sakula | 0d6ffd2be024ed0e4672f7894635ffc3860895a7b12b18e9d3cf16cd44f8989f

General

Target

0d6ffd2be024ed0e4672f7894635ffc3860895a7b12b18e9d3cf16cd44f8989f.exe
Size

36KB
MD5

1a161edfc85358a0fd3beb9f124c82ea
SHA1

2c9c8cf4c3978223988d4213aa483c5c444862c4
SHA256

0d6ffd2be024ed0e4672f7894635ffc3860895a7b12b18e9d3cf16cd44f8989f
SHA512

bd53d051fb756e7b8fd96eb51e37f41aa172b640020a35c74a5336e1b4a2440d84f6f78872762a69ae3b43403bfd5aa639cc953825a02a756979acfc61c68ea6

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/952-55-0x0000000000CE0000-0x0000000000CF9000-memory.dmp	family_sakula
behavioral1/memory/1628-61-0x0000000000080000-0x0000000000099000-memory.dmp	family_sakula

Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1628 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1040 cmd.exe

pid	process
1628	MediaCenter.exe

pid	process
1040	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

0d6ffd2be024ed0e4672f7894635ffc3860895a7b12b18e9d3cf16cd44f8989f.exe

pid	process
952	0d6ffd2be024ed0e4672f7894635ffc3860895a7b12b18e9d3cf16cd44f8989f.exe
952	0d6ffd2be024ed0e4672f7894635ffc3860895a7b12b18e9d3cf16cd44f8989f.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

0d6ffd2be024ed0e4672f7894635ffc3860895a7b12b18e9d3cf16cd44f8989f.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	0d6ffd2be024ed0e4672f7894635ffc3860895a7b12b18e9d3cf16cd44f8989f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1824 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0d6ffd2be024ed0e4672f7894635ffc3860895a7b12b18e9d3cf16cd44f8989f.exe

description pid process

Token: SeIncBasePriorityPrivilege 952 0d6ffd2be024ed0e4672f7894635ffc3860895a7b12b18e9d3cf16cd44f8989f.exe

pid	process
1824	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	952	0d6ffd2be024ed0e4672f7894635ffc3860895a7b12b18e9d3cf16cd44f8989f.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

0d6ffd2be024ed0e4672f7894635ffc3860895a7b12b18e9d3cf16cd44f8989f.execmd.exe

description	pid	process	target process
PID 952 wrote to memory of 1628	952	0d6ffd2be024ed0e4672f7894635ffc3860895a7b12b18e9d3cf16cd44f8989f.exe	MediaCenter.exe
PID 952 wrote to memory of 1628	952	0d6ffd2be024ed0e4672f7894635ffc3860895a7b12b18e9d3cf16cd44f8989f.exe	MediaCenter.exe
PID 952 wrote to memory of 1628	952	0d6ffd2be024ed0e4672f7894635ffc3860895a7b12b18e9d3cf16cd44f8989f.exe	MediaCenter.exe
PID 952 wrote to memory of 1628	952	0d6ffd2be024ed0e4672f7894635ffc3860895a7b12b18e9d3cf16cd44f8989f.exe	MediaCenter.exe
PID 952 wrote to memory of 1040	952	0d6ffd2be024ed0e4672f7894635ffc3860895a7b12b18e9d3cf16cd44f8989f.exe	cmd.exe
PID 952 wrote to memory of 1040	952	0d6ffd2be024ed0e4672f7894635ffc3860895a7b12b18e9d3cf16cd44f8989f.exe	cmd.exe
PID 952 wrote to memory of 1040	952	0d6ffd2be024ed0e4672f7894635ffc3860895a7b12b18e9d3cf16cd44f8989f.exe	cmd.exe
PID 952 wrote to memory of 1040	952	0d6ffd2be024ed0e4672f7894635ffc3860895a7b12b18e9d3cf16cd44f8989f.exe	cmd.exe
PID 1040 wrote to memory of 1824	1040	cmd.exe	PING.EXE
PID 1040 wrote to memory of 1824	1040	cmd.exe	PING.EXE
PID 1040 wrote to memory of 1824	1040	cmd.exe	PING.EXE
PID 1040 wrote to memory of 1824	1040	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\0d6ffd2be024ed0e4672f7894635ffc3860895a7b12b18e9d3cf16cd44f8989f.exe
"C:\Users\Admin\AppData\Local\Temp\0d6ffd2be024ed0e4672f7894635ffc3860895a7b12b18e9d3cf16cd44f8989f.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:952

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1628

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\0d6ffd2be024ed0e4672f7894635ffc3860895a7b12b18e9d3cf16cd44f8989f.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1040

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1824

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
04ce37e02a0b30cd217670be1d02e697

SHA1
ffa4e1295a02cb50ee3f62b2c0982c9a8a75e0d9

SHA256
8400fa09e4dbaa981985e068c5811405605179629ea6fd1db38f7c38f10496c2

SHA512
b8e47918b1d505ac8921634d4da0ca4117d9fafbb94860ca2dfa20d3603a47ee3283732ed71171012b447e038199e6721e931cc507ea36077bccd93f6d7a983d

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
04ce37e02a0b30cd217670be1d02e697

SHA1
ffa4e1295a02cb50ee3f62b2c0982c9a8a75e0d9

SHA256
8400fa09e4dbaa981985e068c5811405605179629ea6fd1db38f7c38f10496c2

SHA512
b8e47918b1d505ac8921634d4da0ca4117d9fafbb94860ca2dfa20d3603a47ee3283732ed71171012b447e038199e6721e931cc507ea36077bccd93f6d7a983d

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
04ce37e02a0b30cd217670be1d02e697

SHA1
ffa4e1295a02cb50ee3f62b2c0982c9a8a75e0d9

SHA256
8400fa09e4dbaa981985e068c5811405605179629ea6fd1db38f7c38f10496c2

SHA512
b8e47918b1d505ac8921634d4da0ca4117d9fafbb94860ca2dfa20d3603a47ee3283732ed71171012b447e038199e6721e931cc507ea36077bccd93f6d7a983d

Download Submit
memory/952-54-0x0000000076B81000-0x0000000076B83000-memory.dmp

Filesize
8KB

Download
memory/952-55-0x0000000000CE0000-0x0000000000CF9000-memory.dmp

Filesize
100KB

Download
memory/952-56-0x0000000000070000-0x0000000000077000-memory.dmp

Filesize
28KB

Download
memory/1628-61-0x0000000000080000-0x0000000000099000-memory.dmp

Filesize
100KB

Download
memory/1628-62-0x0000000000070000-0x0000000000077000-memory.dmp

Filesize
28KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads