sakula | 137ce83e0c77d4b811446aa6193cae1725997ac39813ae380c726feafd64138c

General

Target

137ce83e0c77d4b811446aa6193cae1725997ac39813ae380c726feafd64138c.exe
Size

58KB
MD5

1c98b2119d6686b06c3c3b2c7150fd80
SHA1

72c201d5008057bc6f823e07823be9432ffdff73
SHA256

137ce83e0c77d4b811446aa6193cae1725997ac39813ae380c726feafd64138c
SHA512

259c6ee34426136480bfde6cf102f69fea711cb521b3e5a75b4d455a17e9422824f8ce4af10d352eee1568a61a7561f5434b98457a00a4cfa4cf66c8bc8a5b00

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1472 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

768 cmd.exe

pid	process
1472	MediaCenter.exe

pid	process
768	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

137ce83e0c77d4b811446aa6193cae1725997ac39813ae380c726feafd64138c.exe

pid	process
1396	137ce83e0c77d4b811446aa6193cae1725997ac39813ae380c726feafd64138c.exe
1396	137ce83e0c77d4b811446aa6193cae1725997ac39813ae380c726feafd64138c.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

137ce83e0c77d4b811446aa6193cae1725997ac39813ae380c726feafd64138c.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	137ce83e0c77d4b811446aa6193cae1725997ac39813ae380c726feafd64138c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1168 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

137ce83e0c77d4b811446aa6193cae1725997ac39813ae380c726feafd64138c.exe

description pid process

Token: SeIncBasePriorityPrivilege 1396 137ce83e0c77d4b811446aa6193cae1725997ac39813ae380c726feafd64138c.exe

pid	process
1168	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1396	137ce83e0c77d4b811446aa6193cae1725997ac39813ae380c726feafd64138c.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

137ce83e0c77d4b811446aa6193cae1725997ac39813ae380c726feafd64138c.execmd.exe

description	pid	process	target process
PID 1396 wrote to memory of 1472	1396	137ce83e0c77d4b811446aa6193cae1725997ac39813ae380c726feafd64138c.exe	MediaCenter.exe
PID 1396 wrote to memory of 1472	1396	137ce83e0c77d4b811446aa6193cae1725997ac39813ae380c726feafd64138c.exe	MediaCenter.exe
PID 1396 wrote to memory of 1472	1396	137ce83e0c77d4b811446aa6193cae1725997ac39813ae380c726feafd64138c.exe	MediaCenter.exe
PID 1396 wrote to memory of 1472	1396	137ce83e0c77d4b811446aa6193cae1725997ac39813ae380c726feafd64138c.exe	MediaCenter.exe
PID 1396 wrote to memory of 768	1396	137ce83e0c77d4b811446aa6193cae1725997ac39813ae380c726feafd64138c.exe	cmd.exe
PID 1396 wrote to memory of 768	1396	137ce83e0c77d4b811446aa6193cae1725997ac39813ae380c726feafd64138c.exe	cmd.exe
PID 1396 wrote to memory of 768	1396	137ce83e0c77d4b811446aa6193cae1725997ac39813ae380c726feafd64138c.exe	cmd.exe
PID 1396 wrote to memory of 768	1396	137ce83e0c77d4b811446aa6193cae1725997ac39813ae380c726feafd64138c.exe	cmd.exe
PID 768 wrote to memory of 1168	768	cmd.exe	PING.EXE
PID 768 wrote to memory of 1168	768	cmd.exe	PING.EXE
PID 768 wrote to memory of 1168	768	cmd.exe	PING.EXE
PID 768 wrote to memory of 1168	768	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\137ce83e0c77d4b811446aa6193cae1725997ac39813ae380c726feafd64138c.exe
"C:\Users\Admin\AppData\Local\Temp\137ce83e0c77d4b811446aa6193cae1725997ac39813ae380c726feafd64138c.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1396

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1472

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\137ce83e0c77d4b811446aa6193cae1725997ac39813ae380c726feafd64138c.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:768

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1168

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
cf79eb1b04930b2545af7768f21565e9

SHA1
1de3867b0e73d9f34422fa3578b5ab9e89b655ea

SHA256
cc3dec5cd0271206e82ec89cc2a6463b2e62538ba0db026a546c330f65aa95b4

SHA512
756261714069041e9bf770bd56b4c11860770f60a1355c75860db1ecab0fa40544e6d369df32542c7df18243c39d58a20c67575fd9e7487d193d823ca157ca3c

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
cf79eb1b04930b2545af7768f21565e9

SHA1
1de3867b0e73d9f34422fa3578b5ab9e89b655ea

SHA256
cc3dec5cd0271206e82ec89cc2a6463b2e62538ba0db026a546c330f65aa95b4

SHA512
756261714069041e9bf770bd56b4c11860770f60a1355c75860db1ecab0fa40544e6d369df32542c7df18243c39d58a20c67575fd9e7487d193d823ca157ca3c

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
cf79eb1b04930b2545af7768f21565e9

SHA1
1de3867b0e73d9f34422fa3578b5ab9e89b655ea

SHA256
cc3dec5cd0271206e82ec89cc2a6463b2e62538ba0db026a546c330f65aa95b4

SHA512
756261714069041e9bf770bd56b4c11860770f60a1355c75860db1ecab0fa40544e6d369df32542c7df18243c39d58a20c67575fd9e7487d193d823ca157ca3c

Download Submit
memory/1396-54-0x0000000075D61000-0x0000000075D63000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads