sakula | 127cd87e642cfcb6123d5be8724e91312d61dbfef809fb1aaf9cdd861625e655

General

Target

127cd87e642cfcb6123d5be8724e91312d61dbfef809fb1aaf9cdd861625e655.exe
Size

58KB
MD5

6d36510f1b6aebfd39071560defdca4e
SHA1

b4fab4ecd6907bb18af4d2fd52d62d4444bf17f1
SHA256

127cd87e642cfcb6123d5be8724e91312d61dbfef809fb1aaf9cdd861625e655
SHA512

0170d76ee540b931ceed9cef89752c6c954e872116e96b2d21c4c606e519e4897fa864561c4a9bbdbab35e2b4c66e64b0faa3f0fb67c53eac41a45f459a0fc38

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1224 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

396 cmd.exe

pid	process
1224	MediaCenter.exe

pid	process
396	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

127cd87e642cfcb6123d5be8724e91312d61dbfef809fb1aaf9cdd861625e655.exe

pid	process
1892	127cd87e642cfcb6123d5be8724e91312d61dbfef809fb1aaf9cdd861625e655.exe
1892	127cd87e642cfcb6123d5be8724e91312d61dbfef809fb1aaf9cdd861625e655.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

127cd87e642cfcb6123d5be8724e91312d61dbfef809fb1aaf9cdd861625e655.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	127cd87e642cfcb6123d5be8724e91312d61dbfef809fb1aaf9cdd861625e655.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1088 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

127cd87e642cfcb6123d5be8724e91312d61dbfef809fb1aaf9cdd861625e655.exe

description pid process

Token: SeIncBasePriorityPrivilege 1892 127cd87e642cfcb6123d5be8724e91312d61dbfef809fb1aaf9cdd861625e655.exe

pid	process
1088	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1892	127cd87e642cfcb6123d5be8724e91312d61dbfef809fb1aaf9cdd861625e655.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

127cd87e642cfcb6123d5be8724e91312d61dbfef809fb1aaf9cdd861625e655.execmd.exe

description	pid	process	target process
PID 1892 wrote to memory of 1224	1892	127cd87e642cfcb6123d5be8724e91312d61dbfef809fb1aaf9cdd861625e655.exe	MediaCenter.exe
PID 1892 wrote to memory of 1224	1892	127cd87e642cfcb6123d5be8724e91312d61dbfef809fb1aaf9cdd861625e655.exe	MediaCenter.exe
PID 1892 wrote to memory of 1224	1892	127cd87e642cfcb6123d5be8724e91312d61dbfef809fb1aaf9cdd861625e655.exe	MediaCenter.exe
PID 1892 wrote to memory of 1224	1892	127cd87e642cfcb6123d5be8724e91312d61dbfef809fb1aaf9cdd861625e655.exe	MediaCenter.exe
PID 1892 wrote to memory of 396	1892	127cd87e642cfcb6123d5be8724e91312d61dbfef809fb1aaf9cdd861625e655.exe	cmd.exe
PID 1892 wrote to memory of 396	1892	127cd87e642cfcb6123d5be8724e91312d61dbfef809fb1aaf9cdd861625e655.exe	cmd.exe
PID 1892 wrote to memory of 396	1892	127cd87e642cfcb6123d5be8724e91312d61dbfef809fb1aaf9cdd861625e655.exe	cmd.exe
PID 1892 wrote to memory of 396	1892	127cd87e642cfcb6123d5be8724e91312d61dbfef809fb1aaf9cdd861625e655.exe	cmd.exe
PID 396 wrote to memory of 1088	396	cmd.exe	PING.EXE
PID 396 wrote to memory of 1088	396	cmd.exe	PING.EXE
PID 396 wrote to memory of 1088	396	cmd.exe	PING.EXE
PID 396 wrote to memory of 1088	396	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\127cd87e642cfcb6123d5be8724e91312d61dbfef809fb1aaf9cdd861625e655.exe
"C:\Users\Admin\AppData\Local\Temp\127cd87e642cfcb6123d5be8724e91312d61dbfef809fb1aaf9cdd861625e655.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1892

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1224

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\127cd87e642cfcb6123d5be8724e91312d61dbfef809fb1aaf9cdd861625e655.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:396

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1088

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
7d082e60913e41c91d3fcdaaf006964b

SHA1
430024eb18613ddb68d456d3d5b91f54860acf33

SHA256
36feffc674b12d9e32eb4dd962c65776c7d23777652e215a9a3989fd71f85d4b

SHA512
2aa4f12ea6e8033a786b91ab296ee4d3936a40e0aea04c54f792daaab96e207d6bb3aa65f7ef0117473c3bd40da20f2cc8f7a3d78545db0c14fa8cba921b3426

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
7d082e60913e41c91d3fcdaaf006964b

SHA1
430024eb18613ddb68d456d3d5b91f54860acf33

SHA256
36feffc674b12d9e32eb4dd962c65776c7d23777652e215a9a3989fd71f85d4b

SHA512
2aa4f12ea6e8033a786b91ab296ee4d3936a40e0aea04c54f792daaab96e207d6bb3aa65f7ef0117473c3bd40da20f2cc8f7a3d78545db0c14fa8cba921b3426

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
7d082e60913e41c91d3fcdaaf006964b

SHA1
430024eb18613ddb68d456d3d5b91f54860acf33

SHA256
36feffc674b12d9e32eb4dd962c65776c7d23777652e215a9a3989fd71f85d4b

SHA512
2aa4f12ea6e8033a786b91ab296ee4d3936a40e0aea04c54f792daaab96e207d6bb3aa65f7ef0117473c3bd40da20f2cc8f7a3d78545db0c14fa8cba921b3426

Download Submit
memory/1892-54-0x0000000076071000-0x0000000076073000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads