sakula | 0e439ff4e827a41d9513b26099b1eaffffb2aabb2b83235a7a801e1818286381

General

Target

0e439ff4e827a41d9513b26099b1eaffffb2aabb2b83235a7a801e1818286381.exe
Size

144KB
MD5

e1785323da170f02d95821e884a8d25e
SHA1

587e804666710b78b129d5e72d22f6218ec6331e
SHA256

0e439ff4e827a41d9513b26099b1eaffffb2aabb2b83235a7a801e1818286381
SHA512

90b90189c219aa17096ee2a8dda68d4ce328ffbec9165e01a7bfd0e57fa8a5d9ecf5df26c2fc2859ce68b5405b2ebfc02a65c53ef1a7c872e1dd69cf7a1dc217

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula Payload 4 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
behavioral1/memory/1648-59-0x0000000000400000-0x0000000000420000-memory.dmp	family_sakula
behavioral1/memory/1372-60-0x0000000000400000-0x0000000000420000-memory.dmp	family_sakula

Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1372 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

592 cmd.exe
Loads dropped DLL 1 IoCs

Processes:

0e439ff4e827a41d9513b26099b1eaffffb2aabb2b83235a7a801e1818286381.exe

pid process

1648 0e439ff4e827a41d9513b26099b1eaffffb2aabb2b83235a7a801e1818286381.exe

pid	process
1372	MediaCenter.exe

pid	process
592	cmd.exe

pid	process
1648	0e439ff4e827a41d9513b26099b1eaffffb2aabb2b83235a7a801e1818286381.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

0e439ff4e827a41d9513b26099b1eaffffb2aabb2b83235a7a801e1818286381.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	0e439ff4e827a41d9513b26099b1eaffffb2aabb2b83235a7a801e1818286381.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1164 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0e439ff4e827a41d9513b26099b1eaffffb2aabb2b83235a7a801e1818286381.exe

description pid process

Token: SeIncBasePriorityPrivilege 1648 0e439ff4e827a41d9513b26099b1eaffffb2aabb2b83235a7a801e1818286381.exe

pid	process
1164	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1648	0e439ff4e827a41d9513b26099b1eaffffb2aabb2b83235a7a801e1818286381.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

0e439ff4e827a41d9513b26099b1eaffffb2aabb2b83235a7a801e1818286381.execmd.exe

description	pid	process	target process
PID 1648 wrote to memory of 1372	1648	0e439ff4e827a41d9513b26099b1eaffffb2aabb2b83235a7a801e1818286381.exe	MediaCenter.exe
PID 1648 wrote to memory of 1372	1648	0e439ff4e827a41d9513b26099b1eaffffb2aabb2b83235a7a801e1818286381.exe	MediaCenter.exe
PID 1648 wrote to memory of 1372	1648	0e439ff4e827a41d9513b26099b1eaffffb2aabb2b83235a7a801e1818286381.exe	MediaCenter.exe
PID 1648 wrote to memory of 1372	1648	0e439ff4e827a41d9513b26099b1eaffffb2aabb2b83235a7a801e1818286381.exe	MediaCenter.exe
PID 1648 wrote to memory of 592	1648	0e439ff4e827a41d9513b26099b1eaffffb2aabb2b83235a7a801e1818286381.exe	cmd.exe
PID 1648 wrote to memory of 592	1648	0e439ff4e827a41d9513b26099b1eaffffb2aabb2b83235a7a801e1818286381.exe	cmd.exe
PID 1648 wrote to memory of 592	1648	0e439ff4e827a41d9513b26099b1eaffffb2aabb2b83235a7a801e1818286381.exe	cmd.exe
PID 1648 wrote to memory of 592	1648	0e439ff4e827a41d9513b26099b1eaffffb2aabb2b83235a7a801e1818286381.exe	cmd.exe
PID 592 wrote to memory of 1164	592	cmd.exe	PING.EXE
PID 592 wrote to memory of 1164	592	cmd.exe	PING.EXE
PID 592 wrote to memory of 1164	592	cmd.exe	PING.EXE
PID 592 wrote to memory of 1164	592	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\0e439ff4e827a41d9513b26099b1eaffffb2aabb2b83235a7a801e1818286381.exe
"C:\Users\Admin\AppData\Local\Temp\0e439ff4e827a41d9513b26099b1eaffffb2aabb2b83235a7a801e1818286381.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1648

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1372

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\0e439ff4e827a41d9513b26099b1eaffffb2aabb2b83235a7a801e1818286381.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:592

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1164

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
96ae30a74b13bb1759e863b855b5e64b

SHA1
de81fcfda511578e72f9dffebf026f231cac0f65

SHA256
2f8f362b4c0f00c1bd93ec7897dd9137cbb822c042145808a506ba72ce01d171

SHA512
d31a70acf06416865ad36e8d052830ce661a136bc3a4aa8a29c57fe6a28621ce2b2aea79c1551e6e4e711d1cb8d5180cd20465b7cc0612780b542aa20683564f

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
96ae30a74b13bb1759e863b855b5e64b

SHA1
de81fcfda511578e72f9dffebf026f231cac0f65

SHA256
2f8f362b4c0f00c1bd93ec7897dd9137cbb822c042145808a506ba72ce01d171

SHA512
d31a70acf06416865ad36e8d052830ce661a136bc3a4aa8a29c57fe6a28621ce2b2aea79c1551e6e4e711d1cb8d5180cd20465b7cc0612780b542aa20683564f

Download Submit
memory/1372-60-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1648-55-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download
memory/1648-59-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads