sakula | 0ff3700425c57ee6893c184737a8c5fc1c6e87e8561dd5c25bac7f624cc77451

General

Target

0ff3700425c57ee6893c184737a8c5fc1c6e87e8561dd5c25bac7f624cc77451.exe
Size

192KB
MD5

f43ebf92234cfc4bff92ce147f8821e4
SHA1

e85d06f52cfb168a3af56cf82ddc4fc0b34a4088
SHA256

0ff3700425c57ee6893c184737a8c5fc1c6e87e8561dd5c25bac7f624cc77451
SHA512

0163788e7f1f3f09969b1db756fe2c5a7e105484d0bb92e8426246d8efb0ab902ab6c52e43f8cf24eb1ad1c39c419a09bb9647bc9e8e7e57b0913cae928c2e94

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula Payload 3 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula

Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1604 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1072 cmd.exe

pid	process
1604	MediaCenter.exe

pid	process
1072	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

0ff3700425c57ee6893c184737a8c5fc1c6e87e8561dd5c25bac7f624cc77451.exe

pid	process
964	0ff3700425c57ee6893c184737a8c5fc1c6e87e8561dd5c25bac7f624cc77451.exe
964	0ff3700425c57ee6893c184737a8c5fc1c6e87e8561dd5c25bac7f624cc77451.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

0ff3700425c57ee6893c184737a8c5fc1c6e87e8561dd5c25bac7f624cc77451.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	0ff3700425c57ee6893c184737a8c5fc1c6e87e8561dd5c25bac7f624cc77451.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1084 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0ff3700425c57ee6893c184737a8c5fc1c6e87e8561dd5c25bac7f624cc77451.exe

description pid process

Token: SeIncBasePriorityPrivilege 964 0ff3700425c57ee6893c184737a8c5fc1c6e87e8561dd5c25bac7f624cc77451.exe

pid	process
1084	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	964	0ff3700425c57ee6893c184737a8c5fc1c6e87e8561dd5c25bac7f624cc77451.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

0ff3700425c57ee6893c184737a8c5fc1c6e87e8561dd5c25bac7f624cc77451.execmd.exe

description	pid	process	target process
PID 964 wrote to memory of 1604	964	0ff3700425c57ee6893c184737a8c5fc1c6e87e8561dd5c25bac7f624cc77451.exe	MediaCenter.exe
PID 964 wrote to memory of 1604	964	0ff3700425c57ee6893c184737a8c5fc1c6e87e8561dd5c25bac7f624cc77451.exe	MediaCenter.exe
PID 964 wrote to memory of 1604	964	0ff3700425c57ee6893c184737a8c5fc1c6e87e8561dd5c25bac7f624cc77451.exe	MediaCenter.exe
PID 964 wrote to memory of 1604	964	0ff3700425c57ee6893c184737a8c5fc1c6e87e8561dd5c25bac7f624cc77451.exe	MediaCenter.exe
PID 964 wrote to memory of 1072	964	0ff3700425c57ee6893c184737a8c5fc1c6e87e8561dd5c25bac7f624cc77451.exe	cmd.exe
PID 964 wrote to memory of 1072	964	0ff3700425c57ee6893c184737a8c5fc1c6e87e8561dd5c25bac7f624cc77451.exe	cmd.exe
PID 964 wrote to memory of 1072	964	0ff3700425c57ee6893c184737a8c5fc1c6e87e8561dd5c25bac7f624cc77451.exe	cmd.exe
PID 964 wrote to memory of 1072	964	0ff3700425c57ee6893c184737a8c5fc1c6e87e8561dd5c25bac7f624cc77451.exe	cmd.exe
PID 1072 wrote to memory of 1084	1072	cmd.exe	PING.EXE
PID 1072 wrote to memory of 1084	1072	cmd.exe	PING.EXE
PID 1072 wrote to memory of 1084	1072	cmd.exe	PING.EXE
PID 1072 wrote to memory of 1084	1072	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\0ff3700425c57ee6893c184737a8c5fc1c6e87e8561dd5c25bac7f624cc77451.exe
"C:\Users\Admin\AppData\Local\Temp\0ff3700425c57ee6893c184737a8c5fc1c6e87e8561dd5c25bac7f624cc77451.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:964

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1604

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\0ff3700425c57ee6893c184737a8c5fc1c6e87e8561dd5c25bac7f624cc77451.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1072

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1084

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
58b7aaca1c769545c9393375d3783ec8

SHA1
4197233564fa4b98ed5086b9146b6d1e2ba62f6c

SHA256
90c2d34a83fe8ed863fe25ac4af521d559426377650a2d915e502022cc048370

SHA512
722ee4df691f97a3bffffb4a962766f3f48079c4f726cd8df9ea62cf93623d610fd6629faed87b6aeefe808ba295b2db9f3c8235080ae42137152f5da9d648fa

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
58b7aaca1c769545c9393375d3783ec8

SHA1
4197233564fa4b98ed5086b9146b6d1e2ba62f6c

SHA256
90c2d34a83fe8ed863fe25ac4af521d559426377650a2d915e502022cc048370

SHA512
722ee4df691f97a3bffffb4a962766f3f48079c4f726cd8df9ea62cf93623d610fd6629faed87b6aeefe808ba295b2db9f3c8235080ae42137152f5da9d648fa

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
58b7aaca1c769545c9393375d3783ec8

SHA1
4197233564fa4b98ed5086b9146b6d1e2ba62f6c

SHA256
90c2d34a83fe8ed863fe25ac4af521d559426377650a2d915e502022cc048370

SHA512
722ee4df691f97a3bffffb4a962766f3f48079c4f726cd8df9ea62cf93623d610fd6629faed87b6aeefe808ba295b2db9f3c8235080ae42137152f5da9d648fa

Download Submit
memory/964-55-0x00000000762C1000-0x00000000762C3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads