sakula | 11913ab806a28a8116fb6e6aa828493f5433052d6345bbb6a684f41411e17aac

General

Target

11913ab806a28a8116fb6e6aa828493f5433052d6345bbb6a684f41411e17aac.exe
Size

100KB
MD5

bb7b88ebf1a2ceb062328282abd3b418
SHA1

75431ee6b26b547b9999431950046081d2cf1e5c
SHA256

11913ab806a28a8116fb6e6aa828493f5433052d6345bbb6a684f41411e17aac
SHA512

2e229e613d5ef1976c0e2f4ba16ca60220c37570f1ca6515591367f5bffd31faccb24d3a4a285d0f3bb991bc9dd9fbdd031b679b6dfc4167b7a66b00b383147d

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula Payload 3 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula

Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

268 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1664 cmd.exe

pid	process
268	MediaCenter.exe

pid	process
1664	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

11913ab806a28a8116fb6e6aa828493f5433052d6345bbb6a684f41411e17aac.exe

pid	process
1212	11913ab806a28a8116fb6e6aa828493f5433052d6345bbb6a684f41411e17aac.exe
1212	11913ab806a28a8116fb6e6aa828493f5433052d6345bbb6a684f41411e17aac.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

11913ab806a28a8116fb6e6aa828493f5433052d6345bbb6a684f41411e17aac.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	11913ab806a28a8116fb6e6aa828493f5433052d6345bbb6a684f41411e17aac.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1200 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

11913ab806a28a8116fb6e6aa828493f5433052d6345bbb6a684f41411e17aac.exe

description pid process

Token: SeIncBasePriorityPrivilege 1212 11913ab806a28a8116fb6e6aa828493f5433052d6345bbb6a684f41411e17aac.exe

pid	process
1200	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1212	11913ab806a28a8116fb6e6aa828493f5433052d6345bbb6a684f41411e17aac.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

11913ab806a28a8116fb6e6aa828493f5433052d6345bbb6a684f41411e17aac.execmd.exe

description	pid	process	target process
PID 1212 wrote to memory of 268	1212	11913ab806a28a8116fb6e6aa828493f5433052d6345bbb6a684f41411e17aac.exe	MediaCenter.exe
PID 1212 wrote to memory of 268	1212	11913ab806a28a8116fb6e6aa828493f5433052d6345bbb6a684f41411e17aac.exe	MediaCenter.exe
PID 1212 wrote to memory of 268	1212	11913ab806a28a8116fb6e6aa828493f5433052d6345bbb6a684f41411e17aac.exe	MediaCenter.exe
PID 1212 wrote to memory of 268	1212	11913ab806a28a8116fb6e6aa828493f5433052d6345bbb6a684f41411e17aac.exe	MediaCenter.exe
PID 1212 wrote to memory of 1664	1212	11913ab806a28a8116fb6e6aa828493f5433052d6345bbb6a684f41411e17aac.exe	cmd.exe
PID 1212 wrote to memory of 1664	1212	11913ab806a28a8116fb6e6aa828493f5433052d6345bbb6a684f41411e17aac.exe	cmd.exe
PID 1212 wrote to memory of 1664	1212	11913ab806a28a8116fb6e6aa828493f5433052d6345bbb6a684f41411e17aac.exe	cmd.exe
PID 1212 wrote to memory of 1664	1212	11913ab806a28a8116fb6e6aa828493f5433052d6345bbb6a684f41411e17aac.exe	cmd.exe
PID 1664 wrote to memory of 1200	1664	cmd.exe	PING.EXE
PID 1664 wrote to memory of 1200	1664	cmd.exe	PING.EXE
PID 1664 wrote to memory of 1200	1664	cmd.exe	PING.EXE
PID 1664 wrote to memory of 1200	1664	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\11913ab806a28a8116fb6e6aa828493f5433052d6345bbb6a684f41411e17aac.exe
"C:\Users\Admin\AppData\Local\Temp\11913ab806a28a8116fb6e6aa828493f5433052d6345bbb6a684f41411e17aac.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1212

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:268

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\11913ab806a28a8116fb6e6aa828493f5433052d6345bbb6a684f41411e17aac.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1664

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1200

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
75249dc9ff5850af4d53925f18827683

SHA1
5cf4792044d24b3fdc55a279600e432e98a33767

SHA256
b150c7d500ceccf75362517e2a6a70918160bdad1ce408f82b77aca241855d81

SHA512
d610c25a9b2b1846f281c94d6bf48a769613b232b1f55b0fb87d6112ff634e3a8c268c447b8e65863d33cc0cf1cdd233167f9f908ee1f9572ef2d9b6e17e5364

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
75249dc9ff5850af4d53925f18827683

SHA1
5cf4792044d24b3fdc55a279600e432e98a33767

SHA256
b150c7d500ceccf75362517e2a6a70918160bdad1ce408f82b77aca241855d81

SHA512
d610c25a9b2b1846f281c94d6bf48a769613b232b1f55b0fb87d6112ff634e3a8c268c447b8e65863d33cc0cf1cdd233167f9f908ee1f9572ef2d9b6e17e5364

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
75249dc9ff5850af4d53925f18827683

SHA1
5cf4792044d24b3fdc55a279600e432e98a33767

SHA256
b150c7d500ceccf75362517e2a6a70918160bdad1ce408f82b77aca241855d81

SHA512
d610c25a9b2b1846f281c94d6bf48a769613b232b1f55b0fb87d6112ff634e3a8c268c447b8e65863d33cc0cf1cdd233167f9f908ee1f9572ef2d9b6e17e5364

Download Submit
memory/1212-54-0x0000000075AB1000-0x0000000075AB3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads