sakula | 15c774cdceca4775baa1e0f6cfbf9cf396c5812c03b6e475ecb59a04d1a79ac4

General

Target

15c774cdceca4775baa1e0f6cfbf9cf396c5812c03b6e475ecb59a04d1a79ac4.exe
Size

191KB
MD5

af9bdb24f085fe125b6b1d7dee2ff634
SHA1

a4ecbec9051bcccb201812ed313dfb4651fc168a
SHA256

15c774cdceca4775baa1e0f6cfbf9cf396c5812c03b6e475ecb59a04d1a79ac4
SHA512

65dde3c880078869a7b89dec8fe2f545b39df1a4a7494e58a286c6f84ef5bd8527b87510474e23e0a29ed5a73d47d39aee22fcb9e1a207283bd026659d46031f

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula Payload 3 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula

Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1444 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

912 cmd.exe

pid	process
1444	MediaCenter.exe

pid	process
912	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

15c774cdceca4775baa1e0f6cfbf9cf396c5812c03b6e475ecb59a04d1a79ac4.exe

pid	process
1580	15c774cdceca4775baa1e0f6cfbf9cf396c5812c03b6e475ecb59a04d1a79ac4.exe
1580	15c774cdceca4775baa1e0f6cfbf9cf396c5812c03b6e475ecb59a04d1a79ac4.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

15c774cdceca4775baa1e0f6cfbf9cf396c5812c03b6e475ecb59a04d1a79ac4.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	15c774cdceca4775baa1e0f6cfbf9cf396c5812c03b6e475ecb59a04d1a79ac4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

748 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

15c774cdceca4775baa1e0f6cfbf9cf396c5812c03b6e475ecb59a04d1a79ac4.exe

description pid process

Token: SeIncBasePriorityPrivilege 1580 15c774cdceca4775baa1e0f6cfbf9cf396c5812c03b6e475ecb59a04d1a79ac4.exe

pid	process
748	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1580	15c774cdceca4775baa1e0f6cfbf9cf396c5812c03b6e475ecb59a04d1a79ac4.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

15c774cdceca4775baa1e0f6cfbf9cf396c5812c03b6e475ecb59a04d1a79ac4.execmd.exe

description	pid	process	target process
PID 1580 wrote to memory of 1444	1580	15c774cdceca4775baa1e0f6cfbf9cf396c5812c03b6e475ecb59a04d1a79ac4.exe	MediaCenter.exe
PID 1580 wrote to memory of 1444	1580	15c774cdceca4775baa1e0f6cfbf9cf396c5812c03b6e475ecb59a04d1a79ac4.exe	MediaCenter.exe
PID 1580 wrote to memory of 1444	1580	15c774cdceca4775baa1e0f6cfbf9cf396c5812c03b6e475ecb59a04d1a79ac4.exe	MediaCenter.exe
PID 1580 wrote to memory of 1444	1580	15c774cdceca4775baa1e0f6cfbf9cf396c5812c03b6e475ecb59a04d1a79ac4.exe	MediaCenter.exe
PID 1580 wrote to memory of 912	1580	15c774cdceca4775baa1e0f6cfbf9cf396c5812c03b6e475ecb59a04d1a79ac4.exe	cmd.exe
PID 1580 wrote to memory of 912	1580	15c774cdceca4775baa1e0f6cfbf9cf396c5812c03b6e475ecb59a04d1a79ac4.exe	cmd.exe
PID 1580 wrote to memory of 912	1580	15c774cdceca4775baa1e0f6cfbf9cf396c5812c03b6e475ecb59a04d1a79ac4.exe	cmd.exe
PID 1580 wrote to memory of 912	1580	15c774cdceca4775baa1e0f6cfbf9cf396c5812c03b6e475ecb59a04d1a79ac4.exe	cmd.exe
PID 912 wrote to memory of 748	912	cmd.exe	PING.EXE
PID 912 wrote to memory of 748	912	cmd.exe	PING.EXE
PID 912 wrote to memory of 748	912	cmd.exe	PING.EXE
PID 912 wrote to memory of 748	912	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\15c774cdceca4775baa1e0f6cfbf9cf396c5812c03b6e475ecb59a04d1a79ac4.exe
"C:\Users\Admin\AppData\Local\Temp\15c774cdceca4775baa1e0f6cfbf9cf396c5812c03b6e475ecb59a04d1a79ac4.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1580

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1444

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\15c774cdceca4775baa1e0f6cfbf9cf396c5812c03b6e475ecb59a04d1a79ac4.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:912

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:748

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
9daad0db96e04aa359fb551f166d383a

SHA1
7eb618be7bade100f6d65819743ebcd8d305f25a

SHA256
cafa915c647d0e9d0451baf303f74e2ef2f897f6eb0f090449ee598c62272381

SHA512
9222165b9859046c638144029a6304cb83771a35a341458f2bfe960fc91491c3ea3a7c22b01b4ec7d2ba305e186fc7acdeca55d8aa037bec123ec71608405dba

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
9daad0db96e04aa359fb551f166d383a

SHA1
7eb618be7bade100f6d65819743ebcd8d305f25a

SHA256
cafa915c647d0e9d0451baf303f74e2ef2f897f6eb0f090449ee598c62272381

SHA512
9222165b9859046c638144029a6304cb83771a35a341458f2bfe960fc91491c3ea3a7c22b01b4ec7d2ba305e186fc7acdeca55d8aa037bec123ec71608405dba

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
9daad0db96e04aa359fb551f166d383a

SHA1
7eb618be7bade100f6d65819743ebcd8d305f25a

SHA256
cafa915c647d0e9d0451baf303f74e2ef2f897f6eb0f090449ee598c62272381

SHA512
9222165b9859046c638144029a6304cb83771a35a341458f2bfe960fc91491c3ea3a7c22b01b4ec7d2ba305e186fc7acdeca55d8aa037bec123ec71608405dba

Download Submit
memory/1580-53-0x0000000075AE1000-0x0000000075AE3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads