sakula | 10e3cd19c3107a3e017ab07896b4865715d77490c22dd911667b5f916b259c53

General

Target

10e3cd19c3107a3e017ab07896b4865715d77490c22dd911667b5f916b259c53.exe
Size

100KB
MD5

2049f6b7ce9638e03b67653576c5598b
SHA1

cca807ece31fb86462dc36a49c6ca8d6f5213987
SHA256

10e3cd19c3107a3e017ab07896b4865715d77490c22dd911667b5f916b259c53
SHA512

5b709d0045777de6b07091814d08dfc2ad9a75d16a91651aeaa8ddabb1c4056ed467020e92cb2f43b574ae55b40bdd7fc763194fe3d1f5110a7d6a8ffe913c14

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula Payload 3 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula

Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1668 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

980 cmd.exe

pid	process
1668	MediaCenter.exe

pid	process
980	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

10e3cd19c3107a3e017ab07896b4865715d77490c22dd911667b5f916b259c53.exe

pid	process
308	10e3cd19c3107a3e017ab07896b4865715d77490c22dd911667b5f916b259c53.exe
308	10e3cd19c3107a3e017ab07896b4865715d77490c22dd911667b5f916b259c53.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

10e3cd19c3107a3e017ab07896b4865715d77490c22dd911667b5f916b259c53.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	10e3cd19c3107a3e017ab07896b4865715d77490c22dd911667b5f916b259c53.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1972 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

10e3cd19c3107a3e017ab07896b4865715d77490c22dd911667b5f916b259c53.exe

description pid process

Token: SeIncBasePriorityPrivilege 308 10e3cd19c3107a3e017ab07896b4865715d77490c22dd911667b5f916b259c53.exe

pid	process
1972	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	308	10e3cd19c3107a3e017ab07896b4865715d77490c22dd911667b5f916b259c53.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

10e3cd19c3107a3e017ab07896b4865715d77490c22dd911667b5f916b259c53.execmd.exe

description	pid	process	target process
PID 308 wrote to memory of 1668	308	10e3cd19c3107a3e017ab07896b4865715d77490c22dd911667b5f916b259c53.exe	MediaCenter.exe
PID 308 wrote to memory of 1668	308	10e3cd19c3107a3e017ab07896b4865715d77490c22dd911667b5f916b259c53.exe	MediaCenter.exe
PID 308 wrote to memory of 1668	308	10e3cd19c3107a3e017ab07896b4865715d77490c22dd911667b5f916b259c53.exe	MediaCenter.exe
PID 308 wrote to memory of 1668	308	10e3cd19c3107a3e017ab07896b4865715d77490c22dd911667b5f916b259c53.exe	MediaCenter.exe
PID 308 wrote to memory of 980	308	10e3cd19c3107a3e017ab07896b4865715d77490c22dd911667b5f916b259c53.exe	cmd.exe
PID 308 wrote to memory of 980	308	10e3cd19c3107a3e017ab07896b4865715d77490c22dd911667b5f916b259c53.exe	cmd.exe
PID 308 wrote to memory of 980	308	10e3cd19c3107a3e017ab07896b4865715d77490c22dd911667b5f916b259c53.exe	cmd.exe
PID 308 wrote to memory of 980	308	10e3cd19c3107a3e017ab07896b4865715d77490c22dd911667b5f916b259c53.exe	cmd.exe
PID 980 wrote to memory of 1972	980	cmd.exe	PING.EXE
PID 980 wrote to memory of 1972	980	cmd.exe	PING.EXE
PID 980 wrote to memory of 1972	980	cmd.exe	PING.EXE
PID 980 wrote to memory of 1972	980	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\10e3cd19c3107a3e017ab07896b4865715d77490c22dd911667b5f916b259c53.exe
"C:\Users\Admin\AppData\Local\Temp\10e3cd19c3107a3e017ab07896b4865715d77490c22dd911667b5f916b259c53.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:308

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1668

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\10e3cd19c3107a3e017ab07896b4865715d77490c22dd911667b5f916b259c53.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:980

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1972

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
2d3e9d4f6f145b3f9366416e9bce27b4

SHA1
9fa6a5fbc6c55c3a67103ebe4ced76f53ef51912

SHA256
7db3dd54da2cdf8e66de95a90a390d2bb206eabcba551a033732cb6fb43410d2

SHA512
f51d04b67f5598712359df44090132cd0025e4d7208308483186796908a7d5fbf22f7b6cd04d43a7d7bb86b91905fa5169efe0a9371738ec82c077541ae6b5af

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
2d3e9d4f6f145b3f9366416e9bce27b4

SHA1
9fa6a5fbc6c55c3a67103ebe4ced76f53ef51912

SHA256
7db3dd54da2cdf8e66de95a90a390d2bb206eabcba551a033732cb6fb43410d2

SHA512
f51d04b67f5598712359df44090132cd0025e4d7208308483186796908a7d5fbf22f7b6cd04d43a7d7bb86b91905fa5169efe0a9371738ec82c077541ae6b5af

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
2d3e9d4f6f145b3f9366416e9bce27b4

SHA1
9fa6a5fbc6c55c3a67103ebe4ced76f53ef51912

SHA256
7db3dd54da2cdf8e66de95a90a390d2bb206eabcba551a033732cb6fb43410d2

SHA512
f51d04b67f5598712359df44090132cd0025e4d7208308483186796908a7d5fbf22f7b6cd04d43a7d7bb86b91905fa5169efe0a9371738ec82c077541ae6b5af

Download Submit
memory/308-54-0x0000000076491000-0x0000000076493000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads