sakula | 1196056f2a38e3fff016a5b3be43084bbe1673f24490bbfa71a350c81af42315

General

Target

1196056f2a38e3fff016a5b3be43084bbe1673f24490bbfa71a350c81af42315.exe
Size

99KB
MD5

1595a18358238c91771b5c25fd18330b
SHA1

34859f9c7cdaba81cc678acbdd57f4e3a32ed93a
SHA256

1196056f2a38e3fff016a5b3be43084bbe1673f24490bbfa71a350c81af42315
SHA512

fe1c2a1f8ee004551fa936be595aef2e4fae66479ce7d59cb3d6339cd786bfc330bcf6a7c3498869c92a033bd9812fa2f4969b9c894519336a0b81be6842dcb9

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula Payload 3 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula

Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1428 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

396 cmd.exe

pid	process
1428	MediaCenter.exe

pid	process
396	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

1196056f2a38e3fff016a5b3be43084bbe1673f24490bbfa71a350c81af42315.exe

pid	process
1448	1196056f2a38e3fff016a5b3be43084bbe1673f24490bbfa71a350c81af42315.exe
1448	1196056f2a38e3fff016a5b3be43084bbe1673f24490bbfa71a350c81af42315.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

1196056f2a38e3fff016a5b3be43084bbe1673f24490bbfa71a350c81af42315.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	1196056f2a38e3fff016a5b3be43084bbe1673f24490bbfa71a350c81af42315.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1192 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

1196056f2a38e3fff016a5b3be43084bbe1673f24490bbfa71a350c81af42315.exe

description pid process

Token: SeIncBasePriorityPrivilege 1448 1196056f2a38e3fff016a5b3be43084bbe1673f24490bbfa71a350c81af42315.exe

pid	process
1192	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1448	1196056f2a38e3fff016a5b3be43084bbe1673f24490bbfa71a350c81af42315.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

1196056f2a38e3fff016a5b3be43084bbe1673f24490bbfa71a350c81af42315.execmd.exe

description	pid	process	target process
PID 1448 wrote to memory of 1428	1448	1196056f2a38e3fff016a5b3be43084bbe1673f24490bbfa71a350c81af42315.exe	MediaCenter.exe
PID 1448 wrote to memory of 1428	1448	1196056f2a38e3fff016a5b3be43084bbe1673f24490bbfa71a350c81af42315.exe	MediaCenter.exe
PID 1448 wrote to memory of 1428	1448	1196056f2a38e3fff016a5b3be43084bbe1673f24490bbfa71a350c81af42315.exe	MediaCenter.exe
PID 1448 wrote to memory of 1428	1448	1196056f2a38e3fff016a5b3be43084bbe1673f24490bbfa71a350c81af42315.exe	MediaCenter.exe
PID 1448 wrote to memory of 396	1448	1196056f2a38e3fff016a5b3be43084bbe1673f24490bbfa71a350c81af42315.exe	cmd.exe
PID 1448 wrote to memory of 396	1448	1196056f2a38e3fff016a5b3be43084bbe1673f24490bbfa71a350c81af42315.exe	cmd.exe
PID 1448 wrote to memory of 396	1448	1196056f2a38e3fff016a5b3be43084bbe1673f24490bbfa71a350c81af42315.exe	cmd.exe
PID 1448 wrote to memory of 396	1448	1196056f2a38e3fff016a5b3be43084bbe1673f24490bbfa71a350c81af42315.exe	cmd.exe
PID 396 wrote to memory of 1192	396	cmd.exe	PING.EXE
PID 396 wrote to memory of 1192	396	cmd.exe	PING.EXE
PID 396 wrote to memory of 1192	396	cmd.exe	PING.EXE
PID 396 wrote to memory of 1192	396	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\1196056f2a38e3fff016a5b3be43084bbe1673f24490bbfa71a350c81af42315.exe
"C:\Users\Admin\AppData\Local\Temp\1196056f2a38e3fff016a5b3be43084bbe1673f24490bbfa71a350c81af42315.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1448

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1428

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\1196056f2a38e3fff016a5b3be43084bbe1673f24490bbfa71a350c81af42315.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:396

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1192

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
8693dc9a6b364a5b5b8659aec9b0da7a

SHA1
26f9e43e231bbf897c52be70fb412f170bed4ee7

SHA256
09fdd8327c7f6a2245995a413b3603b7ba76aff4f04b7a565cc2c444a9cca7d3

SHA512
50ba804cde14097dd944c36e51daeba7727c260c6252fa9e6d3720fd08c4a562d308fc09daa72bedf5333574bad7b243359fed62a56d2f4166c9b13d53b0e285

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
8693dc9a6b364a5b5b8659aec9b0da7a

SHA1
26f9e43e231bbf897c52be70fb412f170bed4ee7

SHA256
09fdd8327c7f6a2245995a413b3603b7ba76aff4f04b7a565cc2c444a9cca7d3

SHA512
50ba804cde14097dd944c36e51daeba7727c260c6252fa9e6d3720fd08c4a562d308fc09daa72bedf5333574bad7b243359fed62a56d2f4166c9b13d53b0e285

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
8693dc9a6b364a5b5b8659aec9b0da7a

SHA1
26f9e43e231bbf897c52be70fb412f170bed4ee7

SHA256
09fdd8327c7f6a2245995a413b3603b7ba76aff4f04b7a565cc2c444a9cca7d3

SHA512
50ba804cde14097dd944c36e51daeba7727c260c6252fa9e6d3720fd08c4a562d308fc09daa72bedf5333574bad7b243359fed62a56d2f4166c9b13d53b0e285

Download Submit
memory/1448-54-0x0000000076421000-0x0000000076423000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads