sakula | 132b656faccc6306e3c1c057dfca8c3e67e5bd23cc6375eb27949d1d6e2dcff1

General

Target

132b656faccc6306e3c1c057dfca8c3e67e5bd23cc6375eb27949d1d6e2dcff1.exe
Size

60KB
MD5

37119a8b44ea74313e7f543a737c3c5e
SHA1

a6b3e4b5e5553e98ac66dd77858eff5b9535ae1f
SHA256

132b656faccc6306e3c1c057dfca8c3e67e5bd23cc6375eb27949d1d6e2dcff1
SHA512

15758024dcd3736f88fb062e25e55210970acb470c7b63fb144b5ce0048227f02c8259e65e1a41575458c3030e1df06ec488235ab9a61b2a6fd2f4e2d2273171

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1752 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1984 cmd.exe

pid	process
1752	MediaCenter.exe

pid	process
1984	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

132b656faccc6306e3c1c057dfca8c3e67e5bd23cc6375eb27949d1d6e2dcff1.exe

pid	process
952	132b656faccc6306e3c1c057dfca8c3e67e5bd23cc6375eb27949d1d6e2dcff1.exe
952	132b656faccc6306e3c1c057dfca8c3e67e5bd23cc6375eb27949d1d6e2dcff1.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

132b656faccc6306e3c1c057dfca8c3e67e5bd23cc6375eb27949d1d6e2dcff1.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	132b656faccc6306e3c1c057dfca8c3e67e5bd23cc6375eb27949d1d6e2dcff1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1192 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

132b656faccc6306e3c1c057dfca8c3e67e5bd23cc6375eb27949d1d6e2dcff1.exe

description pid process

Token: SeIncBasePriorityPrivilege 952 132b656faccc6306e3c1c057dfca8c3e67e5bd23cc6375eb27949d1d6e2dcff1.exe

pid	process
1192	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	952	132b656faccc6306e3c1c057dfca8c3e67e5bd23cc6375eb27949d1d6e2dcff1.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

132b656faccc6306e3c1c057dfca8c3e67e5bd23cc6375eb27949d1d6e2dcff1.execmd.exe

description	pid	process	target process
PID 952 wrote to memory of 1752	952	132b656faccc6306e3c1c057dfca8c3e67e5bd23cc6375eb27949d1d6e2dcff1.exe	MediaCenter.exe
PID 952 wrote to memory of 1752	952	132b656faccc6306e3c1c057dfca8c3e67e5bd23cc6375eb27949d1d6e2dcff1.exe	MediaCenter.exe
PID 952 wrote to memory of 1752	952	132b656faccc6306e3c1c057dfca8c3e67e5bd23cc6375eb27949d1d6e2dcff1.exe	MediaCenter.exe
PID 952 wrote to memory of 1752	952	132b656faccc6306e3c1c057dfca8c3e67e5bd23cc6375eb27949d1d6e2dcff1.exe	MediaCenter.exe
PID 952 wrote to memory of 1984	952	132b656faccc6306e3c1c057dfca8c3e67e5bd23cc6375eb27949d1d6e2dcff1.exe	cmd.exe
PID 952 wrote to memory of 1984	952	132b656faccc6306e3c1c057dfca8c3e67e5bd23cc6375eb27949d1d6e2dcff1.exe	cmd.exe
PID 952 wrote to memory of 1984	952	132b656faccc6306e3c1c057dfca8c3e67e5bd23cc6375eb27949d1d6e2dcff1.exe	cmd.exe
PID 952 wrote to memory of 1984	952	132b656faccc6306e3c1c057dfca8c3e67e5bd23cc6375eb27949d1d6e2dcff1.exe	cmd.exe
PID 1984 wrote to memory of 1192	1984	cmd.exe	PING.EXE
PID 1984 wrote to memory of 1192	1984	cmd.exe	PING.EXE
PID 1984 wrote to memory of 1192	1984	cmd.exe	PING.EXE
PID 1984 wrote to memory of 1192	1984	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\132b656faccc6306e3c1c057dfca8c3e67e5bd23cc6375eb27949d1d6e2dcff1.exe
"C:\Users\Admin\AppData\Local\Temp\132b656faccc6306e3c1c057dfca8c3e67e5bd23cc6375eb27949d1d6e2dcff1.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:952

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1752

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\132b656faccc6306e3c1c057dfca8c3e67e5bd23cc6375eb27949d1d6e2dcff1.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1984

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1192

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
5555bc6d40fcf486eaa05a1ef2138306

SHA1
5f14b685fe48c40986df1575a582136736cacb14

SHA256
4708dbaa8d6a5d97ff8526ccb2aef32645d57500433489e64a6ceb1a624e1151

SHA512
367fe0955eb830bfa59362e17dfb68a66cd746007b3b9040c4dae6445a21941dea6b9c490814d2234290582daf8775a620452c5184c5b4b6a52b12169cf2895c

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
5555bc6d40fcf486eaa05a1ef2138306

SHA1
5f14b685fe48c40986df1575a582136736cacb14

SHA256
4708dbaa8d6a5d97ff8526ccb2aef32645d57500433489e64a6ceb1a624e1151

SHA512
367fe0955eb830bfa59362e17dfb68a66cd746007b3b9040c4dae6445a21941dea6b9c490814d2234290582daf8775a620452c5184c5b4b6a52b12169cf2895c

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
5555bc6d40fcf486eaa05a1ef2138306

SHA1
5f14b685fe48c40986df1575a582136736cacb14

SHA256
4708dbaa8d6a5d97ff8526ccb2aef32645d57500433489e64a6ceb1a624e1151

SHA512
367fe0955eb830bfa59362e17dfb68a66cd746007b3b9040c4dae6445a21941dea6b9c490814d2234290582daf8775a620452c5184c5b4b6a52b12169cf2895c

Download Submit
memory/952-55-0x0000000076B81000-0x0000000076B83000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads