sakula | 179b405ee8bd2e5662d36849a487032504076a3182c172c248a6182b22466a10

General

Target

179b405ee8bd2e5662d36849a487032504076a3182c172c248a6182b22466a10.exe
Size

60KB
MD5

9cf9fd4ffe33957a4badaeb32849208b
SHA1

aac97844d45bd12cb0aa332d52d36ad727ba265c
SHA256

179b405ee8bd2e5662d36849a487032504076a3182c172c248a6182b22466a10
SHA512

06e20bbce844e1705ed952da7d56569b40ad59c22e6d428fb93e13d0b83059e9adc12e7e5b671754b640a8d60b15d0adba6aee0ccce279f436a129f0ed8c45c8

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1600 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1976 cmd.exe

pid	process
1600	MediaCenter.exe

pid	process
1976	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

179b405ee8bd2e5662d36849a487032504076a3182c172c248a6182b22466a10.exe

pid	process
964	179b405ee8bd2e5662d36849a487032504076a3182c172c248a6182b22466a10.exe
964	179b405ee8bd2e5662d36849a487032504076a3182c172c248a6182b22466a10.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

179b405ee8bd2e5662d36849a487032504076a3182c172c248a6182b22466a10.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	179b405ee8bd2e5662d36849a487032504076a3182c172c248a6182b22466a10.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1132 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

179b405ee8bd2e5662d36849a487032504076a3182c172c248a6182b22466a10.exe

description pid process

Token: SeIncBasePriorityPrivilege 964 179b405ee8bd2e5662d36849a487032504076a3182c172c248a6182b22466a10.exe

pid	process
1132	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	964	179b405ee8bd2e5662d36849a487032504076a3182c172c248a6182b22466a10.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

179b405ee8bd2e5662d36849a487032504076a3182c172c248a6182b22466a10.execmd.exe

description	pid	process	target process
PID 964 wrote to memory of 1600	964	179b405ee8bd2e5662d36849a487032504076a3182c172c248a6182b22466a10.exe	MediaCenter.exe
PID 964 wrote to memory of 1600	964	179b405ee8bd2e5662d36849a487032504076a3182c172c248a6182b22466a10.exe	MediaCenter.exe
PID 964 wrote to memory of 1600	964	179b405ee8bd2e5662d36849a487032504076a3182c172c248a6182b22466a10.exe	MediaCenter.exe
PID 964 wrote to memory of 1600	964	179b405ee8bd2e5662d36849a487032504076a3182c172c248a6182b22466a10.exe	MediaCenter.exe
PID 964 wrote to memory of 1976	964	179b405ee8bd2e5662d36849a487032504076a3182c172c248a6182b22466a10.exe	cmd.exe
PID 964 wrote to memory of 1976	964	179b405ee8bd2e5662d36849a487032504076a3182c172c248a6182b22466a10.exe	cmd.exe
PID 964 wrote to memory of 1976	964	179b405ee8bd2e5662d36849a487032504076a3182c172c248a6182b22466a10.exe	cmd.exe
PID 964 wrote to memory of 1976	964	179b405ee8bd2e5662d36849a487032504076a3182c172c248a6182b22466a10.exe	cmd.exe
PID 1976 wrote to memory of 1132	1976	cmd.exe	PING.EXE
PID 1976 wrote to memory of 1132	1976	cmd.exe	PING.EXE
PID 1976 wrote to memory of 1132	1976	cmd.exe	PING.EXE
PID 1976 wrote to memory of 1132	1976	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\179b405ee8bd2e5662d36849a487032504076a3182c172c248a6182b22466a10.exe
"C:\Users\Admin\AppData\Local\Temp\179b405ee8bd2e5662d36849a487032504076a3182c172c248a6182b22466a10.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:964

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1600

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\179b405ee8bd2e5662d36849a487032504076a3182c172c248a6182b22466a10.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1976

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1132

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
102e66c0f7556534e0367f4b34e15fa4

SHA1
e77d3bb4fd03b942fc4ef2833cd5c07db6593900

SHA256
3243288d61567a43cf79fe525f3dbfba00ac65b732f6bf9a6d8f1dad0c56d6dd

SHA512
3ace64655248fa718eef93458be52af9172b58c64e71dcb3b611f5d7a7f8ae8b5c7ad98e1f834bc0fbc243a35b984a86bdd2e0737afe2e3707a0ef8470bb5804

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
102e66c0f7556534e0367f4b34e15fa4

SHA1
e77d3bb4fd03b942fc4ef2833cd5c07db6593900

SHA256
3243288d61567a43cf79fe525f3dbfba00ac65b732f6bf9a6d8f1dad0c56d6dd

SHA512
3ace64655248fa718eef93458be52af9172b58c64e71dcb3b611f5d7a7f8ae8b5c7ad98e1f834bc0fbc243a35b984a86bdd2e0737afe2e3707a0ef8470bb5804

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
102e66c0f7556534e0367f4b34e15fa4

SHA1
e77d3bb4fd03b942fc4ef2833cd5c07db6593900

SHA256
3243288d61567a43cf79fe525f3dbfba00ac65b732f6bf9a6d8f1dad0c56d6dd

SHA512
3ace64655248fa718eef93458be52af9172b58c64e71dcb3b611f5d7a7f8ae8b5c7ad98e1f834bc0fbc243a35b984a86bdd2e0737afe2e3707a0ef8470bb5804

Download Submit
memory/964-54-0x0000000075601000-0x0000000075603000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads