sakula | 18e66aa01bfe134734e9b436f190db37e693b4d0c05ab1291a7d6de9fa0af4c5

General

Target

18e66aa01bfe134734e9b436f190db37e693b4d0c05ab1291a7d6de9fa0af4c5.exe
Size

58KB
MD5

248ee41d514f93b0e2f1529a3f017f77
SHA1

5b5f8858ed7472fb2050e8042a0d2d67b9938ea6
SHA256

18e66aa01bfe134734e9b436f190db37e693b4d0c05ab1291a7d6de9fa0af4c5
SHA512

b34ec1be0349090e4be6d7324f4d34b639b44d6ae372a8cc7081c48e534200a17efc396d1acadd1d4866e165928c09e094d752bbf280b2736d6d99d5995da8a1

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

828 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1956 cmd.exe

pid	process
828	MediaCenter.exe

pid	process
1956	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

18e66aa01bfe134734e9b436f190db37e693b4d0c05ab1291a7d6de9fa0af4c5.exe

pid	process
1668	18e66aa01bfe134734e9b436f190db37e693b4d0c05ab1291a7d6de9fa0af4c5.exe
1668	18e66aa01bfe134734e9b436f190db37e693b4d0c05ab1291a7d6de9fa0af4c5.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

18e66aa01bfe134734e9b436f190db37e693b4d0c05ab1291a7d6de9fa0af4c5.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	18e66aa01bfe134734e9b436f190db37e693b4d0c05ab1291a7d6de9fa0af4c5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

772 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

18e66aa01bfe134734e9b436f190db37e693b4d0c05ab1291a7d6de9fa0af4c5.exe

description pid process

Token: SeIncBasePriorityPrivilege 1668 18e66aa01bfe134734e9b436f190db37e693b4d0c05ab1291a7d6de9fa0af4c5.exe

pid	process
772	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1668	18e66aa01bfe134734e9b436f190db37e693b4d0c05ab1291a7d6de9fa0af4c5.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

18e66aa01bfe134734e9b436f190db37e693b4d0c05ab1291a7d6de9fa0af4c5.execmd.exe

description	pid	process	target process
PID 1668 wrote to memory of 828	1668	18e66aa01bfe134734e9b436f190db37e693b4d0c05ab1291a7d6de9fa0af4c5.exe	MediaCenter.exe
PID 1668 wrote to memory of 828	1668	18e66aa01bfe134734e9b436f190db37e693b4d0c05ab1291a7d6de9fa0af4c5.exe	MediaCenter.exe
PID 1668 wrote to memory of 828	1668	18e66aa01bfe134734e9b436f190db37e693b4d0c05ab1291a7d6de9fa0af4c5.exe	MediaCenter.exe
PID 1668 wrote to memory of 828	1668	18e66aa01bfe134734e9b436f190db37e693b4d0c05ab1291a7d6de9fa0af4c5.exe	MediaCenter.exe
PID 1668 wrote to memory of 1956	1668	18e66aa01bfe134734e9b436f190db37e693b4d0c05ab1291a7d6de9fa0af4c5.exe	cmd.exe
PID 1668 wrote to memory of 1956	1668	18e66aa01bfe134734e9b436f190db37e693b4d0c05ab1291a7d6de9fa0af4c5.exe	cmd.exe
PID 1668 wrote to memory of 1956	1668	18e66aa01bfe134734e9b436f190db37e693b4d0c05ab1291a7d6de9fa0af4c5.exe	cmd.exe
PID 1668 wrote to memory of 1956	1668	18e66aa01bfe134734e9b436f190db37e693b4d0c05ab1291a7d6de9fa0af4c5.exe	cmd.exe
PID 1956 wrote to memory of 772	1956	cmd.exe	PING.EXE
PID 1956 wrote to memory of 772	1956	cmd.exe	PING.EXE
PID 1956 wrote to memory of 772	1956	cmd.exe	PING.EXE
PID 1956 wrote to memory of 772	1956	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\18e66aa01bfe134734e9b436f190db37e693b4d0c05ab1291a7d6de9fa0af4c5.exe
"C:\Users\Admin\AppData\Local\Temp\18e66aa01bfe134734e9b436f190db37e693b4d0c05ab1291a7d6de9fa0af4c5.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1668

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:828

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\18e66aa01bfe134734e9b436f190db37e693b4d0c05ab1291a7d6de9fa0af4c5.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1956

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:772

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
0e00fb98ceb169e008837ae9933dc769

SHA1
a4627291e95a8741abb74769c9b60dc668ccd9df

SHA256
a0c23e1a57b6b22e7bff3e44cae9c76ce8a17730331c8bcdf466aac1cefb79c5

SHA512
72e3b4c6b592f401a386b0aa7037050b934abddac8db6725de9ad2c6e7dbbf62b8e694f4b7e6709b0d129bb52d2e92ec8a1a1ee71df275c61cda46853cfdb129

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
0e00fb98ceb169e008837ae9933dc769

SHA1
a4627291e95a8741abb74769c9b60dc668ccd9df

SHA256
a0c23e1a57b6b22e7bff3e44cae9c76ce8a17730331c8bcdf466aac1cefb79c5

SHA512
72e3b4c6b592f401a386b0aa7037050b934abddac8db6725de9ad2c6e7dbbf62b8e694f4b7e6709b0d129bb52d2e92ec8a1a1ee71df275c61cda46853cfdb129

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
0e00fb98ceb169e008837ae9933dc769

SHA1
a4627291e95a8741abb74769c9b60dc668ccd9df

SHA256
a0c23e1a57b6b22e7bff3e44cae9c76ce8a17730331c8bcdf466aac1cefb79c5

SHA512
72e3b4c6b592f401a386b0aa7037050b934abddac8db6725de9ad2c6e7dbbf62b8e694f4b7e6709b0d129bb52d2e92ec8a1a1ee71df275c61cda46853cfdb129

Download Submit
memory/1668-55-0x0000000076641000-0x0000000076643000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads