sakula | 137a0d9894a29d49b94224e22c5cca31808d08739e3bfed7cd67417404044e07

General

Target
137a0d9894a29d49b94224e22c5cca31808d08739e3bfed7cd67417404044e07.exe
Size 58KB
Sample220212-ft23ashhfp
SHA256 137a0d9894a29d49b94224e22c5cca31808d08739e3bfed7cd67417404044e07
MD5 919dabcbb17007661daf0ee628b56118
SHA1 ef6740035b2f42892b79a36fa39db4a2091c7b58
SHA512 537c132d6a9d7de861793616b119da3c7728fc7e8020e0afe9c5e22aa1768e5b5539cf8f8b386bc08028189f3b79c2d2d07af41d2e77bc70601dd4e1801fcc2a
MD5 SHA1 SHA512

Score

10^/10

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Executes dropped EXE 1 IoCs

pid	Process
792	MediaCenter.exe

Deletes itself 1 IoCs

pid	Process
932	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
1672	137a0d9894a29d49b94224e22c5cca31808d08739e3bfed7cd67417404044e07.exe
1672	137a0d9894a29d49b94224e22c5cca31808d08739e3bfed7cd67417404044e07.exe

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	137a0d9894a29d49b94224e22c5cca31808d08739e3bfed7cd67417404044e07.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
1980	PING.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1672	137a0d9894a29d49b94224e22c5cca31808d08739e3bfed7cd67417404044e07.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 792	1672	137a0d9894a29d49b94224e22c5cca31808d08739e3bfed7cd67417404044e07.exe	27
PID 1672 wrote to memory of 792	1672	137a0d9894a29d49b94224e22c5cca31808d08739e3bfed7cd67417404044e07.exe	27
PID 1672 wrote to memory of 792	1672	137a0d9894a29d49b94224e22c5cca31808d08739e3bfed7cd67417404044e07.exe	27
PID 1672 wrote to memory of 792	1672	137a0d9894a29d49b94224e22c5cca31808d08739e3bfed7cd67417404044e07.exe	27
PID 1672 wrote to memory of 932	1672	137a0d9894a29d49b94224e22c5cca31808d08739e3bfed7cd67417404044e07.exe	30
PID 1672 wrote to memory of 932	1672	137a0d9894a29d49b94224e22c5cca31808d08739e3bfed7cd67417404044e07.exe	30
PID 1672 wrote to memory of 932	1672	137a0d9894a29d49b94224e22c5cca31808d08739e3bfed7cd67417404044e07.exe	30
PID 1672 wrote to memory of 932	1672	137a0d9894a29d49b94224e22c5cca31808d08739e3bfed7cd67417404044e07.exe	30
PID 932 wrote to memory of 1980	932	cmd.exe	32
PID 932 wrote to memory of 1980	932	cmd.exe	32
PID 932 wrote to memory of 1980	932	cmd.exe	32
PID 932 wrote to memory of 1980	932	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\137a0d9894a29d49b94224e22c5cca31808d08739e3bfed7cd67417404044e07.exe
"C:\Users\Admin\AppData\Local\Temp\137a0d9894a29d49b94224e22c5cca31808d08739e3bfed7cd67417404044e07.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
  C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
  2⤵
  - Executes dropped EXE
  PID:792
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\137a0d9894a29d49b94224e22c5cca31808d08739e3bfed7cd67417404044e07.exe"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:932
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1980