sakula | 1299ae7de370a0bb491fdff4c88eb69aa742ddfb6777db1f1b618155d895f6cd

General

Target

1299ae7de370a0bb491fdff4c88eb69aa742ddfb6777db1f1b618155d895f6cd.exe
Size

35KB
MD5

02728ad0845544fe22cbdabc81df10a2
SHA1

86385293071db358fc219f9eb1cf49ceedde88c9
SHA256

1299ae7de370a0bb491fdff4c88eb69aa742ddfb6777db1f1b618155d895f6cd
SHA512

07b6e9409064539d1934d38a34018b3492770980dccad5c4c902b6c72aae77ebd943c4bf400c8531cea286b4ae49f607fe2ccffb9e1eff94d63d9e84654a433d

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1596 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

796 cmd.exe

pid	process
1596	MediaCenter.exe

pid	process
796	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

1299ae7de370a0bb491fdff4c88eb69aa742ddfb6777db1f1b618155d895f6cd.exe

pid	process
1908	1299ae7de370a0bb491fdff4c88eb69aa742ddfb6777db1f1b618155d895f6cd.exe
1908	1299ae7de370a0bb491fdff4c88eb69aa742ddfb6777db1f1b618155d895f6cd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

1299ae7de370a0bb491fdff4c88eb69aa742ddfb6777db1f1b618155d895f6cd.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	1299ae7de370a0bb491fdff4c88eb69aa742ddfb6777db1f1b618155d895f6cd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1956 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

1299ae7de370a0bb491fdff4c88eb69aa742ddfb6777db1f1b618155d895f6cd.exe

description pid process

Token: SeIncBasePriorityPrivilege 1908 1299ae7de370a0bb491fdff4c88eb69aa742ddfb6777db1f1b618155d895f6cd.exe

pid	process
1956	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1908	1299ae7de370a0bb491fdff4c88eb69aa742ddfb6777db1f1b618155d895f6cd.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

1299ae7de370a0bb491fdff4c88eb69aa742ddfb6777db1f1b618155d895f6cd.execmd.exe

description	pid	process	target process
PID 1908 wrote to memory of 1596	1908	1299ae7de370a0bb491fdff4c88eb69aa742ddfb6777db1f1b618155d895f6cd.exe	MediaCenter.exe
PID 1908 wrote to memory of 1596	1908	1299ae7de370a0bb491fdff4c88eb69aa742ddfb6777db1f1b618155d895f6cd.exe	MediaCenter.exe
PID 1908 wrote to memory of 1596	1908	1299ae7de370a0bb491fdff4c88eb69aa742ddfb6777db1f1b618155d895f6cd.exe	MediaCenter.exe
PID 1908 wrote to memory of 1596	1908	1299ae7de370a0bb491fdff4c88eb69aa742ddfb6777db1f1b618155d895f6cd.exe	MediaCenter.exe
PID 1908 wrote to memory of 796	1908	1299ae7de370a0bb491fdff4c88eb69aa742ddfb6777db1f1b618155d895f6cd.exe	cmd.exe
PID 1908 wrote to memory of 796	1908	1299ae7de370a0bb491fdff4c88eb69aa742ddfb6777db1f1b618155d895f6cd.exe	cmd.exe
PID 1908 wrote to memory of 796	1908	1299ae7de370a0bb491fdff4c88eb69aa742ddfb6777db1f1b618155d895f6cd.exe	cmd.exe
PID 1908 wrote to memory of 796	1908	1299ae7de370a0bb491fdff4c88eb69aa742ddfb6777db1f1b618155d895f6cd.exe	cmd.exe
PID 796 wrote to memory of 1956	796	cmd.exe	PING.EXE
PID 796 wrote to memory of 1956	796	cmd.exe	PING.EXE
PID 796 wrote to memory of 1956	796	cmd.exe	PING.EXE
PID 796 wrote to memory of 1956	796	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\1299ae7de370a0bb491fdff4c88eb69aa742ddfb6777db1f1b618155d895f6cd.exe
"C:\Users\Admin\AppData\Local\Temp\1299ae7de370a0bb491fdff4c88eb69aa742ddfb6777db1f1b618155d895f6cd.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1908

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1596

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\1299ae7de370a0bb491fdff4c88eb69aa742ddfb6777db1f1b618155d895f6cd.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:796

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1956

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
6985e91d9e68d4f1abc9665cfeab8bf1

SHA1
0a53bc19341e33c8dae2882cfab687c1eb950e38

SHA256
b86af5f4b109dd3eb98aa9efe00a3c90f4e77fe6afc1d4b4f305c6a0ea99e62a

SHA512
c10b383f86c2a0fe57c0da3ae3558aa0c6930e4b88de5581d2b389a60668172cc88e1756462d451ea3493f3945a854cfee1a1eb0eac52e67354c3c8ea8302a83

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
6985e91d9e68d4f1abc9665cfeab8bf1

SHA1
0a53bc19341e33c8dae2882cfab687c1eb950e38

SHA256
b86af5f4b109dd3eb98aa9efe00a3c90f4e77fe6afc1d4b4f305c6a0ea99e62a

SHA512
c10b383f86c2a0fe57c0da3ae3558aa0c6930e4b88de5581d2b389a60668172cc88e1756462d451ea3493f3945a854cfee1a1eb0eac52e67354c3c8ea8302a83

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
6985e91d9e68d4f1abc9665cfeab8bf1

SHA1
0a53bc19341e33c8dae2882cfab687c1eb950e38

SHA256
b86af5f4b109dd3eb98aa9efe00a3c90f4e77fe6afc1d4b4f305c6a0ea99e62a

SHA512
c10b383f86c2a0fe57c0da3ae3558aa0c6930e4b88de5581d2b389a60668172cc88e1756462d451ea3493f3945a854cfee1a1eb0eac52e67354c3c8ea8302a83

Download Submit
memory/1908-55-0x0000000076731000-0x0000000076733000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads