sakula | 16c6f09b21551697b130d5434265289d6fa06ba131ae90a891e8338e37d7c489

General

Target

16c6f09b21551697b130d5434265289d6fa06ba131ae90a891e8338e37d7c489.exe
Size

191KB
MD5

092fa8d2cbdb25d581c2529de6cdafb1
SHA1

cb0e9a40e2634d6c079cb99aa5c9b86fb0740bdb
SHA256

16c6f09b21551697b130d5434265289d6fa06ba131ae90a891e8338e37d7c489
SHA512

136e448aa6b441c781709fb81337c5ea317d788ba30bbe739fbbe14df03f635e30c92a662580e19d23e4367210c2de41272d5732055ded78c4e4ad97fcf0cf93

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula Payload 3 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula

Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1616 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

432 cmd.exe

pid	process
1616	MediaCenter.exe

pid	process
432	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

16c6f09b21551697b130d5434265289d6fa06ba131ae90a891e8338e37d7c489.exe

pid	process
1608	16c6f09b21551697b130d5434265289d6fa06ba131ae90a891e8338e37d7c489.exe
1608	16c6f09b21551697b130d5434265289d6fa06ba131ae90a891e8338e37d7c489.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

16c6f09b21551697b130d5434265289d6fa06ba131ae90a891e8338e37d7c489.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	16c6f09b21551697b130d5434265289d6fa06ba131ae90a891e8338e37d7c489.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

956 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

16c6f09b21551697b130d5434265289d6fa06ba131ae90a891e8338e37d7c489.exe

description pid process

Token: SeIncBasePriorityPrivilege 1608 16c6f09b21551697b130d5434265289d6fa06ba131ae90a891e8338e37d7c489.exe

pid	process
956	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1608	16c6f09b21551697b130d5434265289d6fa06ba131ae90a891e8338e37d7c489.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

16c6f09b21551697b130d5434265289d6fa06ba131ae90a891e8338e37d7c489.execmd.exe

description	pid	process	target process
PID 1608 wrote to memory of 1616	1608	16c6f09b21551697b130d5434265289d6fa06ba131ae90a891e8338e37d7c489.exe	MediaCenter.exe
PID 1608 wrote to memory of 1616	1608	16c6f09b21551697b130d5434265289d6fa06ba131ae90a891e8338e37d7c489.exe	MediaCenter.exe
PID 1608 wrote to memory of 1616	1608	16c6f09b21551697b130d5434265289d6fa06ba131ae90a891e8338e37d7c489.exe	MediaCenter.exe
PID 1608 wrote to memory of 1616	1608	16c6f09b21551697b130d5434265289d6fa06ba131ae90a891e8338e37d7c489.exe	MediaCenter.exe
PID 1608 wrote to memory of 432	1608	16c6f09b21551697b130d5434265289d6fa06ba131ae90a891e8338e37d7c489.exe	cmd.exe
PID 1608 wrote to memory of 432	1608	16c6f09b21551697b130d5434265289d6fa06ba131ae90a891e8338e37d7c489.exe	cmd.exe
PID 1608 wrote to memory of 432	1608	16c6f09b21551697b130d5434265289d6fa06ba131ae90a891e8338e37d7c489.exe	cmd.exe
PID 1608 wrote to memory of 432	1608	16c6f09b21551697b130d5434265289d6fa06ba131ae90a891e8338e37d7c489.exe	cmd.exe
PID 432 wrote to memory of 956	432	cmd.exe	PING.EXE
PID 432 wrote to memory of 956	432	cmd.exe	PING.EXE
PID 432 wrote to memory of 956	432	cmd.exe	PING.EXE
PID 432 wrote to memory of 956	432	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\16c6f09b21551697b130d5434265289d6fa06ba131ae90a891e8338e37d7c489.exe
"C:\Users\Admin\AppData\Local\Temp\16c6f09b21551697b130d5434265289d6fa06ba131ae90a891e8338e37d7c489.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1608

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1616

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\16c6f09b21551697b130d5434265289d6fa06ba131ae90a891e8338e37d7c489.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:432

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:956

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
360373bf2fc58d6ce780ccaae6435864

SHA1
f070c051b30ed1dcb04bba9379a0347e3f2552e1

SHA256
d07f828be359de9723ff9eb872465e6e088c8c568842ef2dff1ee984588140a0

SHA512
f943c1c05ec44ddb9c66670006aac96235875a60bbe04a82d8eec73192dc39f98ada35dc09e7a224b965783f88969dcc3c29dfc1d262f149d5d741a69c787060

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
360373bf2fc58d6ce780ccaae6435864

SHA1
f070c051b30ed1dcb04bba9379a0347e3f2552e1

SHA256
d07f828be359de9723ff9eb872465e6e088c8c568842ef2dff1ee984588140a0

SHA512
f943c1c05ec44ddb9c66670006aac96235875a60bbe04a82d8eec73192dc39f98ada35dc09e7a224b965783f88969dcc3c29dfc1d262f149d5d741a69c787060

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
360373bf2fc58d6ce780ccaae6435864

SHA1
f070c051b30ed1dcb04bba9379a0347e3f2552e1

SHA256
d07f828be359de9723ff9eb872465e6e088c8c568842ef2dff1ee984588140a0

SHA512
f943c1c05ec44ddb9c66670006aac96235875a60bbe04a82d8eec73192dc39f98ada35dc09e7a224b965783f88969dcc3c29dfc1d262f149d5d741a69c787060

Download Submit
memory/1608-55-0x0000000075AB1000-0x0000000075AB3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads