sakula | 0b78ab5f8c6b1e8bdd436517a822620084c865908de9706ebcd6008630a42a41

General

Target

0b78ab5f8c6b1e8bdd436517a822620084c865908de9706ebcd6008630a42a41.exe
Size

58KB
MD5

fc3cab6d5c326d21e033e3f5e72b80ec
SHA1

76043dfc52d0aeb4f7241a38a546833711ab7be2
SHA256

0b78ab5f8c6b1e8bdd436517a822620084c865908de9706ebcd6008630a42a41
SHA512

3ce391fad344da18661ea0db55742c33e47aec180fc1086848124608d05cd11afbda7747f1d50758dd74319884c60e945458cd33826e732f1d289cfa356e17d5

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

3588 MediaCenter.exe

pid	process
3588	MediaCenter.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

0b78ab5f8c6b1e8bdd436517a822620084c865908de9706ebcd6008630a42a41.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	0b78ab5f8c6b1e8bdd436517a822620084c865908de9706ebcd6008630a42a41.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

0b78ab5f8c6b1e8bdd436517a822620084c865908de9706ebcd6008630a42a41.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	0b78ab5f8c6b1e8bdd436517a822620084c865908de9706ebcd6008630a42a41.exe

Drops file in Windows directory 8 IoCs

Processes:

svchost.exeTiWorker.exe

description	ioc	process
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TiWorker.exe
File opened for modification	C:\Windows\WinSxS\pending.xml	TiWorker.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2892 PING.EXE

pid	process
2892	PING.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

svchost.exeTiWorker.exe0b78ab5f8c6b1e8bdd436517a822620084c865908de9706ebcd6008630a42a41.exe

description	pid	process
Token: SeShutdownPrivilege	2860	svchost.exe
Token: SeCreatePagefilePrivilege	2860	svchost.exe
Token: SeShutdownPrivilege	2860	svchost.exe
Token: SeCreatePagefilePrivilege	2860	svchost.exe
Token: SeShutdownPrivilege	2860	svchost.exe
Token: SeCreatePagefilePrivilege	2860	svchost.exe
Token: SeSecurityPrivilege	308	TiWorker.exe
Token: SeRestorePrivilege	308	TiWorker.exe
Token: SeBackupPrivilege	308	TiWorker.exe
Token: SeBackupPrivilege	308	TiWorker.exe
Token: SeRestorePrivilege	308	TiWorker.exe
Token: SeSecurityPrivilege	308	TiWorker.exe
Token: SeBackupPrivilege	308	TiWorker.exe
Token: SeRestorePrivilege	308	TiWorker.exe
Token: SeSecurityPrivilege	308	TiWorker.exe
Token: SeBackupPrivilege	308	TiWorker.exe
Token: SeRestorePrivilege	308	TiWorker.exe
Token: SeSecurityPrivilege	308	TiWorker.exe
Token: SeBackupPrivilege	308	TiWorker.exe
Token: SeRestorePrivilege	308	TiWorker.exe
Token: SeSecurityPrivilege	308	TiWorker.exe
Token: SeBackupPrivilege	308	TiWorker.exe
Token: SeRestorePrivilege	308	TiWorker.exe
Token: SeSecurityPrivilege	308	TiWorker.exe
Token: SeBackupPrivilege	308	TiWorker.exe
Token: SeRestorePrivilege	308	TiWorker.exe
Token: SeSecurityPrivilege	308	TiWorker.exe
Token: SeBackupPrivilege	308	TiWorker.exe
Token: SeRestorePrivilege	308	TiWorker.exe
Token: SeSecurityPrivilege	308	TiWorker.exe
Token: SeBackupPrivilege	308	TiWorker.exe
Token: SeRestorePrivilege	308	TiWorker.exe
Token: SeSecurityPrivilege	308	TiWorker.exe
Token: SeBackupPrivilege	308	TiWorker.exe
Token: SeRestorePrivilege	308	TiWorker.exe
Token: SeSecurityPrivilege	308	TiWorker.exe
Token: SeBackupPrivilege	308	TiWorker.exe
Token: SeRestorePrivilege	308	TiWorker.exe
Token: SeSecurityPrivilege	308	TiWorker.exe
Token: SeBackupPrivilege	308	TiWorker.exe
Token: SeRestorePrivilege	308	TiWorker.exe
Token: SeSecurityPrivilege	308	TiWorker.exe
Token: SeBackupPrivilege	308	TiWorker.exe
Token: SeRestorePrivilege	308	TiWorker.exe
Token: SeSecurityPrivilege	308	TiWorker.exe
Token: SeBackupPrivilege	308	TiWorker.exe
Token: SeRestorePrivilege	308	TiWorker.exe
Token: SeSecurityPrivilege	308	TiWorker.exe
Token: SeBackupPrivilege	308	TiWorker.exe
Token: SeRestorePrivilege	308	TiWorker.exe
Token: SeSecurityPrivilege	308	TiWorker.exe
Token: SeBackupPrivilege	308	TiWorker.exe
Token: SeRestorePrivilege	308	TiWorker.exe
Token: SeSecurityPrivilege	308	TiWorker.exe
Token: SeIncBasePriorityPrivilege	3652	0b78ab5f8c6b1e8bdd436517a822620084c865908de9706ebcd6008630a42a41.exe
Token: SeBackupPrivilege	308	TiWorker.exe
Token: SeRestorePrivilege	308	TiWorker.exe
Token: SeSecurityPrivilege	308	TiWorker.exe
Token: SeBackupPrivilege	308	TiWorker.exe
Token: SeRestorePrivilege	308	TiWorker.exe
Token: SeSecurityPrivilege	308	TiWorker.exe
Token: SeBackupPrivilege	308	TiWorker.exe
Token: SeRestorePrivilege	308	TiWorker.exe
Token: SeSecurityPrivilege	308	TiWorker.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

0b78ab5f8c6b1e8bdd436517a822620084c865908de9706ebcd6008630a42a41.execmd.exe

description	pid	process	target process
PID 3652 wrote to memory of 3588	3652	0b78ab5f8c6b1e8bdd436517a822620084c865908de9706ebcd6008630a42a41.exe	MediaCenter.exe
PID 3652 wrote to memory of 3588	3652	0b78ab5f8c6b1e8bdd436517a822620084c865908de9706ebcd6008630a42a41.exe	MediaCenter.exe
PID 3652 wrote to memory of 3588	3652	0b78ab5f8c6b1e8bdd436517a822620084c865908de9706ebcd6008630a42a41.exe	MediaCenter.exe
PID 3652 wrote to memory of 752	3652	0b78ab5f8c6b1e8bdd436517a822620084c865908de9706ebcd6008630a42a41.exe	cmd.exe
PID 3652 wrote to memory of 752	3652	0b78ab5f8c6b1e8bdd436517a822620084c865908de9706ebcd6008630a42a41.exe	cmd.exe
PID 3652 wrote to memory of 752	3652	0b78ab5f8c6b1e8bdd436517a822620084c865908de9706ebcd6008630a42a41.exe	cmd.exe
PID 752 wrote to memory of 2892	752	cmd.exe	PING.EXE
PID 752 wrote to memory of 2892	752	cmd.exe	PING.EXE
PID 752 wrote to memory of 2892	752	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\0b78ab5f8c6b1e8bdd436517a822620084c865908de9706ebcd6008630a42a41.exe
"C:\Users\Admin\AppData\Local\Temp\0b78ab5f8c6b1e8bdd436517a822620084c865908de9706ebcd6008630a42a41.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3652

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:3588

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\0b78ab5f8c6b1e8bdd436517a822620084c865908de9706ebcd6008630a42a41.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:752

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:2892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2860

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:308

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
2d52df1e3f99ac76e99f27c65c7786e6

SHA1
8eb8066a6365bfac295a95c2ce104ac6a6617b2e

SHA256
900ce6d7219134e3ffdbf0cbb531801ae5a7f1b7116f7d72a28f7b559b2fc4d5

SHA512
876b145d22e702117c768caf6a3a9a1c65cb6ec32e65503beb526718d6e94fb07b67b14d049bccad0b7206f85cf363695e1677176d55df7ed2c2b92e5a148c3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
2d52df1e3f99ac76e99f27c65c7786e6

SHA1
8eb8066a6365bfac295a95c2ce104ac6a6617b2e

SHA256
900ce6d7219134e3ffdbf0cbb531801ae5a7f1b7116f7d72a28f7b559b2fc4d5

SHA512
876b145d22e702117c768caf6a3a9a1c65cb6ec32e65503beb526718d6e94fb07b67b14d049bccad0b7206f85cf363695e1677176d55df7ed2c2b92e5a148c3c

Download Submit
memory/2860-132-0x0000017D44D30000-0x0000017D44D40000-memory.dmp

Filesize
64KB

Download
memory/2860-133-0x0000017D44D90000-0x0000017D44DA0000-memory.dmp

Filesize
64KB

Download
memory/2860-134-0x0000017D47A70000-0x0000017D47A74000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads