sakula | 1048a0974f87b6801905be2b25b700345c0b2f3c14c47762ea64a66506a9f6e7

General

Target

1048a0974f87b6801905be2b25b700345c0b2f3c14c47762ea64a66506a9f6e7.exe
Size

60KB
MD5

04f5f791aa6a7c7d14ed92f4a08fc6b9
SHA1

daeb8bf97356afa1760000e6f2700a9c20d1985e
SHA256

1048a0974f87b6801905be2b25b700345c0b2f3c14c47762ea64a66506a9f6e7
SHA512

cd6ffbf18cc011c5064ec9e0c023b986b8687e8d7996a6cb1ae6c8786d086e184119d51b995f51e4b534feec0cdb1ed9d2211c6b4412242053da0c5c904a5fa1

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1616 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1156 cmd.exe

pid	process
1616	MediaCenter.exe

pid	process
1156	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

1048a0974f87b6801905be2b25b700345c0b2f3c14c47762ea64a66506a9f6e7.exe

pid	process
820	1048a0974f87b6801905be2b25b700345c0b2f3c14c47762ea64a66506a9f6e7.exe
820	1048a0974f87b6801905be2b25b700345c0b2f3c14c47762ea64a66506a9f6e7.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

1048a0974f87b6801905be2b25b700345c0b2f3c14c47762ea64a66506a9f6e7.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	1048a0974f87b6801905be2b25b700345c0b2f3c14c47762ea64a66506a9f6e7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1056 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

1048a0974f87b6801905be2b25b700345c0b2f3c14c47762ea64a66506a9f6e7.exe

description pid process

Token: SeIncBasePriorityPrivilege 820 1048a0974f87b6801905be2b25b700345c0b2f3c14c47762ea64a66506a9f6e7.exe

pid	process
1056	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	820	1048a0974f87b6801905be2b25b700345c0b2f3c14c47762ea64a66506a9f6e7.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

1048a0974f87b6801905be2b25b700345c0b2f3c14c47762ea64a66506a9f6e7.execmd.exe

description	pid	process	target process
PID 820 wrote to memory of 1616	820	1048a0974f87b6801905be2b25b700345c0b2f3c14c47762ea64a66506a9f6e7.exe	MediaCenter.exe
PID 820 wrote to memory of 1616	820	1048a0974f87b6801905be2b25b700345c0b2f3c14c47762ea64a66506a9f6e7.exe	MediaCenter.exe
PID 820 wrote to memory of 1616	820	1048a0974f87b6801905be2b25b700345c0b2f3c14c47762ea64a66506a9f6e7.exe	MediaCenter.exe
PID 820 wrote to memory of 1616	820	1048a0974f87b6801905be2b25b700345c0b2f3c14c47762ea64a66506a9f6e7.exe	MediaCenter.exe
PID 820 wrote to memory of 1156	820	1048a0974f87b6801905be2b25b700345c0b2f3c14c47762ea64a66506a9f6e7.exe	cmd.exe
PID 820 wrote to memory of 1156	820	1048a0974f87b6801905be2b25b700345c0b2f3c14c47762ea64a66506a9f6e7.exe	cmd.exe
PID 820 wrote to memory of 1156	820	1048a0974f87b6801905be2b25b700345c0b2f3c14c47762ea64a66506a9f6e7.exe	cmd.exe
PID 820 wrote to memory of 1156	820	1048a0974f87b6801905be2b25b700345c0b2f3c14c47762ea64a66506a9f6e7.exe	cmd.exe
PID 1156 wrote to memory of 1056	1156	cmd.exe	PING.EXE
PID 1156 wrote to memory of 1056	1156	cmd.exe	PING.EXE
PID 1156 wrote to memory of 1056	1156	cmd.exe	PING.EXE
PID 1156 wrote to memory of 1056	1156	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\1048a0974f87b6801905be2b25b700345c0b2f3c14c47762ea64a66506a9f6e7.exe
"C:\Users\Admin\AppData\Local\Temp\1048a0974f87b6801905be2b25b700345c0b2f3c14c47762ea64a66506a9f6e7.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:820

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1616

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\1048a0974f87b6801905be2b25b700345c0b2f3c14c47762ea64a66506a9f6e7.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1156

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1056

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
869a4d432976c00c06da281232e03ad3

SHA1
f7f56102253b80a52ba9cd4cd11e21293b0956b0

SHA256
5481551c27c5c9e87b4e8a94405d0085a883cdab318d31801dbad13c940eee2d

SHA512
215d22545c8c435feb965c441ac6dab2ffe729e1cd58eb6401ae87ea433b15c7c524d4f74b71f4d5c7d67fb3813301a7c11a0f289b2615cf0055d420a1f7e673

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
869a4d432976c00c06da281232e03ad3

SHA1
f7f56102253b80a52ba9cd4cd11e21293b0956b0

SHA256
5481551c27c5c9e87b4e8a94405d0085a883cdab318d31801dbad13c940eee2d

SHA512
215d22545c8c435feb965c441ac6dab2ffe729e1cd58eb6401ae87ea433b15c7c524d4f74b71f4d5c7d67fb3813301a7c11a0f289b2615cf0055d420a1f7e673

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
869a4d432976c00c06da281232e03ad3

SHA1
f7f56102253b80a52ba9cd4cd11e21293b0956b0

SHA256
5481551c27c5c9e87b4e8a94405d0085a883cdab318d31801dbad13c940eee2d

SHA512
215d22545c8c435feb965c441ac6dab2ffe729e1cd58eb6401ae87ea433b15c7c524d4f74b71f4d5c7d67fb3813301a7c11a0f289b2615cf0055d420a1f7e673

Download Submit
memory/820-55-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads