sakula | 1131f956aaccd7d07bf18c8d07e4d07ed5d4dc6c69ac7011de0831440afb3a19

General

Target

1131f956aaccd7d07bf18c8d07e4d07ed5d4dc6c69ac7011de0831440afb3a19.exe
Size

80KB
MD5

a9bb10c9327c112347e3b3e89158fff5
SHA1

4b197b066936d05e3fd3c21d673d845f50040421
SHA256

1131f956aaccd7d07bf18c8d07e4d07ed5d4dc6c69ac7011de0831440afb3a19
SHA512

3c8048b11b7151c84fb504c632013ae5bdae81ed93ea72905b6bbf0f43cdc552cb9b28fc65eaa6c9eac0703d7a9be091e243301e89566370a0b801287352263d

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula Payload 3 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula

Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1920 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1620 cmd.exe

pid	process
1920	MediaCenter.exe

pid	process
1620	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

1131f956aaccd7d07bf18c8d07e4d07ed5d4dc6c69ac7011de0831440afb3a19.exe

pid	process
1792	1131f956aaccd7d07bf18c8d07e4d07ed5d4dc6c69ac7011de0831440afb3a19.exe
1792	1131f956aaccd7d07bf18c8d07e4d07ed5d4dc6c69ac7011de0831440afb3a19.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

1131f956aaccd7d07bf18c8d07e4d07ed5d4dc6c69ac7011de0831440afb3a19.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	1131f956aaccd7d07bf18c8d07e4d07ed5d4dc6c69ac7011de0831440afb3a19.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1872 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

1131f956aaccd7d07bf18c8d07e4d07ed5d4dc6c69ac7011de0831440afb3a19.exe

description pid process

Token: SeIncBasePriorityPrivilege 1792 1131f956aaccd7d07bf18c8d07e4d07ed5d4dc6c69ac7011de0831440afb3a19.exe

pid	process
1872	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1792	1131f956aaccd7d07bf18c8d07e4d07ed5d4dc6c69ac7011de0831440afb3a19.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

1131f956aaccd7d07bf18c8d07e4d07ed5d4dc6c69ac7011de0831440afb3a19.execmd.exe

description	pid	process	target process
PID 1792 wrote to memory of 1920	1792	1131f956aaccd7d07bf18c8d07e4d07ed5d4dc6c69ac7011de0831440afb3a19.exe	MediaCenter.exe
PID 1792 wrote to memory of 1920	1792	1131f956aaccd7d07bf18c8d07e4d07ed5d4dc6c69ac7011de0831440afb3a19.exe	MediaCenter.exe
PID 1792 wrote to memory of 1920	1792	1131f956aaccd7d07bf18c8d07e4d07ed5d4dc6c69ac7011de0831440afb3a19.exe	MediaCenter.exe
PID 1792 wrote to memory of 1920	1792	1131f956aaccd7d07bf18c8d07e4d07ed5d4dc6c69ac7011de0831440afb3a19.exe	MediaCenter.exe
PID 1792 wrote to memory of 1620	1792	1131f956aaccd7d07bf18c8d07e4d07ed5d4dc6c69ac7011de0831440afb3a19.exe	cmd.exe
PID 1792 wrote to memory of 1620	1792	1131f956aaccd7d07bf18c8d07e4d07ed5d4dc6c69ac7011de0831440afb3a19.exe	cmd.exe
PID 1792 wrote to memory of 1620	1792	1131f956aaccd7d07bf18c8d07e4d07ed5d4dc6c69ac7011de0831440afb3a19.exe	cmd.exe
PID 1792 wrote to memory of 1620	1792	1131f956aaccd7d07bf18c8d07e4d07ed5d4dc6c69ac7011de0831440afb3a19.exe	cmd.exe
PID 1620 wrote to memory of 1872	1620	cmd.exe	PING.EXE
PID 1620 wrote to memory of 1872	1620	cmd.exe	PING.EXE
PID 1620 wrote to memory of 1872	1620	cmd.exe	PING.EXE
PID 1620 wrote to memory of 1872	1620	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\1131f956aaccd7d07bf18c8d07e4d07ed5d4dc6c69ac7011de0831440afb3a19.exe
"C:\Users\Admin\AppData\Local\Temp\1131f956aaccd7d07bf18c8d07e4d07ed5d4dc6c69ac7011de0831440afb3a19.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1792

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1920

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\1131f956aaccd7d07bf18c8d07e4d07ed5d4dc6c69ac7011de0831440afb3a19.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1620

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1872

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
b05669886948d9f249ee470d68f6d684

SHA1
521469f4d320d1e662215aa98dcf5350dfbdec03

SHA256
7882a44c7b30a0c418a708e3b88f26dd0036d16a65908c1f656ab2ddb7a67a3d

SHA512
30b73f836a8061444f50bc137760aa021d812dd9485e0e1a447f867a60fd12e54679719264a6fff4a6abe3d08dd43345fbb09526f4ce6ec4fc3a9e09175b01d0

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
b05669886948d9f249ee470d68f6d684

SHA1
521469f4d320d1e662215aa98dcf5350dfbdec03

SHA256
7882a44c7b30a0c418a708e3b88f26dd0036d16a65908c1f656ab2ddb7a67a3d

SHA512
30b73f836a8061444f50bc137760aa021d812dd9485e0e1a447f867a60fd12e54679719264a6fff4a6abe3d08dd43345fbb09526f4ce6ec4fc3a9e09175b01d0

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
b05669886948d9f249ee470d68f6d684

SHA1
521469f4d320d1e662215aa98dcf5350dfbdec03

SHA256
7882a44c7b30a0c418a708e3b88f26dd0036d16a65908c1f656ab2ddb7a67a3d

SHA512
30b73f836a8061444f50bc137760aa021d812dd9485e0e1a447f867a60fd12e54679719264a6fff4a6abe3d08dd43345fbb09526f4ce6ec4fc3a9e09175b01d0

Download Submit
memory/1792-54-0x00000000754B1000-0x00000000754B3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads