sakula | 15a90fc6e337163d21748dfe1d31f1483d293bbb2e907a9347e81631118efbd1

General

Target

15a90fc6e337163d21748dfe1d31f1483d293bbb2e907a9347e81631118efbd1.exe
Size

58KB
MD5

8029d667949d169e7349b9f5c08ec268
SHA1

b29d90b557fe1a9cbfd9ec510003be3aacc87e3e
SHA256

15a90fc6e337163d21748dfe1d31f1483d293bbb2e907a9347e81631118efbd1
SHA512

592d538cbe0e8c563905bc5e67aac2f547b09cc669239d753ee5cec82b7955d0c4640073cab12deaf70d15244220591f774c03599834111139aff14de37d0464

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1536 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1648 cmd.exe

pid	process
1536	MediaCenter.exe

pid	process
1648	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

15a90fc6e337163d21748dfe1d31f1483d293bbb2e907a9347e81631118efbd1.exe

pid	process
900	15a90fc6e337163d21748dfe1d31f1483d293bbb2e907a9347e81631118efbd1.exe
900	15a90fc6e337163d21748dfe1d31f1483d293bbb2e907a9347e81631118efbd1.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

15a90fc6e337163d21748dfe1d31f1483d293bbb2e907a9347e81631118efbd1.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	15a90fc6e337163d21748dfe1d31f1483d293bbb2e907a9347e81631118efbd1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

540 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

15a90fc6e337163d21748dfe1d31f1483d293bbb2e907a9347e81631118efbd1.exe

description pid process

Token: SeIncBasePriorityPrivilege 900 15a90fc6e337163d21748dfe1d31f1483d293bbb2e907a9347e81631118efbd1.exe

pid	process
540	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	900	15a90fc6e337163d21748dfe1d31f1483d293bbb2e907a9347e81631118efbd1.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

15a90fc6e337163d21748dfe1d31f1483d293bbb2e907a9347e81631118efbd1.execmd.exe

description	pid	process	target process
PID 900 wrote to memory of 1536	900	15a90fc6e337163d21748dfe1d31f1483d293bbb2e907a9347e81631118efbd1.exe	MediaCenter.exe
PID 900 wrote to memory of 1536	900	15a90fc6e337163d21748dfe1d31f1483d293bbb2e907a9347e81631118efbd1.exe	MediaCenter.exe
PID 900 wrote to memory of 1536	900	15a90fc6e337163d21748dfe1d31f1483d293bbb2e907a9347e81631118efbd1.exe	MediaCenter.exe
PID 900 wrote to memory of 1536	900	15a90fc6e337163d21748dfe1d31f1483d293bbb2e907a9347e81631118efbd1.exe	MediaCenter.exe
PID 900 wrote to memory of 1648	900	15a90fc6e337163d21748dfe1d31f1483d293bbb2e907a9347e81631118efbd1.exe	cmd.exe
PID 900 wrote to memory of 1648	900	15a90fc6e337163d21748dfe1d31f1483d293bbb2e907a9347e81631118efbd1.exe	cmd.exe
PID 900 wrote to memory of 1648	900	15a90fc6e337163d21748dfe1d31f1483d293bbb2e907a9347e81631118efbd1.exe	cmd.exe
PID 900 wrote to memory of 1648	900	15a90fc6e337163d21748dfe1d31f1483d293bbb2e907a9347e81631118efbd1.exe	cmd.exe
PID 1648 wrote to memory of 540	1648	cmd.exe	PING.EXE
PID 1648 wrote to memory of 540	1648	cmd.exe	PING.EXE
PID 1648 wrote to memory of 540	1648	cmd.exe	PING.EXE
PID 1648 wrote to memory of 540	1648	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\15a90fc6e337163d21748dfe1d31f1483d293bbb2e907a9347e81631118efbd1.exe
"C:\Users\Admin\AppData\Local\Temp\15a90fc6e337163d21748dfe1d31f1483d293bbb2e907a9347e81631118efbd1.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:900

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1536

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\15a90fc6e337163d21748dfe1d31f1483d293bbb2e907a9347e81631118efbd1.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1648

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:540

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
6acf3c586bebc76dfc8d1c9cf06e3fd2

SHA1
208d263613fe2d01af843a430946999992ebe945

SHA256
b9254d2ccbae09e8839f4bdb252ede0998b782ce4e9861e07725f2dd925ada7c

SHA512
aef5a8f49d0d2c9fed23b7d842bd0f1b999f24580cb69d3639ca0d34b55e81dc22ee7ab33c548ac47283ef35529a248f40d572a749c327a3a11d2eb3c82309a7

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
6acf3c586bebc76dfc8d1c9cf06e3fd2

SHA1
208d263613fe2d01af843a430946999992ebe945

SHA256
b9254d2ccbae09e8839f4bdb252ede0998b782ce4e9861e07725f2dd925ada7c

SHA512
aef5a8f49d0d2c9fed23b7d842bd0f1b999f24580cb69d3639ca0d34b55e81dc22ee7ab33c548ac47283ef35529a248f40d572a749c327a3a11d2eb3c82309a7

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
6acf3c586bebc76dfc8d1c9cf06e3fd2

SHA1
208d263613fe2d01af843a430946999992ebe945

SHA256
b9254d2ccbae09e8839f4bdb252ede0998b782ce4e9861e07725f2dd925ada7c

SHA512
aef5a8f49d0d2c9fed23b7d842bd0f1b999f24580cb69d3639ca0d34b55e81dc22ee7ab33c548ac47283ef35529a248f40d572a749c327a3a11d2eb3c82309a7

Download Submit
memory/900-55-0x0000000075B11000-0x0000000075B13000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads