sakula | 107157cb8a3fa8809e1cd41d2e8ddf840db1c41fb408536a2e1779b708fac67a

General

Target

107157cb8a3fa8809e1cd41d2e8ddf840db1c41fb408536a2e1779b708fac67a.exe
Size

191KB
MD5

cc19d96496d2eab7423d7d17b257252c
SHA1

125fb9164663ca108a493a061e630a759f562d47
SHA256

107157cb8a3fa8809e1cd41d2e8ddf840db1c41fb408536a2e1779b708fac67a
SHA512

0f9db9be57f918e35e10f9987f214b2f382e37ae6b62ae562941fd1ae29a66e9dd9e8504d8a3b59701c5e142d8e4e2f6d92fdacfd7d440514506746df9887a17

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula Payload 3 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula

Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1288 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1032 cmd.exe

pid	process
1288	MediaCenter.exe

pid	process
1032	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

107157cb8a3fa8809e1cd41d2e8ddf840db1c41fb408536a2e1779b708fac67a.exe

pid	process
1468	107157cb8a3fa8809e1cd41d2e8ddf840db1c41fb408536a2e1779b708fac67a.exe
1468	107157cb8a3fa8809e1cd41d2e8ddf840db1c41fb408536a2e1779b708fac67a.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

107157cb8a3fa8809e1cd41d2e8ddf840db1c41fb408536a2e1779b708fac67a.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	107157cb8a3fa8809e1cd41d2e8ddf840db1c41fb408536a2e1779b708fac67a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1328 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

107157cb8a3fa8809e1cd41d2e8ddf840db1c41fb408536a2e1779b708fac67a.exe

description pid process

Token: SeIncBasePriorityPrivilege 1468 107157cb8a3fa8809e1cd41d2e8ddf840db1c41fb408536a2e1779b708fac67a.exe

pid	process
1328	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1468	107157cb8a3fa8809e1cd41d2e8ddf840db1c41fb408536a2e1779b708fac67a.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

107157cb8a3fa8809e1cd41d2e8ddf840db1c41fb408536a2e1779b708fac67a.execmd.exe

description	pid	process	target process
PID 1468 wrote to memory of 1288	1468	107157cb8a3fa8809e1cd41d2e8ddf840db1c41fb408536a2e1779b708fac67a.exe	MediaCenter.exe
PID 1468 wrote to memory of 1288	1468	107157cb8a3fa8809e1cd41d2e8ddf840db1c41fb408536a2e1779b708fac67a.exe	MediaCenter.exe
PID 1468 wrote to memory of 1288	1468	107157cb8a3fa8809e1cd41d2e8ddf840db1c41fb408536a2e1779b708fac67a.exe	MediaCenter.exe
PID 1468 wrote to memory of 1288	1468	107157cb8a3fa8809e1cd41d2e8ddf840db1c41fb408536a2e1779b708fac67a.exe	MediaCenter.exe
PID 1468 wrote to memory of 1032	1468	107157cb8a3fa8809e1cd41d2e8ddf840db1c41fb408536a2e1779b708fac67a.exe	cmd.exe
PID 1468 wrote to memory of 1032	1468	107157cb8a3fa8809e1cd41d2e8ddf840db1c41fb408536a2e1779b708fac67a.exe	cmd.exe
PID 1468 wrote to memory of 1032	1468	107157cb8a3fa8809e1cd41d2e8ddf840db1c41fb408536a2e1779b708fac67a.exe	cmd.exe
PID 1468 wrote to memory of 1032	1468	107157cb8a3fa8809e1cd41d2e8ddf840db1c41fb408536a2e1779b708fac67a.exe	cmd.exe
PID 1032 wrote to memory of 1328	1032	cmd.exe	PING.EXE
PID 1032 wrote to memory of 1328	1032	cmd.exe	PING.EXE
PID 1032 wrote to memory of 1328	1032	cmd.exe	PING.EXE
PID 1032 wrote to memory of 1328	1032	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\107157cb8a3fa8809e1cd41d2e8ddf840db1c41fb408536a2e1779b708fac67a.exe
"C:\Users\Admin\AppData\Local\Temp\107157cb8a3fa8809e1cd41d2e8ddf840db1c41fb408536a2e1779b708fac67a.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1468

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1288

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\107157cb8a3fa8809e1cd41d2e8ddf840db1c41fb408536a2e1779b708fac67a.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1032

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1328

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
0a74b6de5948835dc6313191568942a9

SHA1
75feb00103406f5280cdd722c39ec4899471cb2e

SHA256
1214599ab9f421f06409e82e539f9f826f3e7d88a95a38fa605e1d204b3716cb

SHA512
8afb4572582511df23138d4dab4e280776e4acd33e579dffe59de82af88d5e7a67e72d42aeb3be350aaab17726c04e713478d22fcaaa6679672c4efb8e9bf242

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
0a74b6de5948835dc6313191568942a9

SHA1
75feb00103406f5280cdd722c39ec4899471cb2e

SHA256
1214599ab9f421f06409e82e539f9f826f3e7d88a95a38fa605e1d204b3716cb

SHA512
8afb4572582511df23138d4dab4e280776e4acd33e579dffe59de82af88d5e7a67e72d42aeb3be350aaab17726c04e713478d22fcaaa6679672c4efb8e9bf242

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
0a74b6de5948835dc6313191568942a9

SHA1
75feb00103406f5280cdd722c39ec4899471cb2e

SHA256
1214599ab9f421f06409e82e539f9f826f3e7d88a95a38fa605e1d204b3716cb

SHA512
8afb4572582511df23138d4dab4e280776e4acd33e579dffe59de82af88d5e7a67e72d42aeb3be350aaab17726c04e713478d22fcaaa6679672c4efb8e9bf242

Download Submit
memory/1468-54-0x0000000075B51000-0x0000000075B53000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads