sakula | 155b8f2e93ab15c2732e8a89b53fc055e9915f0605c9d0dc49110d4d12c878b3

General

Target

155b8f2e93ab15c2732e8a89b53fc055e9915f0605c9d0dc49110d4d12c878b3.exe
Size

35KB
MD5

a54468dc5f6370f3ffcef33b25819733
SHA1

47f5aa6d4f62ecd3e1cd21b90afc857305af02f0
SHA256

155b8f2e93ab15c2732e8a89b53fc055e9915f0605c9d0dc49110d4d12c878b3
SHA512

78b3c1cffb49f976a3e69293064db14952b47cd5a9f92a56b3dca20d4c73fe235ec97aa33e2d8e3bf8d822faef7a673cfb309accb37ebb96033d824bceea918f

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

876 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1000 cmd.exe

pid	process
876	MediaCenter.exe

pid	process
1000	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

155b8f2e93ab15c2732e8a89b53fc055e9915f0605c9d0dc49110d4d12c878b3.exe

pid	process
1516	155b8f2e93ab15c2732e8a89b53fc055e9915f0605c9d0dc49110d4d12c878b3.exe
1516	155b8f2e93ab15c2732e8a89b53fc055e9915f0605c9d0dc49110d4d12c878b3.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

155b8f2e93ab15c2732e8a89b53fc055e9915f0605c9d0dc49110d4d12c878b3.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	155b8f2e93ab15c2732e8a89b53fc055e9915f0605c9d0dc49110d4d12c878b3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1876 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

155b8f2e93ab15c2732e8a89b53fc055e9915f0605c9d0dc49110d4d12c878b3.exe

description pid process

Token: SeIncBasePriorityPrivilege 1516 155b8f2e93ab15c2732e8a89b53fc055e9915f0605c9d0dc49110d4d12c878b3.exe

pid	process
1876	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1516	155b8f2e93ab15c2732e8a89b53fc055e9915f0605c9d0dc49110d4d12c878b3.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

155b8f2e93ab15c2732e8a89b53fc055e9915f0605c9d0dc49110d4d12c878b3.execmd.exe

description	pid	process	target process
PID 1516 wrote to memory of 876	1516	155b8f2e93ab15c2732e8a89b53fc055e9915f0605c9d0dc49110d4d12c878b3.exe	MediaCenter.exe
PID 1516 wrote to memory of 876	1516	155b8f2e93ab15c2732e8a89b53fc055e9915f0605c9d0dc49110d4d12c878b3.exe	MediaCenter.exe
PID 1516 wrote to memory of 876	1516	155b8f2e93ab15c2732e8a89b53fc055e9915f0605c9d0dc49110d4d12c878b3.exe	MediaCenter.exe
PID 1516 wrote to memory of 876	1516	155b8f2e93ab15c2732e8a89b53fc055e9915f0605c9d0dc49110d4d12c878b3.exe	MediaCenter.exe
PID 1516 wrote to memory of 1000	1516	155b8f2e93ab15c2732e8a89b53fc055e9915f0605c9d0dc49110d4d12c878b3.exe	cmd.exe
PID 1516 wrote to memory of 1000	1516	155b8f2e93ab15c2732e8a89b53fc055e9915f0605c9d0dc49110d4d12c878b3.exe	cmd.exe
PID 1516 wrote to memory of 1000	1516	155b8f2e93ab15c2732e8a89b53fc055e9915f0605c9d0dc49110d4d12c878b3.exe	cmd.exe
PID 1516 wrote to memory of 1000	1516	155b8f2e93ab15c2732e8a89b53fc055e9915f0605c9d0dc49110d4d12c878b3.exe	cmd.exe
PID 1000 wrote to memory of 1876	1000	cmd.exe	PING.EXE
PID 1000 wrote to memory of 1876	1000	cmd.exe	PING.EXE
PID 1000 wrote to memory of 1876	1000	cmd.exe	PING.EXE
PID 1000 wrote to memory of 1876	1000	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\155b8f2e93ab15c2732e8a89b53fc055e9915f0605c9d0dc49110d4d12c878b3.exe
"C:\Users\Admin\AppData\Local\Temp\155b8f2e93ab15c2732e8a89b53fc055e9915f0605c9d0dc49110d4d12c878b3.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1516

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:876

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\155b8f2e93ab15c2732e8a89b53fc055e9915f0605c9d0dc49110d4d12c878b3.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1000

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1876

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
c8bbf1887d61631a3bb756bd46229b99

SHA1
32f9c62a4b6142a1e1eb3df0e03a83f2c8dce9a8

SHA256
d9f5984105b76b98b428d2fe22baaa7a4885db0a716119f5ac206952ec973431

SHA512
7eee8d46c97547f20bd183547cf5edc7c98c839ca162d76561655da6766682d2a1a744ee72a081c81573481f1e76f7fb5662a595d3cb08e30d749d3ee8c17dac

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
c8bbf1887d61631a3bb756bd46229b99

SHA1
32f9c62a4b6142a1e1eb3df0e03a83f2c8dce9a8

SHA256
d9f5984105b76b98b428d2fe22baaa7a4885db0a716119f5ac206952ec973431

SHA512
7eee8d46c97547f20bd183547cf5edc7c98c839ca162d76561655da6766682d2a1a744ee72a081c81573481f1e76f7fb5662a595d3cb08e30d749d3ee8c17dac

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
c8bbf1887d61631a3bb756bd46229b99

SHA1
32f9c62a4b6142a1e1eb3df0e03a83f2c8dce9a8

SHA256
d9f5984105b76b98b428d2fe22baaa7a4885db0a716119f5ac206952ec973431

SHA512
7eee8d46c97547f20bd183547cf5edc7c98c839ca162d76561655da6766682d2a1a744ee72a081c81573481f1e76f7fb5662a595d3cb08e30d749d3ee8c17dac

Download Submit
memory/1516-53-0x0000000075471000-0x0000000075473000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads