sakula | 129c07b7d495251d6695669c84f82243705f1b1ff08731ddf4bce30b8e8515c3

General

Target

129c07b7d495251d6695669c84f82243705f1b1ff08731ddf4bce30b8e8515c3.exe
Size

58KB
MD5

ff755103afad996b30de6e1a9b7a33d0
SHA1

75f93fc4f16706e57ec26dab7ebebbfbe721639f
SHA256

129c07b7d495251d6695669c84f82243705f1b1ff08731ddf4bce30b8e8515c3
SHA512

0e659114f8bac3b6ad436aa0682da98652b5236e594428cb3fd4a2ad23baf1f96912e17d73a738fb71e4491a8dd5da60bfd14e371dffa6515c820c9d158b5426

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1096 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

632 cmd.exe

pid	process
1096	MediaCenter.exe

pid	process
632	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

129c07b7d495251d6695669c84f82243705f1b1ff08731ddf4bce30b8e8515c3.exe

pid	process
840	129c07b7d495251d6695669c84f82243705f1b1ff08731ddf4bce30b8e8515c3.exe
840	129c07b7d495251d6695669c84f82243705f1b1ff08731ddf4bce30b8e8515c3.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

129c07b7d495251d6695669c84f82243705f1b1ff08731ddf4bce30b8e8515c3.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	129c07b7d495251d6695669c84f82243705f1b1ff08731ddf4bce30b8e8515c3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1956 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

129c07b7d495251d6695669c84f82243705f1b1ff08731ddf4bce30b8e8515c3.exe

description pid process

Token: SeIncBasePriorityPrivilege 840 129c07b7d495251d6695669c84f82243705f1b1ff08731ddf4bce30b8e8515c3.exe

pid	process
1956	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	840	129c07b7d495251d6695669c84f82243705f1b1ff08731ddf4bce30b8e8515c3.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

129c07b7d495251d6695669c84f82243705f1b1ff08731ddf4bce30b8e8515c3.execmd.exe

description	pid	process	target process
PID 840 wrote to memory of 1096	840	129c07b7d495251d6695669c84f82243705f1b1ff08731ddf4bce30b8e8515c3.exe	MediaCenter.exe
PID 840 wrote to memory of 1096	840	129c07b7d495251d6695669c84f82243705f1b1ff08731ddf4bce30b8e8515c3.exe	MediaCenter.exe
PID 840 wrote to memory of 1096	840	129c07b7d495251d6695669c84f82243705f1b1ff08731ddf4bce30b8e8515c3.exe	MediaCenter.exe
PID 840 wrote to memory of 1096	840	129c07b7d495251d6695669c84f82243705f1b1ff08731ddf4bce30b8e8515c3.exe	MediaCenter.exe
PID 840 wrote to memory of 632	840	129c07b7d495251d6695669c84f82243705f1b1ff08731ddf4bce30b8e8515c3.exe	cmd.exe
PID 840 wrote to memory of 632	840	129c07b7d495251d6695669c84f82243705f1b1ff08731ddf4bce30b8e8515c3.exe	cmd.exe
PID 840 wrote to memory of 632	840	129c07b7d495251d6695669c84f82243705f1b1ff08731ddf4bce30b8e8515c3.exe	cmd.exe
PID 840 wrote to memory of 632	840	129c07b7d495251d6695669c84f82243705f1b1ff08731ddf4bce30b8e8515c3.exe	cmd.exe
PID 632 wrote to memory of 1956	632	cmd.exe	PING.EXE
PID 632 wrote to memory of 1956	632	cmd.exe	PING.EXE
PID 632 wrote to memory of 1956	632	cmd.exe	PING.EXE
PID 632 wrote to memory of 1956	632	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\129c07b7d495251d6695669c84f82243705f1b1ff08731ddf4bce30b8e8515c3.exe
"C:\Users\Admin\AppData\Local\Temp\129c07b7d495251d6695669c84f82243705f1b1ff08731ddf4bce30b8e8515c3.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:840

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1096

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\129c07b7d495251d6695669c84f82243705f1b1ff08731ddf4bce30b8e8515c3.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:632

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1956

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
24f016e41db0f7572105b0f2651169fb

SHA1
9b8f14228a0e94001faab0bd520477d53e7f9f40

SHA256
b87cb4b199646815a7b52fe31c57014affb84e7a5239f578b3206374b00018da

SHA512
1a03d45049ddcff5ae5ddbfe27a84aa765072a6a246ad950df9582f4c22634469dd32da93cc44a8065283235a33d27bd51fbe3e23d438d89ff139610b9efb661

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
24f016e41db0f7572105b0f2651169fb

SHA1
9b8f14228a0e94001faab0bd520477d53e7f9f40

SHA256
b87cb4b199646815a7b52fe31c57014affb84e7a5239f578b3206374b00018da

SHA512
1a03d45049ddcff5ae5ddbfe27a84aa765072a6a246ad950df9582f4c22634469dd32da93cc44a8065283235a33d27bd51fbe3e23d438d89ff139610b9efb661

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
24f016e41db0f7572105b0f2651169fb

SHA1
9b8f14228a0e94001faab0bd520477d53e7f9f40

SHA256
b87cb4b199646815a7b52fe31c57014affb84e7a5239f578b3206374b00018da

SHA512
1a03d45049ddcff5ae5ddbfe27a84aa765072a6a246ad950df9582f4c22634469dd32da93cc44a8065283235a33d27bd51fbe3e23d438d89ff139610b9efb661

Download Submit
memory/840-54-0x0000000076491000-0x0000000076493000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads