sakula | 17994630908c7d6f550101f1cb87ac86f609854682e703b6d9a84bc1222461b5

General

Target

17994630908c7d6f550101f1cb87ac86f609854682e703b6d9a84bc1222461b5.exe
Size

99KB
MD5

f06d59b5952d1dcb4c58bc81c226f8f5
SHA1

e83242a3f03696e86bde70ca9ac6a027bce0fb58
SHA256

17994630908c7d6f550101f1cb87ac86f609854682e703b6d9a84bc1222461b5
SHA512

1a1917f04dfb1915752a87074e946a3105d14bc5a9095ef173aa6d6be5709bfe6271a4c42d66bd53713a2b7dd913512c40dc2a5e985afc9a86d0daf2d35cb76c

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula Payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula

Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

2716 MediaCenter.exe

pid	process
2716	MediaCenter.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

17994630908c7d6f550101f1cb87ac86f609854682e703b6d9a84bc1222461b5.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	17994630908c7d6f550101f1cb87ac86f609854682e703b6d9a84bc1222461b5.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

17994630908c7d6f550101f1cb87ac86f609854682e703b6d9a84bc1222461b5.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	17994630908c7d6f550101f1cb87ac86f609854682e703b6d9a84bc1222461b5.exe

Drops file in Windows directory 8 IoCs

Processes:

TiWorker.exesvchost.exe

description	ioc	process
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TiWorker.exe
File opened for modification	C:\Windows\WinSxS\pending.xml	TiWorker.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2540 PING.EXE

pid	process
2540	PING.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

svchost.exeTiWorker.exe

description	pid	process
Token: SeShutdownPrivilege	2720	svchost.exe
Token: SeCreatePagefilePrivilege	2720	svchost.exe
Token: SeShutdownPrivilege	2720	svchost.exe
Token: SeCreatePagefilePrivilege	2720	svchost.exe
Token: SeShutdownPrivilege	2720	svchost.exe
Token: SeCreatePagefilePrivilege	2720	svchost.exe
Token: SeSecurityPrivilege	4848	TiWorker.exe
Token: SeRestorePrivilege	4848	TiWorker.exe
Token: SeBackupPrivilege	4848	TiWorker.exe
Token: SeBackupPrivilege	4848	TiWorker.exe
Token: SeRestorePrivilege	4848	TiWorker.exe
Token: SeSecurityPrivilege	4848	TiWorker.exe
Token: SeBackupPrivilege	4848	TiWorker.exe
Token: SeRestorePrivilege	4848	TiWorker.exe
Token: SeSecurityPrivilege	4848	TiWorker.exe
Token: SeBackupPrivilege	4848	TiWorker.exe
Token: SeRestorePrivilege	4848	TiWorker.exe
Token: SeSecurityPrivilege	4848	TiWorker.exe
Token: SeBackupPrivilege	4848	TiWorker.exe
Token: SeRestorePrivilege	4848	TiWorker.exe
Token: SeSecurityPrivilege	4848	TiWorker.exe
Token: SeBackupPrivilege	4848	TiWorker.exe
Token: SeRestorePrivilege	4848	TiWorker.exe
Token: SeSecurityPrivilege	4848	TiWorker.exe
Token: SeBackupPrivilege	4848	TiWorker.exe
Token: SeRestorePrivilege	4848	TiWorker.exe
Token: SeSecurityPrivilege	4848	TiWorker.exe
Token: SeBackupPrivilege	4848	TiWorker.exe
Token: SeRestorePrivilege	4848	TiWorker.exe
Token: SeSecurityPrivilege	4848	TiWorker.exe
Token: SeBackupPrivilege	4848	TiWorker.exe
Token: SeRestorePrivilege	4848	TiWorker.exe
Token: SeSecurityPrivilege	4848	TiWorker.exe
Token: SeBackupPrivilege	4848	TiWorker.exe
Token: SeRestorePrivilege	4848	TiWorker.exe
Token: SeSecurityPrivilege	4848	TiWorker.exe
Token: SeBackupPrivilege	4848	TiWorker.exe
Token: SeRestorePrivilege	4848	TiWorker.exe
Token: SeSecurityPrivilege	4848	TiWorker.exe
Token: SeBackupPrivilege	4848	TiWorker.exe
Token: SeRestorePrivilege	4848	TiWorker.exe
Token: SeSecurityPrivilege	4848	TiWorker.exe
Token: SeBackupPrivilege	4848	TiWorker.exe
Token: SeRestorePrivilege	4848	TiWorker.exe
Token: SeSecurityPrivilege	4848	TiWorker.exe
Token: SeBackupPrivilege	4848	TiWorker.exe
Token: SeRestorePrivilege	4848	TiWorker.exe
Token: SeSecurityPrivilege	4848	TiWorker.exe
Token: SeBackupPrivilege	4848	TiWorker.exe
Token: SeRestorePrivilege	4848	TiWorker.exe
Token: SeSecurityPrivilege	4848	TiWorker.exe
Token: SeBackupPrivilege	4848	TiWorker.exe
Token: SeRestorePrivilege	4848	TiWorker.exe
Token: SeSecurityPrivilege	4848	TiWorker.exe
Token: SeBackupPrivilege	4848	TiWorker.exe
Token: SeRestorePrivilege	4848	TiWorker.exe
Token: SeSecurityPrivilege	4848	TiWorker.exe
Token: SeBackupPrivilege	4848	TiWorker.exe
Token: SeRestorePrivilege	4848	TiWorker.exe
Token: SeSecurityPrivilege	4848	TiWorker.exe
Token: SeBackupPrivilege	4848	TiWorker.exe
Token: SeRestorePrivilege	4848	TiWorker.exe
Token: SeSecurityPrivilege	4848	TiWorker.exe
Token: SeBackupPrivilege	4848	TiWorker.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

17994630908c7d6f550101f1cb87ac86f609854682e703b6d9a84bc1222461b5.execmd.exe

description	pid	process	target process
PID 4532 wrote to memory of 2716	4532	17994630908c7d6f550101f1cb87ac86f609854682e703b6d9a84bc1222461b5.exe	MediaCenter.exe
PID 4532 wrote to memory of 2716	4532	17994630908c7d6f550101f1cb87ac86f609854682e703b6d9a84bc1222461b5.exe	MediaCenter.exe
PID 4532 wrote to memory of 2716	4532	17994630908c7d6f550101f1cb87ac86f609854682e703b6d9a84bc1222461b5.exe	MediaCenter.exe
PID 4532 wrote to memory of 4836	4532	17994630908c7d6f550101f1cb87ac86f609854682e703b6d9a84bc1222461b5.exe	cmd.exe
PID 4532 wrote to memory of 4836	4532	17994630908c7d6f550101f1cb87ac86f609854682e703b6d9a84bc1222461b5.exe	cmd.exe
PID 4532 wrote to memory of 4836	4532	17994630908c7d6f550101f1cb87ac86f609854682e703b6d9a84bc1222461b5.exe	cmd.exe
PID 4836 wrote to memory of 2540	4836	cmd.exe	PING.EXE
PID 4836 wrote to memory of 2540	4836	cmd.exe	PING.EXE
PID 4836 wrote to memory of 2540	4836	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\17994630908c7d6f550101f1cb87ac86f609854682e703b6d9a84bc1222461b5.exe
"C:\Users\Admin\AppData\Local\Temp\17994630908c7d6f550101f1cb87ac86f609854682e703b6d9a84bc1222461b5.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4532

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:2716

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\17994630908c7d6f550101f1cb87ac86f609854682e703b6d9a84bc1222461b5.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:4836

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:2540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2720

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4848

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
775d9d6cb536f4585052a1381d6d3004

SHA1
d94b3199e3dafb933c0b54e64b8cf55eb5c406e7

SHA256
c1753323c6c31436dc30e01d0deeac13f975f3a3ee647d8f96add0a09c49a4c5

SHA512
a27e12516b930ff4e7d8528daeda65882910d0c55e5e3f097d2e0120e7a1f6b0dddb4a2286e2c9033cbb02cbef179454d45b82344312d69d4fcd856d748eaf10

Download Submit
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
775d9d6cb536f4585052a1381d6d3004

SHA1
d94b3199e3dafb933c0b54e64b8cf55eb5c406e7

SHA256
c1753323c6c31436dc30e01d0deeac13f975f3a3ee647d8f96add0a09c49a4c5

SHA512
a27e12516b930ff4e7d8528daeda65882910d0c55e5e3f097d2e0120e7a1f6b0dddb4a2286e2c9033cbb02cbef179454d45b82344312d69d4fcd856d748eaf10

Download Submit
memory/2720-132-0x0000020596560000-0x0000020596570000-memory.dmp

Filesize
64KB

Download
memory/2720-133-0x0000020596B20000-0x0000020596B30000-memory.dmp

Filesize
64KB

Download
memory/2720-134-0x0000020599190000-0x0000020599194000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads