sakula | 0f6d183cc26531251ccc142466c62642613eb9fb04d8f04c4e4fefa9946ef01d

General

Target

0f6d183cc26531251ccc142466c62642613eb9fb04d8f04c4e4fefa9946ef01d.exe
Size

80KB
MD5

2cb59ab19510f2d71703c681013771a4
SHA1

a0fe501768860d73f659404afa2395c633b2995d
SHA256

0f6d183cc26531251ccc142466c62642613eb9fb04d8f04c4e4fefa9946ef01d
SHA512

9c9892203fe15958256ff98e20f7fc1e57444cc3c54f7b8ab9c7053ede733c354c4344953325d65bdffb08600d3194e10512899ee44b4e69ed462f43e21e5866

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula Payload 3 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula

Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1700 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1952 cmd.exe

pid	process
1700	MediaCenter.exe

pid	process
1952	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

0f6d183cc26531251ccc142466c62642613eb9fb04d8f04c4e4fefa9946ef01d.exe

pid	process
1780	0f6d183cc26531251ccc142466c62642613eb9fb04d8f04c4e4fefa9946ef01d.exe
1780	0f6d183cc26531251ccc142466c62642613eb9fb04d8f04c4e4fefa9946ef01d.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

0f6d183cc26531251ccc142466c62642613eb9fb04d8f04c4e4fefa9946ef01d.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	0f6d183cc26531251ccc142466c62642613eb9fb04d8f04c4e4fefa9946ef01d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1096 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0f6d183cc26531251ccc142466c62642613eb9fb04d8f04c4e4fefa9946ef01d.exe

description pid process

Token: SeIncBasePriorityPrivilege 1780 0f6d183cc26531251ccc142466c62642613eb9fb04d8f04c4e4fefa9946ef01d.exe

pid	process
1096	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1780	0f6d183cc26531251ccc142466c62642613eb9fb04d8f04c4e4fefa9946ef01d.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

0f6d183cc26531251ccc142466c62642613eb9fb04d8f04c4e4fefa9946ef01d.execmd.exe

description	pid	process	target process
PID 1780 wrote to memory of 1700	1780	0f6d183cc26531251ccc142466c62642613eb9fb04d8f04c4e4fefa9946ef01d.exe	MediaCenter.exe
PID 1780 wrote to memory of 1700	1780	0f6d183cc26531251ccc142466c62642613eb9fb04d8f04c4e4fefa9946ef01d.exe	MediaCenter.exe
PID 1780 wrote to memory of 1700	1780	0f6d183cc26531251ccc142466c62642613eb9fb04d8f04c4e4fefa9946ef01d.exe	MediaCenter.exe
PID 1780 wrote to memory of 1700	1780	0f6d183cc26531251ccc142466c62642613eb9fb04d8f04c4e4fefa9946ef01d.exe	MediaCenter.exe
PID 1780 wrote to memory of 1952	1780	0f6d183cc26531251ccc142466c62642613eb9fb04d8f04c4e4fefa9946ef01d.exe	cmd.exe
PID 1780 wrote to memory of 1952	1780	0f6d183cc26531251ccc142466c62642613eb9fb04d8f04c4e4fefa9946ef01d.exe	cmd.exe
PID 1780 wrote to memory of 1952	1780	0f6d183cc26531251ccc142466c62642613eb9fb04d8f04c4e4fefa9946ef01d.exe	cmd.exe
PID 1780 wrote to memory of 1952	1780	0f6d183cc26531251ccc142466c62642613eb9fb04d8f04c4e4fefa9946ef01d.exe	cmd.exe
PID 1952 wrote to memory of 1096	1952	cmd.exe	PING.EXE
PID 1952 wrote to memory of 1096	1952	cmd.exe	PING.EXE
PID 1952 wrote to memory of 1096	1952	cmd.exe	PING.EXE
PID 1952 wrote to memory of 1096	1952	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\0f6d183cc26531251ccc142466c62642613eb9fb04d8f04c4e4fefa9946ef01d.exe
"C:\Users\Admin\AppData\Local\Temp\0f6d183cc26531251ccc142466c62642613eb9fb04d8f04c4e4fefa9946ef01d.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1780

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1700

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\0f6d183cc26531251ccc142466c62642613eb9fb04d8f04c4e4fefa9946ef01d.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1952

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1096

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
f5bccbf35f8d36d027bd9e6fc457721e

SHA1
48d9e1a8616a0d68432edc817ccdb2f4c70f21bc

SHA256
8c2bc25af18a984672e7f889271f2f5675992e2e3392c777e2b04a0b896776ab

SHA512
fd80682859535a50c6e28a0ff99ed48beda2e58d0a87296f978492d260181ebfbc56a7bc3f8f75a3745567192789f9ece612b3aebb51f1da04290096a03f8a9c

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
f5bccbf35f8d36d027bd9e6fc457721e

SHA1
48d9e1a8616a0d68432edc817ccdb2f4c70f21bc

SHA256
8c2bc25af18a984672e7f889271f2f5675992e2e3392c777e2b04a0b896776ab

SHA512
fd80682859535a50c6e28a0ff99ed48beda2e58d0a87296f978492d260181ebfbc56a7bc3f8f75a3745567192789f9ece612b3aebb51f1da04290096a03f8a9c

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
f5bccbf35f8d36d027bd9e6fc457721e

SHA1
48d9e1a8616a0d68432edc817ccdb2f4c70f21bc

SHA256
8c2bc25af18a984672e7f889271f2f5675992e2e3392c777e2b04a0b896776ab

SHA512
fd80682859535a50c6e28a0ff99ed48beda2e58d0a87296f978492d260181ebfbc56a7bc3f8f75a3745567192789f9ece612b3aebb51f1da04290096a03f8a9c

Download Submit
memory/1780-55-0x0000000075F91000-0x0000000075F93000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads