sakula | 0fb56487de64d46e07222958ae16410d0321fee239fb5d9b424a4d15db9f9156

General

Target

0fb56487de64d46e07222958ae16410d0321fee239fb5d9b424a4d15db9f9156.exe
Size

60KB
MD5

dffc5d89fae948dc599ac689fa4c2821
SHA1

233fa8253b0b2a6f6e0dd1b448dab3a56f8f2897
SHA256

0fb56487de64d46e07222958ae16410d0321fee239fb5d9b424a4d15db9f9156
SHA512

b81640a132ac8e0ac16ab2cf6f8945f4cc4164fb09126cf122b26e45d7f232498a0e540b577be4bf51770bdd3daf56734970af3545a4d9e04be17e7567fa8cbb

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

628 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1596 cmd.exe

pid	process
628	MediaCenter.exe

pid	process
1596	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

0fb56487de64d46e07222958ae16410d0321fee239fb5d9b424a4d15db9f9156.exe

pid	process
1796	0fb56487de64d46e07222958ae16410d0321fee239fb5d9b424a4d15db9f9156.exe
1796	0fb56487de64d46e07222958ae16410d0321fee239fb5d9b424a4d15db9f9156.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

0fb56487de64d46e07222958ae16410d0321fee239fb5d9b424a4d15db9f9156.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	0fb56487de64d46e07222958ae16410d0321fee239fb5d9b424a4d15db9f9156.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1636 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0fb56487de64d46e07222958ae16410d0321fee239fb5d9b424a4d15db9f9156.exe

description pid process

Token: SeIncBasePriorityPrivilege 1796 0fb56487de64d46e07222958ae16410d0321fee239fb5d9b424a4d15db9f9156.exe

pid	process
1636	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1796	0fb56487de64d46e07222958ae16410d0321fee239fb5d9b424a4d15db9f9156.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

0fb56487de64d46e07222958ae16410d0321fee239fb5d9b424a4d15db9f9156.execmd.exe

description	pid	process	target process
PID 1796 wrote to memory of 628	1796	0fb56487de64d46e07222958ae16410d0321fee239fb5d9b424a4d15db9f9156.exe	MediaCenter.exe
PID 1796 wrote to memory of 628	1796	0fb56487de64d46e07222958ae16410d0321fee239fb5d9b424a4d15db9f9156.exe	MediaCenter.exe
PID 1796 wrote to memory of 628	1796	0fb56487de64d46e07222958ae16410d0321fee239fb5d9b424a4d15db9f9156.exe	MediaCenter.exe
PID 1796 wrote to memory of 628	1796	0fb56487de64d46e07222958ae16410d0321fee239fb5d9b424a4d15db9f9156.exe	MediaCenter.exe
PID 1796 wrote to memory of 1596	1796	0fb56487de64d46e07222958ae16410d0321fee239fb5d9b424a4d15db9f9156.exe	cmd.exe
PID 1796 wrote to memory of 1596	1796	0fb56487de64d46e07222958ae16410d0321fee239fb5d9b424a4d15db9f9156.exe	cmd.exe
PID 1796 wrote to memory of 1596	1796	0fb56487de64d46e07222958ae16410d0321fee239fb5d9b424a4d15db9f9156.exe	cmd.exe
PID 1796 wrote to memory of 1596	1796	0fb56487de64d46e07222958ae16410d0321fee239fb5d9b424a4d15db9f9156.exe	cmd.exe
PID 1596 wrote to memory of 1636	1596	cmd.exe	PING.EXE
PID 1596 wrote to memory of 1636	1596	cmd.exe	PING.EXE
PID 1596 wrote to memory of 1636	1596	cmd.exe	PING.EXE
PID 1596 wrote to memory of 1636	1596	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\0fb56487de64d46e07222958ae16410d0321fee239fb5d9b424a4d15db9f9156.exe
"C:\Users\Admin\AppData\Local\Temp\0fb56487de64d46e07222958ae16410d0321fee239fb5d9b424a4d15db9f9156.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1796

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:628

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\0fb56487de64d46e07222958ae16410d0321fee239fb5d9b424a4d15db9f9156.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1596

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1636

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
54f3a00f847564beacde1cb7b24f8d78

SHA1
829b4051183cef27be55b418b69fb5eeb0e9678c

SHA256
915db5b9d1bebf09c1f1c6eeb80301d5e3714f57b8601e008a8254cbd41f6d71

SHA512
32b5fad0b6a12871899da357467771ab57ea96d379a0e65da05bb7462b59e6749a85b24abe7bf393fe65356a1d04e98ae9d51ff50d62eec9f2532441ffd403ff

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
54f3a00f847564beacde1cb7b24f8d78

SHA1
829b4051183cef27be55b418b69fb5eeb0e9678c

SHA256
915db5b9d1bebf09c1f1c6eeb80301d5e3714f57b8601e008a8254cbd41f6d71

SHA512
32b5fad0b6a12871899da357467771ab57ea96d379a0e65da05bb7462b59e6749a85b24abe7bf393fe65356a1d04e98ae9d51ff50d62eec9f2532441ffd403ff

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
54f3a00f847564beacde1cb7b24f8d78

SHA1
829b4051183cef27be55b418b69fb5eeb0e9678c

SHA256
915db5b9d1bebf09c1f1c6eeb80301d5e3714f57b8601e008a8254cbd41f6d71

SHA512
32b5fad0b6a12871899da357467771ab57ea96d379a0e65da05bb7462b59e6749a85b24abe7bf393fe65356a1d04e98ae9d51ff50d62eec9f2532441ffd403ff

Download Submit
memory/1796-54-0x0000000076C61000-0x0000000076C63000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads