sakula | 0e6ff585ba81aa0bde6a53600951d1f598baa5f5019ee5c05d14e9a22ae02ea3

General

Target

0e6ff585ba81aa0bde6a53600951d1f598baa5f5019ee5c05d14e9a22ae02ea3.exe
Size

60KB
MD5

d48c9e7248c2ff9f83da185de29fe31c
SHA1

16194482c265650bb817828c54e6fe524f6f67b2
SHA256

0e6ff585ba81aa0bde6a53600951d1f598baa5f5019ee5c05d14e9a22ae02ea3
SHA512

6b3fffeb10a8a772e3138d7a851a73581b91223e7817cf5f19316cd8bbda8768975e646fe08823adc61ebd3152f7e34800d9b4d71171d5df0fb92b00daf03728

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1864 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

432 cmd.exe

pid	process
1864	MediaCenter.exe

pid	process
432	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

0e6ff585ba81aa0bde6a53600951d1f598baa5f5019ee5c05d14e9a22ae02ea3.exe

pid	process
952	0e6ff585ba81aa0bde6a53600951d1f598baa5f5019ee5c05d14e9a22ae02ea3.exe
952	0e6ff585ba81aa0bde6a53600951d1f598baa5f5019ee5c05d14e9a22ae02ea3.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

0e6ff585ba81aa0bde6a53600951d1f598baa5f5019ee5c05d14e9a22ae02ea3.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	0e6ff585ba81aa0bde6a53600951d1f598baa5f5019ee5c05d14e9a22ae02ea3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1996 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0e6ff585ba81aa0bde6a53600951d1f598baa5f5019ee5c05d14e9a22ae02ea3.exe

description pid process

Token: SeIncBasePriorityPrivilege 952 0e6ff585ba81aa0bde6a53600951d1f598baa5f5019ee5c05d14e9a22ae02ea3.exe

pid	process
1996	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	952	0e6ff585ba81aa0bde6a53600951d1f598baa5f5019ee5c05d14e9a22ae02ea3.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

0e6ff585ba81aa0bde6a53600951d1f598baa5f5019ee5c05d14e9a22ae02ea3.execmd.exe

description	pid	process	target process
PID 952 wrote to memory of 1864	952	0e6ff585ba81aa0bde6a53600951d1f598baa5f5019ee5c05d14e9a22ae02ea3.exe	MediaCenter.exe
PID 952 wrote to memory of 1864	952	0e6ff585ba81aa0bde6a53600951d1f598baa5f5019ee5c05d14e9a22ae02ea3.exe	MediaCenter.exe
PID 952 wrote to memory of 1864	952	0e6ff585ba81aa0bde6a53600951d1f598baa5f5019ee5c05d14e9a22ae02ea3.exe	MediaCenter.exe
PID 952 wrote to memory of 1864	952	0e6ff585ba81aa0bde6a53600951d1f598baa5f5019ee5c05d14e9a22ae02ea3.exe	MediaCenter.exe
PID 952 wrote to memory of 432	952	0e6ff585ba81aa0bde6a53600951d1f598baa5f5019ee5c05d14e9a22ae02ea3.exe	cmd.exe
PID 952 wrote to memory of 432	952	0e6ff585ba81aa0bde6a53600951d1f598baa5f5019ee5c05d14e9a22ae02ea3.exe	cmd.exe
PID 952 wrote to memory of 432	952	0e6ff585ba81aa0bde6a53600951d1f598baa5f5019ee5c05d14e9a22ae02ea3.exe	cmd.exe
PID 952 wrote to memory of 432	952	0e6ff585ba81aa0bde6a53600951d1f598baa5f5019ee5c05d14e9a22ae02ea3.exe	cmd.exe
PID 432 wrote to memory of 1996	432	cmd.exe	PING.EXE
PID 432 wrote to memory of 1996	432	cmd.exe	PING.EXE
PID 432 wrote to memory of 1996	432	cmd.exe	PING.EXE
PID 432 wrote to memory of 1996	432	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\0e6ff585ba81aa0bde6a53600951d1f598baa5f5019ee5c05d14e9a22ae02ea3.exe
"C:\Users\Admin\AppData\Local\Temp\0e6ff585ba81aa0bde6a53600951d1f598baa5f5019ee5c05d14e9a22ae02ea3.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:952

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1864

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\0e6ff585ba81aa0bde6a53600951d1f598baa5f5019ee5c05d14e9a22ae02ea3.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:432

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1996

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
c785b74062369e6abb3f6676361bcb81

SHA1
84e1eb1573a73eef2abf28d7936d015fe7c7b045

SHA256
e6d65f9c14491c9d01c7fbd92b32d6065a0d49c5f4e0df372bdf703c6201890e

SHA512
974dcb2a19de1035a548191190ae2a98fd8f56ab2fb4df0dc6da1417449ee759aa632c35f1b0c9950696039ba301a2aab0b7c42cfe5aa4934f83c2b78d024e3e

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
c785b74062369e6abb3f6676361bcb81

SHA1
84e1eb1573a73eef2abf28d7936d015fe7c7b045

SHA256
e6d65f9c14491c9d01c7fbd92b32d6065a0d49c5f4e0df372bdf703c6201890e

SHA512
974dcb2a19de1035a548191190ae2a98fd8f56ab2fb4df0dc6da1417449ee759aa632c35f1b0c9950696039ba301a2aab0b7c42cfe5aa4934f83c2b78d024e3e

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
c785b74062369e6abb3f6676361bcb81

SHA1
84e1eb1573a73eef2abf28d7936d015fe7c7b045

SHA256
e6d65f9c14491c9d01c7fbd92b32d6065a0d49c5f4e0df372bdf703c6201890e

SHA512
974dcb2a19de1035a548191190ae2a98fd8f56ab2fb4df0dc6da1417449ee759aa632c35f1b0c9950696039ba301a2aab0b7c42cfe5aa4934f83c2b78d024e3e

Download Submit
memory/952-54-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads