sakula | 0e01c1f2c430179aa284beeaf290c74038bbf422689bd8b96b1c41d83fce57fd

General

Target

0e01c1f2c430179aa284beeaf290c74038bbf422689bd8b96b1c41d83fce57fd.exe
Size

60KB
MD5

d8be8f6d83215c8acd68bed1261cb831
SHA1

00fb37195cfc3bc1fd3206cb3f36c8b5977ea545
SHA256

0e01c1f2c430179aa284beeaf290c74038bbf422689bd8b96b1c41d83fce57fd
SHA512

a5ebcff83a49b8ea6ba3d6a46d29895093729c0d2df3dad8db36241f8f70f6cc585e4de87d7af2482abec36632f72f99e50718f58ded1d4ccf40a7eef7b0f209

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

776 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1352 cmd.exe

pid	process
776	MediaCenter.exe

pid	process
1352	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

0e01c1f2c430179aa284beeaf290c74038bbf422689bd8b96b1c41d83fce57fd.exe

pid	process
1444	0e01c1f2c430179aa284beeaf290c74038bbf422689bd8b96b1c41d83fce57fd.exe
1444	0e01c1f2c430179aa284beeaf290c74038bbf422689bd8b96b1c41d83fce57fd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

0e01c1f2c430179aa284beeaf290c74038bbf422689bd8b96b1c41d83fce57fd.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	0e01c1f2c430179aa284beeaf290c74038bbf422689bd8b96b1c41d83fce57fd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1040 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0e01c1f2c430179aa284beeaf290c74038bbf422689bd8b96b1c41d83fce57fd.exe

description pid process

Token: SeIncBasePriorityPrivilege 1444 0e01c1f2c430179aa284beeaf290c74038bbf422689bd8b96b1c41d83fce57fd.exe

pid	process
1040	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1444	0e01c1f2c430179aa284beeaf290c74038bbf422689bd8b96b1c41d83fce57fd.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

0e01c1f2c430179aa284beeaf290c74038bbf422689bd8b96b1c41d83fce57fd.execmd.exe

description	pid	process	target process
PID 1444 wrote to memory of 776	1444	0e01c1f2c430179aa284beeaf290c74038bbf422689bd8b96b1c41d83fce57fd.exe	MediaCenter.exe
PID 1444 wrote to memory of 776	1444	0e01c1f2c430179aa284beeaf290c74038bbf422689bd8b96b1c41d83fce57fd.exe	MediaCenter.exe
PID 1444 wrote to memory of 776	1444	0e01c1f2c430179aa284beeaf290c74038bbf422689bd8b96b1c41d83fce57fd.exe	MediaCenter.exe
PID 1444 wrote to memory of 776	1444	0e01c1f2c430179aa284beeaf290c74038bbf422689bd8b96b1c41d83fce57fd.exe	MediaCenter.exe
PID 1444 wrote to memory of 1352	1444	0e01c1f2c430179aa284beeaf290c74038bbf422689bd8b96b1c41d83fce57fd.exe	cmd.exe
PID 1444 wrote to memory of 1352	1444	0e01c1f2c430179aa284beeaf290c74038bbf422689bd8b96b1c41d83fce57fd.exe	cmd.exe
PID 1444 wrote to memory of 1352	1444	0e01c1f2c430179aa284beeaf290c74038bbf422689bd8b96b1c41d83fce57fd.exe	cmd.exe
PID 1444 wrote to memory of 1352	1444	0e01c1f2c430179aa284beeaf290c74038bbf422689bd8b96b1c41d83fce57fd.exe	cmd.exe
PID 1352 wrote to memory of 1040	1352	cmd.exe	PING.EXE
PID 1352 wrote to memory of 1040	1352	cmd.exe	PING.EXE
PID 1352 wrote to memory of 1040	1352	cmd.exe	PING.EXE
PID 1352 wrote to memory of 1040	1352	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\0e01c1f2c430179aa284beeaf290c74038bbf422689bd8b96b1c41d83fce57fd.exe
"C:\Users\Admin\AppData\Local\Temp\0e01c1f2c430179aa284beeaf290c74038bbf422689bd8b96b1c41d83fce57fd.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1444

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:776

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\0e01c1f2c430179aa284beeaf290c74038bbf422689bd8b96b1c41d83fce57fd.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1352

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1040

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
426fc17095aa96760c359ca30235fbe1

SHA1
1e650e25fc4373f0cd3393e0206bd08ec1998b0e

SHA256
29b203b8366ef4af95bd5d72269ec58e976b986c93a78fa0353fe503b66dbc59

SHA512
c197c1533c647698dd99a8e5fda4d8b3bd6bb80147e16b8b11405b74a579338d037366872d32d59e02c159dc61dc794d7a7a5ccc5acc320a2d72720766466af6

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
426fc17095aa96760c359ca30235fbe1

SHA1
1e650e25fc4373f0cd3393e0206bd08ec1998b0e

SHA256
29b203b8366ef4af95bd5d72269ec58e976b986c93a78fa0353fe503b66dbc59

SHA512
c197c1533c647698dd99a8e5fda4d8b3bd6bb80147e16b8b11405b74a579338d037366872d32d59e02c159dc61dc794d7a7a5ccc5acc320a2d72720766466af6

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
426fc17095aa96760c359ca30235fbe1

SHA1
1e650e25fc4373f0cd3393e0206bd08ec1998b0e

SHA256
29b203b8366ef4af95bd5d72269ec58e976b986c93a78fa0353fe503b66dbc59

SHA512
c197c1533c647698dd99a8e5fda4d8b3bd6bb80147e16b8b11405b74a579338d037366872d32d59e02c159dc61dc794d7a7a5ccc5acc320a2d72720766466af6

Download Submit
memory/1444-55-0x0000000075191000-0x0000000075193000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads