sakula | 0f8e0c0b8c902fd9950ee539ad3da3c2f4d15881dae27e01c3aa979383064a61

General

Target

0f8e0c0b8c902fd9950ee539ad3da3c2f4d15881dae27e01c3aa979383064a61.exe
Size

144KB
MD5

9cfdd52318b4fdc5209eae48c9b2b723
SHA1

fb7cd36e476881bd97774ffc345e5fd517774f7d
SHA256

0f8e0c0b8c902fd9950ee539ad3da3c2f4d15881dae27e01c3aa979383064a61
SHA512

1178183104c009724208cea1231fc8e43692e473d2924253f85969ff0ce80d909130de1bdfdd4b4b7d05879e34100ae9d9a3ba1525d34089fcfeb4e2163ad0bf

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula Payload 3 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula

Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1932 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1088 cmd.exe

pid	process
1932	MediaCenter.exe

pid	process
1088	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

0f8e0c0b8c902fd9950ee539ad3da3c2f4d15881dae27e01c3aa979383064a61.exe

pid	process
1388	0f8e0c0b8c902fd9950ee539ad3da3c2f4d15881dae27e01c3aa979383064a61.exe
1388	0f8e0c0b8c902fd9950ee539ad3da3c2f4d15881dae27e01c3aa979383064a61.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

0f8e0c0b8c902fd9950ee539ad3da3c2f4d15881dae27e01c3aa979383064a61.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	0f8e0c0b8c902fd9950ee539ad3da3c2f4d15881dae27e01c3aa979383064a61.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1164 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0f8e0c0b8c902fd9950ee539ad3da3c2f4d15881dae27e01c3aa979383064a61.exe

description pid process

Token: SeIncBasePriorityPrivilege 1388 0f8e0c0b8c902fd9950ee539ad3da3c2f4d15881dae27e01c3aa979383064a61.exe

pid	process
1164	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1388	0f8e0c0b8c902fd9950ee539ad3da3c2f4d15881dae27e01c3aa979383064a61.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

0f8e0c0b8c902fd9950ee539ad3da3c2f4d15881dae27e01c3aa979383064a61.execmd.exe

description	pid	process	target process
PID 1388 wrote to memory of 1932	1388	0f8e0c0b8c902fd9950ee539ad3da3c2f4d15881dae27e01c3aa979383064a61.exe	MediaCenter.exe
PID 1388 wrote to memory of 1932	1388	0f8e0c0b8c902fd9950ee539ad3da3c2f4d15881dae27e01c3aa979383064a61.exe	MediaCenter.exe
PID 1388 wrote to memory of 1932	1388	0f8e0c0b8c902fd9950ee539ad3da3c2f4d15881dae27e01c3aa979383064a61.exe	MediaCenter.exe
PID 1388 wrote to memory of 1932	1388	0f8e0c0b8c902fd9950ee539ad3da3c2f4d15881dae27e01c3aa979383064a61.exe	MediaCenter.exe
PID 1388 wrote to memory of 1088	1388	0f8e0c0b8c902fd9950ee539ad3da3c2f4d15881dae27e01c3aa979383064a61.exe	cmd.exe
PID 1388 wrote to memory of 1088	1388	0f8e0c0b8c902fd9950ee539ad3da3c2f4d15881dae27e01c3aa979383064a61.exe	cmd.exe
PID 1388 wrote to memory of 1088	1388	0f8e0c0b8c902fd9950ee539ad3da3c2f4d15881dae27e01c3aa979383064a61.exe	cmd.exe
PID 1388 wrote to memory of 1088	1388	0f8e0c0b8c902fd9950ee539ad3da3c2f4d15881dae27e01c3aa979383064a61.exe	cmd.exe
PID 1088 wrote to memory of 1164	1088	cmd.exe	PING.EXE
PID 1088 wrote to memory of 1164	1088	cmd.exe	PING.EXE
PID 1088 wrote to memory of 1164	1088	cmd.exe	PING.EXE
PID 1088 wrote to memory of 1164	1088	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\0f8e0c0b8c902fd9950ee539ad3da3c2f4d15881dae27e01c3aa979383064a61.exe
"C:\Users\Admin\AppData\Local\Temp\0f8e0c0b8c902fd9950ee539ad3da3c2f4d15881dae27e01c3aa979383064a61.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1388

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1932

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\0f8e0c0b8c902fd9950ee539ad3da3c2f4d15881dae27e01c3aa979383064a61.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1088

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1164

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
85394fbc0e9aff845be81f1efab013b6

SHA1
d8e18979c2de332aace4a0c3b98b6ce1b8488413

SHA256
00764383af79cd601564a7356f10879087d3afad5dce39e569b149604e4fa9be

SHA512
ba008abbdbdf8b84922ef65ce7fd61c180b91084d5362e40643b5a1498909d656dd7c38697ce886d5ecc8ccc8b271757dd0a526f6659b0b1dfeb1ecbfc463e42

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
85394fbc0e9aff845be81f1efab013b6

SHA1
d8e18979c2de332aace4a0c3b98b6ce1b8488413

SHA256
00764383af79cd601564a7356f10879087d3afad5dce39e569b149604e4fa9be

SHA512
ba008abbdbdf8b84922ef65ce7fd61c180b91084d5362e40643b5a1498909d656dd7c38697ce886d5ecc8ccc8b271757dd0a526f6659b0b1dfeb1ecbfc463e42

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
85394fbc0e9aff845be81f1efab013b6

SHA1
d8e18979c2de332aace4a0c3b98b6ce1b8488413

SHA256
00764383af79cd601564a7356f10879087d3afad5dce39e569b149604e4fa9be

SHA512
ba008abbdbdf8b84922ef65ce7fd61c180b91084d5362e40643b5a1498909d656dd7c38697ce886d5ecc8ccc8b271757dd0a526f6659b0b1dfeb1ecbfc463e42

Download Submit
memory/1388-55-0x00000000758A1000-0x00000000758A3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads