sakula | 13a09fcde654921a56c22c03b66ea91fa0f2624e8d092a850732df71ed4e7564

General

Target

13a09fcde654921a56c22c03b66ea91fa0f2624e8d092a850732df71ed4e7564.exe
Size

35KB
MD5

5191dced48f9ec50433d367582e188d7
SHA1

85580e6428b65cc0506bce899157c0065eac1748
SHA256

13a09fcde654921a56c22c03b66ea91fa0f2624e8d092a850732df71ed4e7564
SHA512

d8f4906ebd82a6bbe3b8912d93569ad226b4884ddfee4e86c752f0425c4eae752789eb701dbf1b29c28eff898b9653810228e6f1caf9f0d9d809b84086f42c07

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

764 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

276 cmd.exe

pid	process
764	MediaCenter.exe

pid	process
276	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

13a09fcde654921a56c22c03b66ea91fa0f2624e8d092a850732df71ed4e7564.exe

pid	process
1804	13a09fcde654921a56c22c03b66ea91fa0f2624e8d092a850732df71ed4e7564.exe
1804	13a09fcde654921a56c22c03b66ea91fa0f2624e8d092a850732df71ed4e7564.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

13a09fcde654921a56c22c03b66ea91fa0f2624e8d092a850732df71ed4e7564.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	13a09fcde654921a56c22c03b66ea91fa0f2624e8d092a850732df71ed4e7564.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1620 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

13a09fcde654921a56c22c03b66ea91fa0f2624e8d092a850732df71ed4e7564.exe

description pid process

Token: SeIncBasePriorityPrivilege 1804 13a09fcde654921a56c22c03b66ea91fa0f2624e8d092a850732df71ed4e7564.exe

pid	process
1620	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1804	13a09fcde654921a56c22c03b66ea91fa0f2624e8d092a850732df71ed4e7564.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

13a09fcde654921a56c22c03b66ea91fa0f2624e8d092a850732df71ed4e7564.execmd.exe

description	pid	process	target process
PID 1804 wrote to memory of 764	1804	13a09fcde654921a56c22c03b66ea91fa0f2624e8d092a850732df71ed4e7564.exe	MediaCenter.exe
PID 1804 wrote to memory of 764	1804	13a09fcde654921a56c22c03b66ea91fa0f2624e8d092a850732df71ed4e7564.exe	MediaCenter.exe
PID 1804 wrote to memory of 764	1804	13a09fcde654921a56c22c03b66ea91fa0f2624e8d092a850732df71ed4e7564.exe	MediaCenter.exe
PID 1804 wrote to memory of 764	1804	13a09fcde654921a56c22c03b66ea91fa0f2624e8d092a850732df71ed4e7564.exe	MediaCenter.exe
PID 1804 wrote to memory of 276	1804	13a09fcde654921a56c22c03b66ea91fa0f2624e8d092a850732df71ed4e7564.exe	cmd.exe
PID 1804 wrote to memory of 276	1804	13a09fcde654921a56c22c03b66ea91fa0f2624e8d092a850732df71ed4e7564.exe	cmd.exe
PID 1804 wrote to memory of 276	1804	13a09fcde654921a56c22c03b66ea91fa0f2624e8d092a850732df71ed4e7564.exe	cmd.exe
PID 1804 wrote to memory of 276	1804	13a09fcde654921a56c22c03b66ea91fa0f2624e8d092a850732df71ed4e7564.exe	cmd.exe
PID 276 wrote to memory of 1620	276	cmd.exe	PING.EXE
PID 276 wrote to memory of 1620	276	cmd.exe	PING.EXE
PID 276 wrote to memory of 1620	276	cmd.exe	PING.EXE
PID 276 wrote to memory of 1620	276	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\13a09fcde654921a56c22c03b66ea91fa0f2624e8d092a850732df71ed4e7564.exe
"C:\Users\Admin\AppData\Local\Temp\13a09fcde654921a56c22c03b66ea91fa0f2624e8d092a850732df71ed4e7564.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1804

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:764

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\13a09fcde654921a56c22c03b66ea91fa0f2624e8d092a850732df71ed4e7564.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:276

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1620

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
d030cddd843c7dcd34f1e1ee2a4810bb

SHA1
b7b5264d74a40876e0da3f016ab75737a69c3c55

SHA256
aa074420f55d92fd563f54de8a50ada14e2867526c7ad14683feece5d78a45c5

SHA512
be68d195c50cb86156889954e1a25aa143f022aee1bb777dd0eee2a85072ea412cb7a3c86d381223a104a2de62ba1af58661428f447a6fe53f6d99d178db7573

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
d030cddd843c7dcd34f1e1ee2a4810bb

SHA1
b7b5264d74a40876e0da3f016ab75737a69c3c55

SHA256
aa074420f55d92fd563f54de8a50ada14e2867526c7ad14683feece5d78a45c5

SHA512
be68d195c50cb86156889954e1a25aa143f022aee1bb777dd0eee2a85072ea412cb7a3c86d381223a104a2de62ba1af58661428f447a6fe53f6d99d178db7573

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
d030cddd843c7dcd34f1e1ee2a4810bb

SHA1
b7b5264d74a40876e0da3f016ab75737a69c3c55

SHA256
aa074420f55d92fd563f54de8a50ada14e2867526c7ad14683feece5d78a45c5

SHA512
be68d195c50cb86156889954e1a25aa143f022aee1bb777dd0eee2a85072ea412cb7a3c86d381223a104a2de62ba1af58661428f447a6fe53f6d99d178db7573

Download Submit
memory/1804-55-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads