sakula | 156dc36d2d3961be836c497a016a7ecc3ce762fd9e25b7f5e5a59da6aa496cd5

General

Target

156dc36d2d3961be836c497a016a7ecc3ce762fd9e25b7f5e5a59da6aa496cd5.exe
Size

99KB
MD5

aa7b8a039eedc95be933b8e1420c4853
SHA1

5d594a1d7bb595a1e34dd99194c087a14715e752
SHA256

156dc36d2d3961be836c497a016a7ecc3ce762fd9e25b7f5e5a59da6aa496cd5
SHA512

d4a7eae672754e8657434708f4c5d728ecbe236efd3d15d04dc2b7531ca32ef6dacdf92eca3327b85fd17b828dc0a6cfdd73c700735ad3fcf6c7b7493300e2ef

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula Payload 3 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula

Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1700 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

732 cmd.exe

pid	process
1700	MediaCenter.exe

pid	process
732	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

156dc36d2d3961be836c497a016a7ecc3ce762fd9e25b7f5e5a59da6aa496cd5.exe

pid	process
1780	156dc36d2d3961be836c497a016a7ecc3ce762fd9e25b7f5e5a59da6aa496cd5.exe
1780	156dc36d2d3961be836c497a016a7ecc3ce762fd9e25b7f5e5a59da6aa496cd5.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

156dc36d2d3961be836c497a016a7ecc3ce762fd9e25b7f5e5a59da6aa496cd5.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	156dc36d2d3961be836c497a016a7ecc3ce762fd9e25b7f5e5a59da6aa496cd5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1624 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

156dc36d2d3961be836c497a016a7ecc3ce762fd9e25b7f5e5a59da6aa496cd5.exe

description pid process

Token: SeIncBasePriorityPrivilege 1780 156dc36d2d3961be836c497a016a7ecc3ce762fd9e25b7f5e5a59da6aa496cd5.exe

pid	process
1624	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1780	156dc36d2d3961be836c497a016a7ecc3ce762fd9e25b7f5e5a59da6aa496cd5.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

156dc36d2d3961be836c497a016a7ecc3ce762fd9e25b7f5e5a59da6aa496cd5.execmd.exe

description	pid	process	target process
PID 1780 wrote to memory of 1700	1780	156dc36d2d3961be836c497a016a7ecc3ce762fd9e25b7f5e5a59da6aa496cd5.exe	MediaCenter.exe
PID 1780 wrote to memory of 1700	1780	156dc36d2d3961be836c497a016a7ecc3ce762fd9e25b7f5e5a59da6aa496cd5.exe	MediaCenter.exe
PID 1780 wrote to memory of 1700	1780	156dc36d2d3961be836c497a016a7ecc3ce762fd9e25b7f5e5a59da6aa496cd5.exe	MediaCenter.exe
PID 1780 wrote to memory of 1700	1780	156dc36d2d3961be836c497a016a7ecc3ce762fd9e25b7f5e5a59da6aa496cd5.exe	MediaCenter.exe
PID 1780 wrote to memory of 732	1780	156dc36d2d3961be836c497a016a7ecc3ce762fd9e25b7f5e5a59da6aa496cd5.exe	cmd.exe
PID 1780 wrote to memory of 732	1780	156dc36d2d3961be836c497a016a7ecc3ce762fd9e25b7f5e5a59da6aa496cd5.exe	cmd.exe
PID 1780 wrote to memory of 732	1780	156dc36d2d3961be836c497a016a7ecc3ce762fd9e25b7f5e5a59da6aa496cd5.exe	cmd.exe
PID 1780 wrote to memory of 732	1780	156dc36d2d3961be836c497a016a7ecc3ce762fd9e25b7f5e5a59da6aa496cd5.exe	cmd.exe
PID 732 wrote to memory of 1624	732	cmd.exe	PING.EXE
PID 732 wrote to memory of 1624	732	cmd.exe	PING.EXE
PID 732 wrote to memory of 1624	732	cmd.exe	PING.EXE
PID 732 wrote to memory of 1624	732	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\156dc36d2d3961be836c497a016a7ecc3ce762fd9e25b7f5e5a59da6aa496cd5.exe
"C:\Users\Admin\AppData\Local\Temp\156dc36d2d3961be836c497a016a7ecc3ce762fd9e25b7f5e5a59da6aa496cd5.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1780

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1700

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\156dc36d2d3961be836c497a016a7ecc3ce762fd9e25b7f5e5a59da6aa496cd5.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:732

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1624

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
38c6269369f866067f24a9c8434e2994

SHA1
1779fb99d937520726000fa53fa19ba8cb2b794a

SHA256
356f3f9fc98c8c7d19b33c978e19ca76c9726f07dcf29b684a592258e93f830d

SHA512
e049a39ce55b61f5feae81f9c76e553601adeb570ae3eb23ce96e3f889b9425d4f695b8caf94ff7b68d82b9d12ddb113e59b56e01e069bac197c8f58f6be7bb0

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
38c6269369f866067f24a9c8434e2994

SHA1
1779fb99d937520726000fa53fa19ba8cb2b794a

SHA256
356f3f9fc98c8c7d19b33c978e19ca76c9726f07dcf29b684a592258e93f830d

SHA512
e049a39ce55b61f5feae81f9c76e553601adeb570ae3eb23ce96e3f889b9425d4f695b8caf94ff7b68d82b9d12ddb113e59b56e01e069bac197c8f58f6be7bb0

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
38c6269369f866067f24a9c8434e2994

SHA1
1779fb99d937520726000fa53fa19ba8cb2b794a

SHA256
356f3f9fc98c8c7d19b33c978e19ca76c9726f07dcf29b684a592258e93f830d

SHA512
e049a39ce55b61f5feae81f9c76e553601adeb570ae3eb23ce96e3f889b9425d4f695b8caf94ff7b68d82b9d12ddb113e59b56e01e069bac197c8f58f6be7bb0

Download Submit
memory/1780-55-0x0000000075F91000-0x0000000075F93000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads