sakula | 0fc53c045233c145c90521b5b49b258d9fa2c623d73382eb2439255f835f1ef0

General

Target

0fc53c045233c145c90521b5b49b258d9fa2c623d73382eb2439255f835f1ef0.exe
Size

99KB
MD5

2b1708fbbcb031f89ee204ffa27f56a5
SHA1

bc47e8b8b2b353bed823fbb786c4738de29efc57
SHA256

0fc53c045233c145c90521b5b49b258d9fa2c623d73382eb2439255f835f1ef0
SHA512

7da01976173fffe50d2c0aeabf957c569a63a352a42e1ea44c6229d5ddc6577105e3eec111dfd10e3c5ccf5f431166a8d8826b2f2d2eda54f4fb5430401b1bd9

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula Payload 3 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula

Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

764 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1568 cmd.exe

pid	process
764	MediaCenter.exe

pid	process
1568	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

0fc53c045233c145c90521b5b49b258d9fa2c623d73382eb2439255f835f1ef0.exe

pid	process
1804	0fc53c045233c145c90521b5b49b258d9fa2c623d73382eb2439255f835f1ef0.exe
1804	0fc53c045233c145c90521b5b49b258d9fa2c623d73382eb2439255f835f1ef0.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

0fc53c045233c145c90521b5b49b258d9fa2c623d73382eb2439255f835f1ef0.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	0fc53c045233c145c90521b5b49b258d9fa2c623d73382eb2439255f835f1ef0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

988 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0fc53c045233c145c90521b5b49b258d9fa2c623d73382eb2439255f835f1ef0.exe

description pid process

Token: SeIncBasePriorityPrivilege 1804 0fc53c045233c145c90521b5b49b258d9fa2c623d73382eb2439255f835f1ef0.exe

pid	process
988	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1804	0fc53c045233c145c90521b5b49b258d9fa2c623d73382eb2439255f835f1ef0.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

0fc53c045233c145c90521b5b49b258d9fa2c623d73382eb2439255f835f1ef0.execmd.exe

description	pid	process	target process
PID 1804 wrote to memory of 764	1804	0fc53c045233c145c90521b5b49b258d9fa2c623d73382eb2439255f835f1ef0.exe	MediaCenter.exe
PID 1804 wrote to memory of 764	1804	0fc53c045233c145c90521b5b49b258d9fa2c623d73382eb2439255f835f1ef0.exe	MediaCenter.exe
PID 1804 wrote to memory of 764	1804	0fc53c045233c145c90521b5b49b258d9fa2c623d73382eb2439255f835f1ef0.exe	MediaCenter.exe
PID 1804 wrote to memory of 764	1804	0fc53c045233c145c90521b5b49b258d9fa2c623d73382eb2439255f835f1ef0.exe	MediaCenter.exe
PID 1804 wrote to memory of 1568	1804	0fc53c045233c145c90521b5b49b258d9fa2c623d73382eb2439255f835f1ef0.exe	cmd.exe
PID 1804 wrote to memory of 1568	1804	0fc53c045233c145c90521b5b49b258d9fa2c623d73382eb2439255f835f1ef0.exe	cmd.exe
PID 1804 wrote to memory of 1568	1804	0fc53c045233c145c90521b5b49b258d9fa2c623d73382eb2439255f835f1ef0.exe	cmd.exe
PID 1804 wrote to memory of 1568	1804	0fc53c045233c145c90521b5b49b258d9fa2c623d73382eb2439255f835f1ef0.exe	cmd.exe
PID 1568 wrote to memory of 988	1568	cmd.exe	PING.EXE
PID 1568 wrote to memory of 988	1568	cmd.exe	PING.EXE
PID 1568 wrote to memory of 988	1568	cmd.exe	PING.EXE
PID 1568 wrote to memory of 988	1568	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\0fc53c045233c145c90521b5b49b258d9fa2c623d73382eb2439255f835f1ef0.exe
"C:\Users\Admin\AppData\Local\Temp\0fc53c045233c145c90521b5b49b258d9fa2c623d73382eb2439255f835f1ef0.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1804

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:764

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\0fc53c045233c145c90521b5b49b258d9fa2c623d73382eb2439255f835f1ef0.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1568

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:988

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
2438f82d699c3b4ee8125ae29c2cf2b2

SHA1
0472f2c5468e1eff76a7e76dc8507bf5335a527e

SHA256
52fe24d45a7b6cbd5dcf8318053048cbbbb72ed63aa552059f7444aa8be96f8c

SHA512
cadb837c74c533d267e53a594b2976023aaf78ffeb5d69ef3485018c67899166fa075b1424242444c0c1a87ec6fe088fa40ba132da08a8a28b1c179196dff296

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
2438f82d699c3b4ee8125ae29c2cf2b2

SHA1
0472f2c5468e1eff76a7e76dc8507bf5335a527e

SHA256
52fe24d45a7b6cbd5dcf8318053048cbbbb72ed63aa552059f7444aa8be96f8c

SHA512
cadb837c74c533d267e53a594b2976023aaf78ffeb5d69ef3485018c67899166fa075b1424242444c0c1a87ec6fe088fa40ba132da08a8a28b1c179196dff296

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
2438f82d699c3b4ee8125ae29c2cf2b2

SHA1
0472f2c5468e1eff76a7e76dc8507bf5335a527e

SHA256
52fe24d45a7b6cbd5dcf8318053048cbbbb72ed63aa552059f7444aa8be96f8c

SHA512
cadb837c74c533d267e53a594b2976023aaf78ffeb5d69ef3485018c67899166fa075b1424242444c0c1a87ec6fe088fa40ba132da08a8a28b1c179196dff296

Download Submit
memory/1804-55-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads