sakula | 11ec1b86317d3bfa2f56ac3e5c84cc6028bf5bfbe9f0f2004645ab6997a56f8b

General

Target

11ec1b86317d3bfa2f56ac3e5c84cc6028bf5bfbe9f0f2004645ab6997a56f8b.exe
Size

191KB
MD5

db46adb8c349b2eda959f2d6959f87c4
SHA1

0ffe9fde60654d7945e4426969d7ee1021a78ff8
SHA256

11ec1b86317d3bfa2f56ac3e5c84cc6028bf5bfbe9f0f2004645ab6997a56f8b
SHA512

a789e7752822b7f949491acc6c388e927e5cb9117e5eaa4dda765d2dc2e25f27a42f47a2b6bc61762819cc6cc10694993d5ed2f3abaac68db8865072ddee407b

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula Payload 3 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula

Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1536 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1416 cmd.exe

pid	process
1536	MediaCenter.exe

pid	process
1416	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

11ec1b86317d3bfa2f56ac3e5c84cc6028bf5bfbe9f0f2004645ab6997a56f8b.exe

pid	process
900	11ec1b86317d3bfa2f56ac3e5c84cc6028bf5bfbe9f0f2004645ab6997a56f8b.exe
900	11ec1b86317d3bfa2f56ac3e5c84cc6028bf5bfbe9f0f2004645ab6997a56f8b.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

11ec1b86317d3bfa2f56ac3e5c84cc6028bf5bfbe9f0f2004645ab6997a56f8b.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	11ec1b86317d3bfa2f56ac3e5c84cc6028bf5bfbe9f0f2004645ab6997a56f8b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1360 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

11ec1b86317d3bfa2f56ac3e5c84cc6028bf5bfbe9f0f2004645ab6997a56f8b.exe

description pid process

Token: SeIncBasePriorityPrivilege 900 11ec1b86317d3bfa2f56ac3e5c84cc6028bf5bfbe9f0f2004645ab6997a56f8b.exe

pid	process
1360	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	900	11ec1b86317d3bfa2f56ac3e5c84cc6028bf5bfbe9f0f2004645ab6997a56f8b.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

11ec1b86317d3bfa2f56ac3e5c84cc6028bf5bfbe9f0f2004645ab6997a56f8b.execmd.exe

description	pid	process	target process
PID 900 wrote to memory of 1536	900	11ec1b86317d3bfa2f56ac3e5c84cc6028bf5bfbe9f0f2004645ab6997a56f8b.exe	MediaCenter.exe
PID 900 wrote to memory of 1536	900	11ec1b86317d3bfa2f56ac3e5c84cc6028bf5bfbe9f0f2004645ab6997a56f8b.exe	MediaCenter.exe
PID 900 wrote to memory of 1536	900	11ec1b86317d3bfa2f56ac3e5c84cc6028bf5bfbe9f0f2004645ab6997a56f8b.exe	MediaCenter.exe
PID 900 wrote to memory of 1536	900	11ec1b86317d3bfa2f56ac3e5c84cc6028bf5bfbe9f0f2004645ab6997a56f8b.exe	MediaCenter.exe
PID 900 wrote to memory of 1416	900	11ec1b86317d3bfa2f56ac3e5c84cc6028bf5bfbe9f0f2004645ab6997a56f8b.exe	cmd.exe
PID 900 wrote to memory of 1416	900	11ec1b86317d3bfa2f56ac3e5c84cc6028bf5bfbe9f0f2004645ab6997a56f8b.exe	cmd.exe
PID 900 wrote to memory of 1416	900	11ec1b86317d3bfa2f56ac3e5c84cc6028bf5bfbe9f0f2004645ab6997a56f8b.exe	cmd.exe
PID 900 wrote to memory of 1416	900	11ec1b86317d3bfa2f56ac3e5c84cc6028bf5bfbe9f0f2004645ab6997a56f8b.exe	cmd.exe
PID 1416 wrote to memory of 1360	1416	cmd.exe	PING.EXE
PID 1416 wrote to memory of 1360	1416	cmd.exe	PING.EXE
PID 1416 wrote to memory of 1360	1416	cmd.exe	PING.EXE
PID 1416 wrote to memory of 1360	1416	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\11ec1b86317d3bfa2f56ac3e5c84cc6028bf5bfbe9f0f2004645ab6997a56f8b.exe
"C:\Users\Admin\AppData\Local\Temp\11ec1b86317d3bfa2f56ac3e5c84cc6028bf5bfbe9f0f2004645ab6997a56f8b.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:900

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1536

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\11ec1b86317d3bfa2f56ac3e5c84cc6028bf5bfbe9f0f2004645ab6997a56f8b.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1416

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1360

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
f206648313d28531883b5ba667d3aec8

SHA1
f9c6faca80f20c518d1b2e207a365c530a2f84fa

SHA256
4746b47d93f825f10b8f042d7a9313b23d1d83b3fcbb2e9e4950a644471662d8

SHA512
93c1a93aac9c46eedbb3ecb578b0e61726322ba575f946aede5459ae263548e648b7a71a0eea37b2b40d2a96e7548868c0d781d7dbea6f65c2637783d07799d4

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
f206648313d28531883b5ba667d3aec8

SHA1
f9c6faca80f20c518d1b2e207a365c530a2f84fa

SHA256
4746b47d93f825f10b8f042d7a9313b23d1d83b3fcbb2e9e4950a644471662d8

SHA512
93c1a93aac9c46eedbb3ecb578b0e61726322ba575f946aede5459ae263548e648b7a71a0eea37b2b40d2a96e7548868c0d781d7dbea6f65c2637783d07799d4

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
f206648313d28531883b5ba667d3aec8

SHA1
f9c6faca80f20c518d1b2e207a365c530a2f84fa

SHA256
4746b47d93f825f10b8f042d7a9313b23d1d83b3fcbb2e9e4950a644471662d8

SHA512
93c1a93aac9c46eedbb3ecb578b0e61726322ba575f946aede5459ae263548e648b7a71a0eea37b2b40d2a96e7548868c0d781d7dbea6f65c2637783d07799d4

Download Submit
memory/900-55-0x0000000075B11000-0x0000000075B13000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads