sakula | 132c2f8fc5d13fbd57400e14198026b7c1c2cd55def5d9b97f88bc548f6b38f6

General

Target

132c2f8fc5d13fbd57400e14198026b7c1c2cd55def5d9b97f88bc548f6b38f6.exe
Size

80KB
MD5

2c30ce9f33f96febaf1d3edc4635cacb
SHA1

b260f4ed4fa844a1a945bb5eb5a5c8ed883e02e8
SHA256

132c2f8fc5d13fbd57400e14198026b7c1c2cd55def5d9b97f88bc548f6b38f6
SHA512

406cf3bd4830fa8b75b7d95516d605dc0b0f385b77e781b066ec7543f3104c6ab4f2511fb8568f9e2b0ef96d9c562dbacea3d1bf080fd21c93a8bbb27a300558

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula Payload 3 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula

Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1588 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1096 cmd.exe

pid	process
1588	MediaCenter.exe

pid	process
1096	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

132c2f8fc5d13fbd57400e14198026b7c1c2cd55def5d9b97f88bc548f6b38f6.exe

pid	process
1568	132c2f8fc5d13fbd57400e14198026b7c1c2cd55def5d9b97f88bc548f6b38f6.exe
1568	132c2f8fc5d13fbd57400e14198026b7c1c2cd55def5d9b97f88bc548f6b38f6.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

132c2f8fc5d13fbd57400e14198026b7c1c2cd55def5d9b97f88bc548f6b38f6.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	132c2f8fc5d13fbd57400e14198026b7c1c2cd55def5d9b97f88bc548f6b38f6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1540 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

132c2f8fc5d13fbd57400e14198026b7c1c2cd55def5d9b97f88bc548f6b38f6.exe

description pid process

Token: SeIncBasePriorityPrivilege 1568 132c2f8fc5d13fbd57400e14198026b7c1c2cd55def5d9b97f88bc548f6b38f6.exe

pid	process
1540	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1568	132c2f8fc5d13fbd57400e14198026b7c1c2cd55def5d9b97f88bc548f6b38f6.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

132c2f8fc5d13fbd57400e14198026b7c1c2cd55def5d9b97f88bc548f6b38f6.execmd.exe

description	pid	process	target process
PID 1568 wrote to memory of 1588	1568	132c2f8fc5d13fbd57400e14198026b7c1c2cd55def5d9b97f88bc548f6b38f6.exe	MediaCenter.exe
PID 1568 wrote to memory of 1588	1568	132c2f8fc5d13fbd57400e14198026b7c1c2cd55def5d9b97f88bc548f6b38f6.exe	MediaCenter.exe
PID 1568 wrote to memory of 1588	1568	132c2f8fc5d13fbd57400e14198026b7c1c2cd55def5d9b97f88bc548f6b38f6.exe	MediaCenter.exe
PID 1568 wrote to memory of 1588	1568	132c2f8fc5d13fbd57400e14198026b7c1c2cd55def5d9b97f88bc548f6b38f6.exe	MediaCenter.exe
PID 1568 wrote to memory of 1096	1568	132c2f8fc5d13fbd57400e14198026b7c1c2cd55def5d9b97f88bc548f6b38f6.exe	cmd.exe
PID 1568 wrote to memory of 1096	1568	132c2f8fc5d13fbd57400e14198026b7c1c2cd55def5d9b97f88bc548f6b38f6.exe	cmd.exe
PID 1568 wrote to memory of 1096	1568	132c2f8fc5d13fbd57400e14198026b7c1c2cd55def5d9b97f88bc548f6b38f6.exe	cmd.exe
PID 1568 wrote to memory of 1096	1568	132c2f8fc5d13fbd57400e14198026b7c1c2cd55def5d9b97f88bc548f6b38f6.exe	cmd.exe
PID 1096 wrote to memory of 1540	1096	cmd.exe	PING.EXE
PID 1096 wrote to memory of 1540	1096	cmd.exe	PING.EXE
PID 1096 wrote to memory of 1540	1096	cmd.exe	PING.EXE
PID 1096 wrote to memory of 1540	1096	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\132c2f8fc5d13fbd57400e14198026b7c1c2cd55def5d9b97f88bc548f6b38f6.exe
"C:\Users\Admin\AppData\Local\Temp\132c2f8fc5d13fbd57400e14198026b7c1c2cd55def5d9b97f88bc548f6b38f6.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1568

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1588

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\132c2f8fc5d13fbd57400e14198026b7c1c2cd55def5d9b97f88bc548f6b38f6.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1096

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1540

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
4484ec6a4a7d18057871409da8f20a8a

SHA1
f2223da7c3500dcccae16a63658d03041a988868

SHA256
37a767c7f7c1ae68e51c3e2c3dc4233c2cce00546993897a2acf1c8d9f110e24

SHA512
1f69dd351d6a95e2cd1e6ecb830c880def1b7ef4fafc3fa81acbac8b2b57502cbb66d625656fb22cc06231121df7b99caed0f0d394e4f4d7278bce38e79b6350

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
4484ec6a4a7d18057871409da8f20a8a

SHA1
f2223da7c3500dcccae16a63658d03041a988868

SHA256
37a767c7f7c1ae68e51c3e2c3dc4233c2cce00546993897a2acf1c8d9f110e24

SHA512
1f69dd351d6a95e2cd1e6ecb830c880def1b7ef4fafc3fa81acbac8b2b57502cbb66d625656fb22cc06231121df7b99caed0f0d394e4f4d7278bce38e79b6350

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
4484ec6a4a7d18057871409da8f20a8a

SHA1
f2223da7c3500dcccae16a63658d03041a988868

SHA256
37a767c7f7c1ae68e51c3e2c3dc4233c2cce00546993897a2acf1c8d9f110e24

SHA512
1f69dd351d6a95e2cd1e6ecb830c880def1b7ef4fafc3fa81acbac8b2b57502cbb66d625656fb22cc06231121df7b99caed0f0d394e4f4d7278bce38e79b6350

Download Submit
memory/1568-55-0x0000000076371000-0x0000000076373000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads