sakula | 12d07d5288e029850a63c183e103edc0bbe2caa7021d2f231bd9cfaf28ad3486

General

Target

12d07d5288e029850a63c183e103edc0bbe2caa7021d2f231bd9cfaf28ad3486.exe
Size

60KB
MD5

dcf9df431b54e124b78ead60f6d186aa
SHA1

9595345e2a15ef473a2bd479ace0dbab172745ac
SHA256

12d07d5288e029850a63c183e103edc0bbe2caa7021d2f231bd9cfaf28ad3486
SHA512

cd397e1b9fca30a073427e99297c7c0d9ebbf736e75dcd601806c1d5e0c17596e950568b515d17698fed3726aa2b849e0871ff8837c709c0348459df25ac4eb6

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1516 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

804 cmd.exe

pid	process
1516	MediaCenter.exe

pid	process
804	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

12d07d5288e029850a63c183e103edc0bbe2caa7021d2f231bd9cfaf28ad3486.exe

pid	process
1572	12d07d5288e029850a63c183e103edc0bbe2caa7021d2f231bd9cfaf28ad3486.exe
1572	12d07d5288e029850a63c183e103edc0bbe2caa7021d2f231bd9cfaf28ad3486.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

12d07d5288e029850a63c183e103edc0bbe2caa7021d2f231bd9cfaf28ad3486.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	12d07d5288e029850a63c183e103edc0bbe2caa7021d2f231bd9cfaf28ad3486.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1060 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

12d07d5288e029850a63c183e103edc0bbe2caa7021d2f231bd9cfaf28ad3486.exe

description pid process

Token: SeIncBasePriorityPrivilege 1572 12d07d5288e029850a63c183e103edc0bbe2caa7021d2f231bd9cfaf28ad3486.exe

pid	process
1060	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1572	12d07d5288e029850a63c183e103edc0bbe2caa7021d2f231bd9cfaf28ad3486.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

12d07d5288e029850a63c183e103edc0bbe2caa7021d2f231bd9cfaf28ad3486.execmd.exe

description	pid	process	target process
PID 1572 wrote to memory of 1516	1572	12d07d5288e029850a63c183e103edc0bbe2caa7021d2f231bd9cfaf28ad3486.exe	MediaCenter.exe
PID 1572 wrote to memory of 1516	1572	12d07d5288e029850a63c183e103edc0bbe2caa7021d2f231bd9cfaf28ad3486.exe	MediaCenter.exe
PID 1572 wrote to memory of 1516	1572	12d07d5288e029850a63c183e103edc0bbe2caa7021d2f231bd9cfaf28ad3486.exe	MediaCenter.exe
PID 1572 wrote to memory of 1516	1572	12d07d5288e029850a63c183e103edc0bbe2caa7021d2f231bd9cfaf28ad3486.exe	MediaCenter.exe
PID 1572 wrote to memory of 804	1572	12d07d5288e029850a63c183e103edc0bbe2caa7021d2f231bd9cfaf28ad3486.exe	cmd.exe
PID 1572 wrote to memory of 804	1572	12d07d5288e029850a63c183e103edc0bbe2caa7021d2f231bd9cfaf28ad3486.exe	cmd.exe
PID 1572 wrote to memory of 804	1572	12d07d5288e029850a63c183e103edc0bbe2caa7021d2f231bd9cfaf28ad3486.exe	cmd.exe
PID 1572 wrote to memory of 804	1572	12d07d5288e029850a63c183e103edc0bbe2caa7021d2f231bd9cfaf28ad3486.exe	cmd.exe
PID 804 wrote to memory of 1060	804	cmd.exe	PING.EXE
PID 804 wrote to memory of 1060	804	cmd.exe	PING.EXE
PID 804 wrote to memory of 1060	804	cmd.exe	PING.EXE
PID 804 wrote to memory of 1060	804	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\12d07d5288e029850a63c183e103edc0bbe2caa7021d2f231bd9cfaf28ad3486.exe
"C:\Users\Admin\AppData\Local\Temp\12d07d5288e029850a63c183e103edc0bbe2caa7021d2f231bd9cfaf28ad3486.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1572

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1516

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\12d07d5288e029850a63c183e103edc0bbe2caa7021d2f231bd9cfaf28ad3486.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:804

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1060

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
1c96f063665a4027a45f3695fe071a54

SHA1
8011ae148fcbb24cea7d18c7568bb3a9c059c1ca

SHA256
04432b1a15573ac9ba1d8c97b1968556074e3288be3dc7869548f57dd0073945

SHA512
5d87461d4ad3eeb1daddb273b1a868d4d0a9497089ee125a84afa3bcf2c6f13fc82b97457b750f76ff21a08595f5dc6128ffd9230127a91cd8b940dd2bfde281

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
1c96f063665a4027a45f3695fe071a54

SHA1
8011ae148fcbb24cea7d18c7568bb3a9c059c1ca

SHA256
04432b1a15573ac9ba1d8c97b1968556074e3288be3dc7869548f57dd0073945

SHA512
5d87461d4ad3eeb1daddb273b1a868d4d0a9497089ee125a84afa3bcf2c6f13fc82b97457b750f76ff21a08595f5dc6128ffd9230127a91cd8b940dd2bfde281

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
1c96f063665a4027a45f3695fe071a54

SHA1
8011ae148fcbb24cea7d18c7568bb3a9c059c1ca

SHA256
04432b1a15573ac9ba1d8c97b1968556074e3288be3dc7869548f57dd0073945

SHA512
5d87461d4ad3eeb1daddb273b1a868d4d0a9497089ee125a84afa3bcf2c6f13fc82b97457b750f76ff21a08595f5dc6128ffd9230127a91cd8b940dd2bfde281

Download Submit
memory/1572-55-0x0000000075AB1000-0x0000000075AB3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads