sakula | 16dda042ae8dc7cefb3f88cedf71a7e12d2d68fe26ab7eea8de257cdd3c9892b

General

Target

16dda042ae8dc7cefb3f88cedf71a7e12d2d68fe26ab7eea8de257cdd3c9892b.exe
Size

104KB
MD5

2d4ff13a7d07e781b1ab9dd9e040a2fb
SHA1

c0c62ef131e5ea3573742a3f7c1c62a2185d3cfa
SHA256

16dda042ae8dc7cefb3f88cedf71a7e12d2d68fe26ab7eea8de257cdd3c9892b
SHA512

1ae9126e75b8652eb07b91ea2b59726810c1ff7f386b13da784fae600837530dc6558d34c1205367b133dda2b34f796ecefba4aeb39e04e7a283ef4ef745661c

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula Payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula

Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

2472 MediaCenter.exe

pid	process
2472	MediaCenter.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

16dda042ae8dc7cefb3f88cedf71a7e12d2d68fe26ab7eea8de257cdd3c9892b.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	16dda042ae8dc7cefb3f88cedf71a7e12d2d68fe26ab7eea8de257cdd3c9892b.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

16dda042ae8dc7cefb3f88cedf71a7e12d2d68fe26ab7eea8de257cdd3c9892b.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	16dda042ae8dc7cefb3f88cedf71a7e12d2d68fe26ab7eea8de257cdd3c9892b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

MusNotifyIcon.exe

description	ioc	process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MusNotifyIcon.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MusNotifyIcon.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

916 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

16dda042ae8dc7cefb3f88cedf71a7e12d2d68fe26ab7eea8de257cdd3c9892b.exe

description pid process

Token: SeIncBasePriorityPrivilege 536 16dda042ae8dc7cefb3f88cedf71a7e12d2d68fe26ab7eea8de257cdd3c9892b.exe

pid	process
916	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	536	16dda042ae8dc7cefb3f88cedf71a7e12d2d68fe26ab7eea8de257cdd3c9892b.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

16dda042ae8dc7cefb3f88cedf71a7e12d2d68fe26ab7eea8de257cdd3c9892b.execmd.exe

description	pid	process	target process
PID 536 wrote to memory of 2472	536	16dda042ae8dc7cefb3f88cedf71a7e12d2d68fe26ab7eea8de257cdd3c9892b.exe	MediaCenter.exe
PID 536 wrote to memory of 2472	536	16dda042ae8dc7cefb3f88cedf71a7e12d2d68fe26ab7eea8de257cdd3c9892b.exe	MediaCenter.exe
PID 536 wrote to memory of 2472	536	16dda042ae8dc7cefb3f88cedf71a7e12d2d68fe26ab7eea8de257cdd3c9892b.exe	MediaCenter.exe
PID 536 wrote to memory of 3524	536	16dda042ae8dc7cefb3f88cedf71a7e12d2d68fe26ab7eea8de257cdd3c9892b.exe	cmd.exe
PID 536 wrote to memory of 3524	536	16dda042ae8dc7cefb3f88cedf71a7e12d2d68fe26ab7eea8de257cdd3c9892b.exe	cmd.exe
PID 536 wrote to memory of 3524	536	16dda042ae8dc7cefb3f88cedf71a7e12d2d68fe26ab7eea8de257cdd3c9892b.exe	cmd.exe
PID 3524 wrote to memory of 916	3524	cmd.exe	PING.EXE
PID 3524 wrote to memory of 916	3524	cmd.exe	PING.EXE
PID 3524 wrote to memory of 916	3524	cmd.exe	PING.EXE

C:\Windows\system32\MusNotifyIcon.exe
%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13
1⤵
- Checks processor information in registry
PID:1184

C:\Users\Admin\AppData\Local\Temp\16dda042ae8dc7cefb3f88cedf71a7e12d2d68fe26ab7eea8de257cdd3c9892b.exe
"C:\Users\Admin\AppData\Local\Temp\16dda042ae8dc7cefb3f88cedf71a7e12d2d68fe26ab7eea8de257cdd3c9892b.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:536

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:2472

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\16dda042ae8dc7cefb3f88cedf71a7e12d2d68fe26ab7eea8de257cdd3c9892b.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:3524

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:916

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

Remote System Discovery

1

T1018

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
1ed376b26d7889cc8dd946902f07edc9

SHA1
759bc5f2d4b0f21dfae70c3f2aaf4c6b819d949d

SHA256
7e45fcce94092282443076d3df82daf8d9114d3b275c5b751f5d36ec28215236

SHA512
5253c847697b54faffb07f0dbdba6e5ae444050f95485de04c9571f1fd0d3886fdb179d446ef2c28f2b67dc4921f083d443d4289842aafebb47ad2ce6d60839d

Download Submit
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
1ed376b26d7889cc8dd946902f07edc9

SHA1
759bc5f2d4b0f21dfae70c3f2aaf4c6b819d949d

SHA256
7e45fcce94092282443076d3df82daf8d9114d3b275c5b751f5d36ec28215236

SHA512
5253c847697b54faffb07f0dbdba6e5ae444050f95485de04c9571f1fd0d3886fdb179d446ef2c28f2b67dc4921f083d443d4289842aafebb47ad2ce6d60839d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads