sakula | 102dcd59db57f80c64e544a4d48bb548fd4c840191d9287a1d148901a54b01fe

General

Target

102dcd59db57f80c64e544a4d48bb548fd4c840191d9287a1d148901a54b01fe.exe
Size

35KB
MD5

d4ede4ee7b47d0134bcba66182f04c2a
SHA1

14e7b70de341667d276c3a5253e21b9e3a6b8987
SHA256

102dcd59db57f80c64e544a4d48bb548fd4c840191d9287a1d148901a54b01fe
SHA512

e41f6dc6978fd076c72b4331b7f1e5b5e85b5996bdc3bfa733c78ecf35860b593eb480a19481785612d423d233eb7b1cc4b60e599bd27c675731e1af864ae3a1

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

320 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1968 cmd.exe

pid	process
320	MediaCenter.exe

pid	process
1968	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

102dcd59db57f80c64e544a4d48bb548fd4c840191d9287a1d148901a54b01fe.exe

pid	process
812	102dcd59db57f80c64e544a4d48bb548fd4c840191d9287a1d148901a54b01fe.exe
812	102dcd59db57f80c64e544a4d48bb548fd4c840191d9287a1d148901a54b01fe.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

102dcd59db57f80c64e544a4d48bb548fd4c840191d9287a1d148901a54b01fe.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	102dcd59db57f80c64e544a4d48bb548fd4c840191d9287a1d148901a54b01fe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1068 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

102dcd59db57f80c64e544a4d48bb548fd4c840191d9287a1d148901a54b01fe.exe

description pid process

Token: SeIncBasePriorityPrivilege 812 102dcd59db57f80c64e544a4d48bb548fd4c840191d9287a1d148901a54b01fe.exe

pid	process
1068	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	812	102dcd59db57f80c64e544a4d48bb548fd4c840191d9287a1d148901a54b01fe.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

102dcd59db57f80c64e544a4d48bb548fd4c840191d9287a1d148901a54b01fe.execmd.exe

description	pid	process	target process
PID 812 wrote to memory of 320	812	102dcd59db57f80c64e544a4d48bb548fd4c840191d9287a1d148901a54b01fe.exe	MediaCenter.exe
PID 812 wrote to memory of 320	812	102dcd59db57f80c64e544a4d48bb548fd4c840191d9287a1d148901a54b01fe.exe	MediaCenter.exe
PID 812 wrote to memory of 320	812	102dcd59db57f80c64e544a4d48bb548fd4c840191d9287a1d148901a54b01fe.exe	MediaCenter.exe
PID 812 wrote to memory of 320	812	102dcd59db57f80c64e544a4d48bb548fd4c840191d9287a1d148901a54b01fe.exe	MediaCenter.exe
PID 812 wrote to memory of 1968	812	102dcd59db57f80c64e544a4d48bb548fd4c840191d9287a1d148901a54b01fe.exe	cmd.exe
PID 812 wrote to memory of 1968	812	102dcd59db57f80c64e544a4d48bb548fd4c840191d9287a1d148901a54b01fe.exe	cmd.exe
PID 812 wrote to memory of 1968	812	102dcd59db57f80c64e544a4d48bb548fd4c840191d9287a1d148901a54b01fe.exe	cmd.exe
PID 812 wrote to memory of 1968	812	102dcd59db57f80c64e544a4d48bb548fd4c840191d9287a1d148901a54b01fe.exe	cmd.exe
PID 1968 wrote to memory of 1068	1968	cmd.exe	PING.EXE
PID 1968 wrote to memory of 1068	1968	cmd.exe	PING.EXE
PID 1968 wrote to memory of 1068	1968	cmd.exe	PING.EXE
PID 1968 wrote to memory of 1068	1968	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\102dcd59db57f80c64e544a4d48bb548fd4c840191d9287a1d148901a54b01fe.exe
"C:\Users\Admin\AppData\Local\Temp\102dcd59db57f80c64e544a4d48bb548fd4c840191d9287a1d148901a54b01fe.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:812

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:320

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\102dcd59db57f80c64e544a4d48bb548fd4c840191d9287a1d148901a54b01fe.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1968

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1068

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
14f8998517d57b054d7ee6b1f50d66bb

SHA1
c07b8a4f4bd9c6ef29884b71abecda8fb8c9e30b

SHA256
17f53c52fdb9254634432586c5707c4f3cddec9cc7a08775aecc99484b26c78a

SHA512
79a5065e8b5da95fdf6b41701fd439a40d0af15b9d157e7a0b26119b83752a4bf4f3475a720cd60e86c13eba632f1267e8a2fcf301ff0e213c9d7bb4630561fc

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
14f8998517d57b054d7ee6b1f50d66bb

SHA1
c07b8a4f4bd9c6ef29884b71abecda8fb8c9e30b

SHA256
17f53c52fdb9254634432586c5707c4f3cddec9cc7a08775aecc99484b26c78a

SHA512
79a5065e8b5da95fdf6b41701fd439a40d0af15b9d157e7a0b26119b83752a4bf4f3475a720cd60e86c13eba632f1267e8a2fcf301ff0e213c9d7bb4630561fc

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
14f8998517d57b054d7ee6b1f50d66bb

SHA1
c07b8a4f4bd9c6ef29884b71abecda8fb8c9e30b

SHA256
17f53c52fdb9254634432586c5707c4f3cddec9cc7a08775aecc99484b26c78a

SHA512
79a5065e8b5da95fdf6b41701fd439a40d0af15b9d157e7a0b26119b83752a4bf4f3475a720cd60e86c13eba632f1267e8a2fcf301ff0e213c9d7bb4630561fc

Download Submit
memory/812-55-0x0000000076071000-0x0000000076073000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads