sakula | 0ca3b1969fe2e3d0118033ed90f3b0869be5e9d4a499d50b4912f115ef7ebd38

General

Target

0ca3b1969fe2e3d0118033ed90f3b0869be5e9d4a499d50b4912f115ef7ebd38.exe
Size

80KB
MD5

b776e38184c62df808901eb91bfaeb6f
SHA1

3cd80acf4ae377f41b8f5629ac24fd043522b1aa
SHA256

0ca3b1969fe2e3d0118033ed90f3b0869be5e9d4a499d50b4912f115ef7ebd38
SHA512

92ff30a7d1bc775651be6b37589646bb13caed2addc50d74e94b4df81afba30f95cd57827a66263dae1f036e2015312f6582fc638a9d459ab1e01745c363b1ea

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula Payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula

Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

4800 MediaCenter.exe

pid	process
4800	MediaCenter.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

0ca3b1969fe2e3d0118033ed90f3b0869be5e9d4a499d50b4912f115ef7ebd38.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	0ca3b1969fe2e3d0118033ed90f3b0869be5e9d4a499d50b4912f115ef7ebd38.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

0ca3b1969fe2e3d0118033ed90f3b0869be5e9d4a499d50b4912f115ef7ebd38.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	0ca3b1969fe2e3d0118033ed90f3b0869be5e9d4a499d50b4912f115ef7ebd38.exe

Drops file in Windows directory 8 IoCs

Processes:

svchost.exeTiWorker.exe

description	ioc	process
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TiWorker.exe
File opened for modification	C:\Windows\WinSxS\pending.xml	TiWorker.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1740 PING.EXE

pid	process
1740	PING.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

svchost.exeTiWorker.exe

description	pid	process
Token: SeShutdownPrivilege	4836	svchost.exe
Token: SeCreatePagefilePrivilege	4836	svchost.exe
Token: SeShutdownPrivilege	4836	svchost.exe
Token: SeCreatePagefilePrivilege	4836	svchost.exe
Token: SeShutdownPrivilege	4836	svchost.exe
Token: SeCreatePagefilePrivilege	4836	svchost.exe
Token: SeSecurityPrivilege	3840	TiWorker.exe
Token: SeRestorePrivilege	3840	TiWorker.exe
Token: SeBackupPrivilege	3840	TiWorker.exe
Token: SeBackupPrivilege	3840	TiWorker.exe
Token: SeRestorePrivilege	3840	TiWorker.exe
Token: SeSecurityPrivilege	3840	TiWorker.exe
Token: SeBackupPrivilege	3840	TiWorker.exe
Token: SeRestorePrivilege	3840	TiWorker.exe
Token: SeSecurityPrivilege	3840	TiWorker.exe
Token: SeBackupPrivilege	3840	TiWorker.exe
Token: SeRestorePrivilege	3840	TiWorker.exe
Token: SeSecurityPrivilege	3840	TiWorker.exe
Token: SeBackupPrivilege	3840	TiWorker.exe
Token: SeRestorePrivilege	3840	TiWorker.exe
Token: SeSecurityPrivilege	3840	TiWorker.exe
Token: SeBackupPrivilege	3840	TiWorker.exe
Token: SeRestorePrivilege	3840	TiWorker.exe
Token: SeSecurityPrivilege	3840	TiWorker.exe
Token: SeBackupPrivilege	3840	TiWorker.exe
Token: SeRestorePrivilege	3840	TiWorker.exe
Token: SeSecurityPrivilege	3840	TiWorker.exe
Token: SeBackupPrivilege	3840	TiWorker.exe
Token: SeRestorePrivilege	3840	TiWorker.exe
Token: SeSecurityPrivilege	3840	TiWorker.exe
Token: SeBackupPrivilege	3840	TiWorker.exe
Token: SeRestorePrivilege	3840	TiWorker.exe
Token: SeSecurityPrivilege	3840	TiWorker.exe
Token: SeBackupPrivilege	3840	TiWorker.exe
Token: SeRestorePrivilege	3840	TiWorker.exe
Token: SeSecurityPrivilege	3840	TiWorker.exe
Token: SeBackupPrivilege	3840	TiWorker.exe
Token: SeRestorePrivilege	3840	TiWorker.exe
Token: SeSecurityPrivilege	3840	TiWorker.exe
Token: SeBackupPrivilege	3840	TiWorker.exe
Token: SeRestorePrivilege	3840	TiWorker.exe
Token: SeSecurityPrivilege	3840	TiWorker.exe
Token: SeBackupPrivilege	3840	TiWorker.exe
Token: SeRestorePrivilege	3840	TiWorker.exe
Token: SeSecurityPrivilege	3840	TiWorker.exe
Token: SeBackupPrivilege	3840	TiWorker.exe
Token: SeRestorePrivilege	3840	TiWorker.exe
Token: SeSecurityPrivilege	3840	TiWorker.exe
Token: SeBackupPrivilege	3840	TiWorker.exe
Token: SeRestorePrivilege	3840	TiWorker.exe
Token: SeSecurityPrivilege	3840	TiWorker.exe
Token: SeBackupPrivilege	3840	TiWorker.exe
Token: SeRestorePrivilege	3840	TiWorker.exe
Token: SeSecurityPrivilege	3840	TiWorker.exe
Token: SeBackupPrivilege	3840	TiWorker.exe
Token: SeRestorePrivilege	3840	TiWorker.exe
Token: SeSecurityPrivilege	3840	TiWorker.exe
Token: SeBackupPrivilege	3840	TiWorker.exe
Token: SeRestorePrivilege	3840	TiWorker.exe
Token: SeSecurityPrivilege	3840	TiWorker.exe
Token: SeBackupPrivilege	3840	TiWorker.exe
Token: SeRestorePrivilege	3840	TiWorker.exe
Token: SeSecurityPrivilege	3840	TiWorker.exe
Token: SeBackupPrivilege	3840	TiWorker.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

0ca3b1969fe2e3d0118033ed90f3b0869be5e9d4a499d50b4912f115ef7ebd38.execmd.exe

description	pid	process	target process
PID 1456 wrote to memory of 4800	1456	0ca3b1969fe2e3d0118033ed90f3b0869be5e9d4a499d50b4912f115ef7ebd38.exe	MediaCenter.exe
PID 1456 wrote to memory of 4800	1456	0ca3b1969fe2e3d0118033ed90f3b0869be5e9d4a499d50b4912f115ef7ebd38.exe	MediaCenter.exe
PID 1456 wrote to memory of 4800	1456	0ca3b1969fe2e3d0118033ed90f3b0869be5e9d4a499d50b4912f115ef7ebd38.exe	MediaCenter.exe
PID 1456 wrote to memory of 2240	1456	0ca3b1969fe2e3d0118033ed90f3b0869be5e9d4a499d50b4912f115ef7ebd38.exe	cmd.exe
PID 1456 wrote to memory of 2240	1456	0ca3b1969fe2e3d0118033ed90f3b0869be5e9d4a499d50b4912f115ef7ebd38.exe	cmd.exe
PID 1456 wrote to memory of 2240	1456	0ca3b1969fe2e3d0118033ed90f3b0869be5e9d4a499d50b4912f115ef7ebd38.exe	cmd.exe
PID 2240 wrote to memory of 1740	2240	cmd.exe	PING.EXE
PID 2240 wrote to memory of 1740	2240	cmd.exe	PING.EXE
PID 2240 wrote to memory of 1740	2240	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\0ca3b1969fe2e3d0118033ed90f3b0869be5e9d4a499d50b4912f115ef7ebd38.exe
"C:\Users\Admin\AppData\Local\Temp\0ca3b1969fe2e3d0118033ed90f3b0869be5e9d4a499d50b4912f115ef7ebd38.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1456

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:4800

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\0ca3b1969fe2e3d0118033ed90f3b0869be5e9d4a499d50b4912f115ef7ebd38.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2240

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4836

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3840

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
5ba5a2c95797ef0a241401d8c40ff34c

SHA1
ad87dfc9d1197581fcad60f1e7cdb4b2c6b44959

SHA256
d9e24b06b6d9bd2eeb8b9df1b448a124f5dcdbd22eab4b813c407441938241c0

SHA512
2de57a9e9b1b6932fe96349a69a64e3dc3aeb49f915ad1f0f19f67cc496bf268d973f413cdf3f21664a2e8d449ca6082b3f73de7002b9fe6b487603a7851f438

Download Submit
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
5ba5a2c95797ef0a241401d8c40ff34c

SHA1
ad87dfc9d1197581fcad60f1e7cdb4b2c6b44959

SHA256
d9e24b06b6d9bd2eeb8b9df1b448a124f5dcdbd22eab4b813c407441938241c0

SHA512
2de57a9e9b1b6932fe96349a69a64e3dc3aeb49f915ad1f0f19f67cc496bf268d973f413cdf3f21664a2e8d449ca6082b3f73de7002b9fe6b487603a7851f438

Download Submit
memory/4836-132-0x000002C385170000-0x000002C385180000-memory.dmp

Filesize
64KB

Download
memory/4836-133-0x000002C385720000-0x000002C385730000-memory.dmp

Filesize
64KB

Download
memory/4836-134-0x000002C387DF0000-0x000002C387DF4000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads