sakula | 16c5574d1a647ccaf0aaf7b16fd52c5a2df29297abfc58bce40423bef89a3fc0

General

Target

16c5574d1a647ccaf0aaf7b16fd52c5a2df29297abfc58bce40423bef89a3fc0.exe
Size

60KB
MD5

2dd6289b929f6aaa732dfdb74c53e018
SHA1

6a844dd533d18eb32f81023fb85c76280d1fdbf3
SHA256

16c5574d1a647ccaf0aaf7b16fd52c5a2df29297abfc58bce40423bef89a3fc0
SHA512

36021fcc08191ce8e3ef8aa24055e34edd1df193bfb65774b91117c542af4bbf012e53acc3a8951b7d3baca9384602ef5d0ace4f00675648124b7fd574cc991b

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1888 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

684 cmd.exe

pid	process
1888	MediaCenter.exe

pid	process
684	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

16c5574d1a647ccaf0aaf7b16fd52c5a2df29297abfc58bce40423bef89a3fc0.exe

pid	process
1416	16c5574d1a647ccaf0aaf7b16fd52c5a2df29297abfc58bce40423bef89a3fc0.exe
1416	16c5574d1a647ccaf0aaf7b16fd52c5a2df29297abfc58bce40423bef89a3fc0.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

16c5574d1a647ccaf0aaf7b16fd52c5a2df29297abfc58bce40423bef89a3fc0.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	16c5574d1a647ccaf0aaf7b16fd52c5a2df29297abfc58bce40423bef89a3fc0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1108 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

16c5574d1a647ccaf0aaf7b16fd52c5a2df29297abfc58bce40423bef89a3fc0.exe

description pid process

Token: SeIncBasePriorityPrivilege 1416 16c5574d1a647ccaf0aaf7b16fd52c5a2df29297abfc58bce40423bef89a3fc0.exe

pid	process
1108	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1416	16c5574d1a647ccaf0aaf7b16fd52c5a2df29297abfc58bce40423bef89a3fc0.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

16c5574d1a647ccaf0aaf7b16fd52c5a2df29297abfc58bce40423bef89a3fc0.execmd.exe

description	pid	process	target process
PID 1416 wrote to memory of 1888	1416	16c5574d1a647ccaf0aaf7b16fd52c5a2df29297abfc58bce40423bef89a3fc0.exe	MediaCenter.exe
PID 1416 wrote to memory of 1888	1416	16c5574d1a647ccaf0aaf7b16fd52c5a2df29297abfc58bce40423bef89a3fc0.exe	MediaCenter.exe
PID 1416 wrote to memory of 1888	1416	16c5574d1a647ccaf0aaf7b16fd52c5a2df29297abfc58bce40423bef89a3fc0.exe	MediaCenter.exe
PID 1416 wrote to memory of 1888	1416	16c5574d1a647ccaf0aaf7b16fd52c5a2df29297abfc58bce40423bef89a3fc0.exe	MediaCenter.exe
PID 1416 wrote to memory of 684	1416	16c5574d1a647ccaf0aaf7b16fd52c5a2df29297abfc58bce40423bef89a3fc0.exe	cmd.exe
PID 1416 wrote to memory of 684	1416	16c5574d1a647ccaf0aaf7b16fd52c5a2df29297abfc58bce40423bef89a3fc0.exe	cmd.exe
PID 1416 wrote to memory of 684	1416	16c5574d1a647ccaf0aaf7b16fd52c5a2df29297abfc58bce40423bef89a3fc0.exe	cmd.exe
PID 1416 wrote to memory of 684	1416	16c5574d1a647ccaf0aaf7b16fd52c5a2df29297abfc58bce40423bef89a3fc0.exe	cmd.exe
PID 684 wrote to memory of 1108	684	cmd.exe	PING.EXE
PID 684 wrote to memory of 1108	684	cmd.exe	PING.EXE
PID 684 wrote to memory of 1108	684	cmd.exe	PING.EXE
PID 684 wrote to memory of 1108	684	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\16c5574d1a647ccaf0aaf7b16fd52c5a2df29297abfc58bce40423bef89a3fc0.exe
"C:\Users\Admin\AppData\Local\Temp\16c5574d1a647ccaf0aaf7b16fd52c5a2df29297abfc58bce40423bef89a3fc0.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1416

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1888

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\16c5574d1a647ccaf0aaf7b16fd52c5a2df29297abfc58bce40423bef89a3fc0.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:684

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1108

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
af4a1dbc3e2b9421b9f90b9bc66f6ba0

SHA1
ee9643bcc3f0a20f71d9e2ccd633b198cf6bb275

SHA256
37ceb9beac25ddb49affab63ff2e193741ba9c32f8635212098af37defde76f7

SHA512
6c4b2cfa5d8b87364746bd2e0cbd1f577f6f6490b75dbbabc2c9af9a4af159389608d6b1868c9c5584818e7de5d5e340088f90a3f5579d301a3618a15be0ae0b

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
af4a1dbc3e2b9421b9f90b9bc66f6ba0

SHA1
ee9643bcc3f0a20f71d9e2ccd633b198cf6bb275

SHA256
37ceb9beac25ddb49affab63ff2e193741ba9c32f8635212098af37defde76f7

SHA512
6c4b2cfa5d8b87364746bd2e0cbd1f577f6f6490b75dbbabc2c9af9a4af159389608d6b1868c9c5584818e7de5d5e340088f90a3f5579d301a3618a15be0ae0b

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
af4a1dbc3e2b9421b9f90b9bc66f6ba0

SHA1
ee9643bcc3f0a20f71d9e2ccd633b198cf6bb275

SHA256
37ceb9beac25ddb49affab63ff2e193741ba9c32f8635212098af37defde76f7

SHA512
6c4b2cfa5d8b87364746bd2e0cbd1f577f6f6490b75dbbabc2c9af9a4af159389608d6b1868c9c5584818e7de5d5e340088f90a3f5579d301a3618a15be0ae0b

Download Submit
memory/1416-54-0x0000000076071000-0x0000000076073000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads