sakula | 0c886d16d4625c4356aa086992676aaadf2c038661280ac0eac1b85881513f6f

General

Target

0c886d16d4625c4356aa086992676aaadf2c038661280ac0eac1b85881513f6f.exe
Size

176KB
MD5

b11ee71e76eba5c974d677e45a899268
SHA1

c15bbbe804c434a5f7f4af888198c6f7a6260740
SHA256

0c886d16d4625c4356aa086992676aaadf2c038661280ac0eac1b85881513f6f
SHA512

e4db3e8a80d5ccec48fc9cd6bef688ec84694faafa3b336f509ac54ce6cd4f4bf30974909a25f27fa879d4e53c14a112733d1f35b0a4c2fafa32d529d1b557ee

Score

10^/10

sakula persistence rat suricata trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula Payload 4 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
behavioral1/memory/1632-59-0x0000000000400000-0x0000000000420000-memory.dmp	family_sakula
behavioral1/memory/1312-60-0x0000000000400000-0x0000000000420000-memory.dmp	family_sakula

suricata: ET MALWARE SUSPICIOUS UA (iexplore)
suricata: ET MALWARE SUSPICIOUS UA (iexplore)
suricata
suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1
suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1
suricata
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1312 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

960 cmd.exe
Loads dropped DLL 1 IoCs

Processes:

0c886d16d4625c4356aa086992676aaadf2c038661280ac0eac1b85881513f6f.exe

pid process

1632 0c886d16d4625c4356aa086992676aaadf2c038661280ac0eac1b85881513f6f.exe

pid	process
1312	MediaCenter.exe

pid	process
960	cmd.exe

pid	process
1632	0c886d16d4625c4356aa086992676aaadf2c038661280ac0eac1b85881513f6f.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

0c886d16d4625c4356aa086992676aaadf2c038661280ac0eac1b85881513f6f.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	0c886d16d4625c4356aa086992676aaadf2c038661280ac0eac1b85881513f6f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

640 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0c886d16d4625c4356aa086992676aaadf2c038661280ac0eac1b85881513f6f.exe

description pid process

Token: SeIncBasePriorityPrivilege 1632 0c886d16d4625c4356aa086992676aaadf2c038661280ac0eac1b85881513f6f.exe

pid	process
640	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1632	0c886d16d4625c4356aa086992676aaadf2c038661280ac0eac1b85881513f6f.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

0c886d16d4625c4356aa086992676aaadf2c038661280ac0eac1b85881513f6f.execmd.exe

description	pid	process	target process
PID 1632 wrote to memory of 1312	1632	0c886d16d4625c4356aa086992676aaadf2c038661280ac0eac1b85881513f6f.exe	MediaCenter.exe
PID 1632 wrote to memory of 1312	1632	0c886d16d4625c4356aa086992676aaadf2c038661280ac0eac1b85881513f6f.exe	MediaCenter.exe
PID 1632 wrote to memory of 1312	1632	0c886d16d4625c4356aa086992676aaadf2c038661280ac0eac1b85881513f6f.exe	MediaCenter.exe
PID 1632 wrote to memory of 1312	1632	0c886d16d4625c4356aa086992676aaadf2c038661280ac0eac1b85881513f6f.exe	MediaCenter.exe
PID 1632 wrote to memory of 960	1632	0c886d16d4625c4356aa086992676aaadf2c038661280ac0eac1b85881513f6f.exe	cmd.exe
PID 1632 wrote to memory of 960	1632	0c886d16d4625c4356aa086992676aaadf2c038661280ac0eac1b85881513f6f.exe	cmd.exe
PID 1632 wrote to memory of 960	1632	0c886d16d4625c4356aa086992676aaadf2c038661280ac0eac1b85881513f6f.exe	cmd.exe
PID 1632 wrote to memory of 960	1632	0c886d16d4625c4356aa086992676aaadf2c038661280ac0eac1b85881513f6f.exe	cmd.exe
PID 960 wrote to memory of 640	960	cmd.exe	PING.EXE
PID 960 wrote to memory of 640	960	cmd.exe	PING.EXE
PID 960 wrote to memory of 640	960	cmd.exe	PING.EXE
PID 960 wrote to memory of 640	960	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\0c886d16d4625c4356aa086992676aaadf2c038661280ac0eac1b85881513f6f.exe
"C:\Users\Admin\AppData\Local\Temp\0c886d16d4625c4356aa086992676aaadf2c038661280ac0eac1b85881513f6f.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1632

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1312

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\0c886d16d4625c4356aa086992676aaadf2c038661280ac0eac1b85881513f6f.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:960

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:640

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
8e6faa4414e46ca2cf0e1984f8ef3266

SHA1
e384f9b2881c8e66941a131334afceb40a008632

SHA256
77692d2862fbe6253c9c762b89a12cebe58b2898beaba4dff1a6108f420041ec

SHA512
50e425ea2e97924989e886bb92cdcb51cf49c4f3c663e6b452c342fe1dcf7e7931d70c89f1176f5fbc94f15d0fa940cff94aee6dde5a1b200bbda4c8e3f460d7

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
8e6faa4414e46ca2cf0e1984f8ef3266

SHA1
e384f9b2881c8e66941a131334afceb40a008632

SHA256
77692d2862fbe6253c9c762b89a12cebe58b2898beaba4dff1a6108f420041ec

SHA512
50e425ea2e97924989e886bb92cdcb51cf49c4f3c663e6b452c342fe1dcf7e7931d70c89f1176f5fbc94f15d0fa940cff94aee6dde5a1b200bbda4c8e3f460d7

Download Submit
memory/1312-60-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1632-55-0x0000000075801000-0x0000000075803000-memory.dmp

Filesize
8KB

Download
memory/1632-59-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads