sakula | 17c7f39a9ba873ac02d2a2dfeb1e8e05dceb416af19b806d0853ce9c2c879d4f

General

Target

17c7f39a9ba873ac02d2a2dfeb1e8e05dceb416af19b806d0853ce9c2c879d4f.exe
Size

168KB
MD5

124f80ca5c6591aca8e81bce1f87f53d
SHA1

251b647b1d170880d032dde51ecde2f4a46277e1
SHA256

17c7f39a9ba873ac02d2a2dfeb1e8e05dceb416af19b806d0853ce9c2c879d4f
SHA512

b7c18bfb5b87bb0bca45c10dfdbbd5da75c63e292d1a71bf53fd852d7cae649bfe8ed7d4e36e5359c97f076ac934f2f5da4991f2bd7c0ea41b5fd73e7c82f5d2

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula Payload 4 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
behavioral1/memory/1528-57-0x0000000000400000-0x0000000000420000-memory.dmp	family_sakula
behavioral1/memory/1532-58-0x0000000000400000-0x0000000000420000-memory.dmp	family_sakula

Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1532 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1816 cmd.exe
Loads dropped DLL 1 IoCs

Processes:

17c7f39a9ba873ac02d2a2dfeb1e8e05dceb416af19b806d0853ce9c2c879d4f.exe

pid process

1528 17c7f39a9ba873ac02d2a2dfeb1e8e05dceb416af19b806d0853ce9c2c879d4f.exe

pid	process
1532	MediaCenter.exe

pid	process
1816	cmd.exe

pid	process
1528	17c7f39a9ba873ac02d2a2dfeb1e8e05dceb416af19b806d0853ce9c2c879d4f.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

17c7f39a9ba873ac02d2a2dfeb1e8e05dceb416af19b806d0853ce9c2c879d4f.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	17c7f39a9ba873ac02d2a2dfeb1e8e05dceb416af19b806d0853ce9c2c879d4f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

436 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

17c7f39a9ba873ac02d2a2dfeb1e8e05dceb416af19b806d0853ce9c2c879d4f.exe

description pid process

Token: SeIncBasePriorityPrivilege 1528 17c7f39a9ba873ac02d2a2dfeb1e8e05dceb416af19b806d0853ce9c2c879d4f.exe

pid	process
436	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1528	17c7f39a9ba873ac02d2a2dfeb1e8e05dceb416af19b806d0853ce9c2c879d4f.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

17c7f39a9ba873ac02d2a2dfeb1e8e05dceb416af19b806d0853ce9c2c879d4f.execmd.exe

description	pid	process	target process
PID 1528 wrote to memory of 1532	1528	17c7f39a9ba873ac02d2a2dfeb1e8e05dceb416af19b806d0853ce9c2c879d4f.exe	MediaCenter.exe
PID 1528 wrote to memory of 1532	1528	17c7f39a9ba873ac02d2a2dfeb1e8e05dceb416af19b806d0853ce9c2c879d4f.exe	MediaCenter.exe
PID 1528 wrote to memory of 1532	1528	17c7f39a9ba873ac02d2a2dfeb1e8e05dceb416af19b806d0853ce9c2c879d4f.exe	MediaCenter.exe
PID 1528 wrote to memory of 1532	1528	17c7f39a9ba873ac02d2a2dfeb1e8e05dceb416af19b806d0853ce9c2c879d4f.exe	MediaCenter.exe
PID 1528 wrote to memory of 1816	1528	17c7f39a9ba873ac02d2a2dfeb1e8e05dceb416af19b806d0853ce9c2c879d4f.exe	cmd.exe
PID 1528 wrote to memory of 1816	1528	17c7f39a9ba873ac02d2a2dfeb1e8e05dceb416af19b806d0853ce9c2c879d4f.exe	cmd.exe
PID 1528 wrote to memory of 1816	1528	17c7f39a9ba873ac02d2a2dfeb1e8e05dceb416af19b806d0853ce9c2c879d4f.exe	cmd.exe
PID 1528 wrote to memory of 1816	1528	17c7f39a9ba873ac02d2a2dfeb1e8e05dceb416af19b806d0853ce9c2c879d4f.exe	cmd.exe
PID 1816 wrote to memory of 436	1816	cmd.exe	PING.EXE
PID 1816 wrote to memory of 436	1816	cmd.exe	PING.EXE
PID 1816 wrote to memory of 436	1816	cmd.exe	PING.EXE
PID 1816 wrote to memory of 436	1816	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\17c7f39a9ba873ac02d2a2dfeb1e8e05dceb416af19b806d0853ce9c2c879d4f.exe
"C:\Users\Admin\AppData\Local\Temp\17c7f39a9ba873ac02d2a2dfeb1e8e05dceb416af19b806d0853ce9c2c879d4f.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1528

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1532

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\17c7f39a9ba873ac02d2a2dfeb1e8e05dceb416af19b806d0853ce9c2c879d4f.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1816

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:436

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
3adbe2d655e1c784c980187c68f287d0

SHA1
0c8a3f8b1431dc0a5bd5d391ca8c6c6543b5362f

SHA256
7482e0ac9e4f28d1dcc5439f4908cf2cb0847234ae543faebf085a5971c022be

SHA512
7357bfbfa630fa38319b2fb70d286f6eed2e95e842f84ef43aac2abd51c0fe0c44b71307b62f93e3662e3aba92f765197aead6d0bdfb5d389e5e3993c223e92c

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
3adbe2d655e1c784c980187c68f287d0

SHA1
0c8a3f8b1431dc0a5bd5d391ca8c6c6543b5362f

SHA256
7482e0ac9e4f28d1dcc5439f4908cf2cb0847234ae543faebf085a5971c022be

SHA512
7357bfbfa630fa38319b2fb70d286f6eed2e95e842f84ef43aac2abd51c0fe0c44b71307b62f93e3662e3aba92f765197aead6d0bdfb5d389e5e3993c223e92c

Download Submit
memory/1528-53-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download
memory/1528-57-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1532-58-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads