sakula | 0b5f7e93218d13ae98105682824f367059e1c315b317cf95dca635f5be1a3547

General

Target

0b5f7e93218d13ae98105682824f367059e1c315b317cf95dca635f5be1a3547.exe
Size

80KB
MD5

cceca84e4d9259ef5d7c011635c47d5e
SHA1

5619e55c8b7f1b6c5760995066c0bea5375dde20
SHA256

0b5f7e93218d13ae98105682824f367059e1c315b317cf95dca635f5be1a3547
SHA512

42e42195d7cfc0dffe46ef80d8bf0bebbf720fa0f3acc1d2acee47f1162208b72869e1fd0118572e1b33f427b06000c55a4bb5e0a1a013bcbd397e968481caed

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula Payload 3 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula

Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

516 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1188 cmd.exe

pid	process
516	MediaCenter.exe

pid	process
1188	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

0b5f7e93218d13ae98105682824f367059e1c315b317cf95dca635f5be1a3547.exe

pid	process
956	0b5f7e93218d13ae98105682824f367059e1c315b317cf95dca635f5be1a3547.exe
956	0b5f7e93218d13ae98105682824f367059e1c315b317cf95dca635f5be1a3547.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

0b5f7e93218d13ae98105682824f367059e1c315b317cf95dca635f5be1a3547.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	0b5f7e93218d13ae98105682824f367059e1c315b317cf95dca635f5be1a3547.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1184 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0b5f7e93218d13ae98105682824f367059e1c315b317cf95dca635f5be1a3547.exe

description pid process

Token: SeIncBasePriorityPrivilege 956 0b5f7e93218d13ae98105682824f367059e1c315b317cf95dca635f5be1a3547.exe

pid	process
1184	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	956	0b5f7e93218d13ae98105682824f367059e1c315b317cf95dca635f5be1a3547.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

0b5f7e93218d13ae98105682824f367059e1c315b317cf95dca635f5be1a3547.execmd.exe

description	pid	process	target process
PID 956 wrote to memory of 516	956	0b5f7e93218d13ae98105682824f367059e1c315b317cf95dca635f5be1a3547.exe	MediaCenter.exe
PID 956 wrote to memory of 516	956	0b5f7e93218d13ae98105682824f367059e1c315b317cf95dca635f5be1a3547.exe	MediaCenter.exe
PID 956 wrote to memory of 516	956	0b5f7e93218d13ae98105682824f367059e1c315b317cf95dca635f5be1a3547.exe	MediaCenter.exe
PID 956 wrote to memory of 516	956	0b5f7e93218d13ae98105682824f367059e1c315b317cf95dca635f5be1a3547.exe	MediaCenter.exe
PID 956 wrote to memory of 1188	956	0b5f7e93218d13ae98105682824f367059e1c315b317cf95dca635f5be1a3547.exe	cmd.exe
PID 956 wrote to memory of 1188	956	0b5f7e93218d13ae98105682824f367059e1c315b317cf95dca635f5be1a3547.exe	cmd.exe
PID 956 wrote to memory of 1188	956	0b5f7e93218d13ae98105682824f367059e1c315b317cf95dca635f5be1a3547.exe	cmd.exe
PID 956 wrote to memory of 1188	956	0b5f7e93218d13ae98105682824f367059e1c315b317cf95dca635f5be1a3547.exe	cmd.exe
PID 1188 wrote to memory of 1184	1188	cmd.exe	PING.EXE
PID 1188 wrote to memory of 1184	1188	cmd.exe	PING.EXE
PID 1188 wrote to memory of 1184	1188	cmd.exe	PING.EXE
PID 1188 wrote to memory of 1184	1188	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\0b5f7e93218d13ae98105682824f367059e1c315b317cf95dca635f5be1a3547.exe
"C:\Users\Admin\AppData\Local\Temp\0b5f7e93218d13ae98105682824f367059e1c315b317cf95dca635f5be1a3547.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:956

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:516

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\0b5f7e93218d13ae98105682824f367059e1c315b317cf95dca635f5be1a3547.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1188

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1184

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
a53cf2e91a45b4f3df91dcda67cf846b

SHA1
48073d15d1a61da350a51781906b429f37049566

SHA256
6d1d83d56c7148afbc74a02ae779f546788f30215525f3cad7b3c6b4d6ba05ab

SHA512
7dd811cc4a4718dcd29cbc8af84efc43445a74fe7bc968c7a5225d9b74c85710c57a99d6d71fd6562b0807df1686719ff9cb2ab6e910789a6d2bcabf7c8d230e

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
a53cf2e91a45b4f3df91dcda67cf846b

SHA1
48073d15d1a61da350a51781906b429f37049566

SHA256
6d1d83d56c7148afbc74a02ae779f546788f30215525f3cad7b3c6b4d6ba05ab

SHA512
7dd811cc4a4718dcd29cbc8af84efc43445a74fe7bc968c7a5225d9b74c85710c57a99d6d71fd6562b0807df1686719ff9cb2ab6e910789a6d2bcabf7c8d230e

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
a53cf2e91a45b4f3df91dcda67cf846b

SHA1
48073d15d1a61da350a51781906b429f37049566

SHA256
6d1d83d56c7148afbc74a02ae779f546788f30215525f3cad7b3c6b4d6ba05ab

SHA512
7dd811cc4a4718dcd29cbc8af84efc43445a74fe7bc968c7a5225d9b74c85710c57a99d6d71fd6562b0807df1686719ff9cb2ab6e910789a6d2bcabf7c8d230e

Download Submit
memory/956-54-0x0000000075AB1000-0x0000000075AB3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads