sakula | 16d8a03d3c12ca5fee24e0e023cb95237bfff9d2555782fc09932fd2dd798139

General

Target

16d8a03d3c12ca5fee24e0e023cb95237bfff9d2555782fc09932fd2dd798139.exe
Size

101KB
MD5

3875414913996eac2b786994b760de04
SHA1

807e5963591e1f0d0efa87eef54e30930a4c431c
SHA256

16d8a03d3c12ca5fee24e0e023cb95237bfff9d2555782fc09932fd2dd798139
SHA512

271768d2e900c7083021627594a4d2b9c59a714d232eb9102389c798ae3c6ec8c861f0f606d88d39c1ebca0d7bacf04fe6252abe72ffa6e3c5fde75cc7c9f002

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula Payload 3 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula

Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1212 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

592 cmd.exe

pid	process
1212	MediaCenter.exe

pid	process
592	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

16d8a03d3c12ca5fee24e0e023cb95237bfff9d2555782fc09932fd2dd798139.exe

pid	process
1636	16d8a03d3c12ca5fee24e0e023cb95237bfff9d2555782fc09932fd2dd798139.exe
1636	16d8a03d3c12ca5fee24e0e023cb95237bfff9d2555782fc09932fd2dd798139.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

16d8a03d3c12ca5fee24e0e023cb95237bfff9d2555782fc09932fd2dd798139.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	16d8a03d3c12ca5fee24e0e023cb95237bfff9d2555782fc09932fd2dd798139.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

968 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

16d8a03d3c12ca5fee24e0e023cb95237bfff9d2555782fc09932fd2dd798139.exe

description pid process

Token: SeIncBasePriorityPrivilege 1636 16d8a03d3c12ca5fee24e0e023cb95237bfff9d2555782fc09932fd2dd798139.exe

pid	process
968	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1636	16d8a03d3c12ca5fee24e0e023cb95237bfff9d2555782fc09932fd2dd798139.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

16d8a03d3c12ca5fee24e0e023cb95237bfff9d2555782fc09932fd2dd798139.execmd.exe

description	pid	process	target process
PID 1636 wrote to memory of 1212	1636	16d8a03d3c12ca5fee24e0e023cb95237bfff9d2555782fc09932fd2dd798139.exe	MediaCenter.exe
PID 1636 wrote to memory of 1212	1636	16d8a03d3c12ca5fee24e0e023cb95237bfff9d2555782fc09932fd2dd798139.exe	MediaCenter.exe
PID 1636 wrote to memory of 1212	1636	16d8a03d3c12ca5fee24e0e023cb95237bfff9d2555782fc09932fd2dd798139.exe	MediaCenter.exe
PID 1636 wrote to memory of 1212	1636	16d8a03d3c12ca5fee24e0e023cb95237bfff9d2555782fc09932fd2dd798139.exe	MediaCenter.exe
PID 1636 wrote to memory of 592	1636	16d8a03d3c12ca5fee24e0e023cb95237bfff9d2555782fc09932fd2dd798139.exe	cmd.exe
PID 1636 wrote to memory of 592	1636	16d8a03d3c12ca5fee24e0e023cb95237bfff9d2555782fc09932fd2dd798139.exe	cmd.exe
PID 1636 wrote to memory of 592	1636	16d8a03d3c12ca5fee24e0e023cb95237bfff9d2555782fc09932fd2dd798139.exe	cmd.exe
PID 1636 wrote to memory of 592	1636	16d8a03d3c12ca5fee24e0e023cb95237bfff9d2555782fc09932fd2dd798139.exe	cmd.exe
PID 592 wrote to memory of 968	592	cmd.exe	PING.EXE
PID 592 wrote to memory of 968	592	cmd.exe	PING.EXE
PID 592 wrote to memory of 968	592	cmd.exe	PING.EXE
PID 592 wrote to memory of 968	592	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\16d8a03d3c12ca5fee24e0e023cb95237bfff9d2555782fc09932fd2dd798139.exe
"C:\Users\Admin\AppData\Local\Temp\16d8a03d3c12ca5fee24e0e023cb95237bfff9d2555782fc09932fd2dd798139.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1636

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1212

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\16d8a03d3c12ca5fee24e0e023cb95237bfff9d2555782fc09932fd2dd798139.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:592

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:968

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
eac20e050883cb0f1991f9967f69cf99

SHA1
26e73b82bdffaf7bc0afc5331ed6247f13d49862

SHA256
e3ebbc6c6eb27333d8a72764608e704c4334a0c4e96064be84cdc8d0d249564d

SHA512
6ea2285e136db26f41afb57e05e4f29eb8ad2ff8a95f4ae6422a07a370494cd4616f9ba2ae523425db1b6df95e8813d1031b1cd12dbe872423d7296adbb29ee0

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
eac20e050883cb0f1991f9967f69cf99

SHA1
26e73b82bdffaf7bc0afc5331ed6247f13d49862

SHA256
e3ebbc6c6eb27333d8a72764608e704c4334a0c4e96064be84cdc8d0d249564d

SHA512
6ea2285e136db26f41afb57e05e4f29eb8ad2ff8a95f4ae6422a07a370494cd4616f9ba2ae523425db1b6df95e8813d1031b1cd12dbe872423d7296adbb29ee0

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
eac20e050883cb0f1991f9967f69cf99

SHA1
26e73b82bdffaf7bc0afc5331ed6247f13d49862

SHA256
e3ebbc6c6eb27333d8a72764608e704c4334a0c4e96064be84cdc8d0d249564d

SHA512
6ea2285e136db26f41afb57e05e4f29eb8ad2ff8a95f4ae6422a07a370494cd4616f9ba2ae523425db1b6df95e8813d1031b1cd12dbe872423d7296adbb29ee0

Download Submit
memory/1636-55-0x0000000075D61000-0x0000000075D63000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads