a0ca18f83ac252d.exe	MediaCenter.exe
PID 1652 wrote to memory of 1740	1652	18e723d7990c3e4db6e8376064f7bff494754ace03f104c58a0ca18f83ac252d.exe	MediaCenter.exe
PID 1652 wrote to memory of 1740	1652	18e723d7990c3e4db6e8376064f7bff494754ace03f104c58a0ca18f83ac252d.exe	MediaCenter.exe
PID 1652 wrote to memory of 1792	1652	18e723d7990c3e4db6e8376064f7bff494754ace03f104c58a0ca18f83ac252d.exe	cmd.exe
PID 1652 wrote to memory of 1792	1652	18e723d7990c3e4db6e8376064f7bff494754ace03f104c58a0ca18f83ac252d.exe	cmd.exe
PID 1652 wrote to memory of 1792	1652	18e723d7990c3e4db6e8376064f7bff494754ace03f104c58a0ca18f83ac252d.exe	cmd.exe
PID 1652 wrote to memory of 1792	1652	18e723d7990c3e4db6e8376064f7bff494754ace03f104c58a0ca18f83ac252d.exe	cmd.exe
PID 1792 wrote to memory of 920	1792	cmd.exe	PING.EXE
PID 1792 wrote to memory of 920	1792	cmd.exe	PING.EXE
PID 1792 wrote to memory of 920	1792	cmd.exe	PING.EXE
PID 1792 wrote to memory of 920	1792	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\18e723d7990c3e4db6e8376064f7bff494754ace03f104c58a0ca18f83ac252d.exe
"C:\Users\Admin\AppData\Local\Temp\18e723d7990c3e4db6e8376064f7bff494754ace03f104c58a0ca18f83ac252d.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1652

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1740

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\18e723d7990c3e4db6e8376064f7bff494754ace03f104c58a0ca18f83ac252d.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1792

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:920

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
bf3a752f0fc65a1b720221760ec0746a

SHA1
04800ebf6e7e8b8a2d0c5abc515a01a38fbe160b

SHA256
25a183fee733ad148172703289c9f1f8cb81e5877f5498823751d674ed8edde2

SHA512
c818a2bc4a0f600394285b82b5c45629fe7324a97b11c3a18158118c7836fb574ac8b316cdbba4012cb898a6fb300865528144c80cff1aa03599775e5e63012d

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
bf3a752f0fc65a1b720221760ec0746a

SHA1
04800ebf6e7e8b8a2d0c5abc515a01a38fbe160b

SHA256
25a183fee733ad148172703289c9f1f8cb81e5877f5498823751d674ed8edde2

SHA512
c818a2bc4a0f600394285b82b5c45629fe7324a97b11c3a18158118c7836fb574ac8b316cdbba4012cb898a6fb300865528144c80cff1aa03599775e5e63012d

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
bf3a752f0fc65a1b720221760ec0746a

SHA1
04800ebf6e7e8b8a2d0c5abc515a01a38fbe160b

SHA256
25a183fee733ad148172703289c9f1f8cb81e5877f5498823751d674ed8edde2

SHA512
c818a2bc4a0f600394285b82b5c45629fe7324a97b11c3a18158118c7836fb574ac8b316cdbba4012cb898a6fb300865528144c80cff1aa03599775e5e63012d

Download Submit
memory/1652-55-0x0000000074EC1000-0x0000000074EC3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads