sakula | 0c0f54df5c7e6c8c0efd2c4aa63cdd204ae4b1953fbbcb7c822819c3526febc2

General

Target

0c0f54df5c7e6c8c0efd2c4aa63cdd204ae4b1953fbbcb7c822819c3526febc2.exe
Size

36KB
MD5

b0b85b1dc59aa8d3e8185b2e53b438d3
SHA1

0dde149d9940268fc58ec89c445db67f23a1a2d9
SHA256

0c0f54df5c7e6c8c0efd2c4aa63cdd204ae4b1953fbbcb7c822819c3526febc2
SHA512

a3ad963bbc50f8e43dcbaac78cc5541655d105c9321103fe9874c4959df042387ff365ed2a00f093a2a3fc312e95ae86cadf0bfdfdd9f2b0ef3621b09ced11f6

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1860 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1972 cmd.exe

pid	process
1860	MediaCenter.exe

pid	process
1972	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

0c0f54df5c7e6c8c0efd2c4aa63cdd204ae4b1953fbbcb7c822819c3526febc2.exe

pid	process
612	0c0f54df5c7e6c8c0efd2c4aa63cdd204ae4b1953fbbcb7c822819c3526febc2.exe
612	0c0f54df5c7e6c8c0efd2c4aa63cdd204ae4b1953fbbcb7c822819c3526febc2.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

0c0f54df5c7e6c8c0efd2c4aa63cdd204ae4b1953fbbcb7c822819c3526febc2.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	0c0f54df5c7e6c8c0efd2c4aa63cdd204ae4b1953fbbcb7c822819c3526febc2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1044 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0c0f54df5c7e6c8c0efd2c4aa63cdd204ae4b1953fbbcb7c822819c3526febc2.exe

description pid process

Token: SeIncBasePriorityPrivilege 612 0c0f54df5c7e6c8c0efd2c4aa63cdd204ae4b1953fbbcb7c822819c3526febc2.exe

pid	process
1044	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	612	0c0f54df5c7e6c8c0efd2c4aa63cdd204ae4b1953fbbcb7c822819c3526febc2.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

0c0f54df5c7e6c8c0efd2c4aa63cdd204ae4b1953fbbcb7c822819c3526febc2.execmd.exe

description	pid	process	target process
PID 612 wrote to memory of 1860	612	0c0f54df5c7e6c8c0efd2c4aa63cdd204ae4b1953fbbcb7c822819c3526febc2.exe	MediaCenter.exe
PID 612 wrote to memory of 1860	612	0c0f54df5c7e6c8c0efd2c4aa63cdd204ae4b1953fbbcb7c822819c3526febc2.exe	MediaCenter.exe
PID 612 wrote to memory of 1860	612	0c0f54df5c7e6c8c0efd2c4aa63cdd204ae4b1953fbbcb7c822819c3526febc2.exe	MediaCenter.exe
PID 612 wrote to memory of 1860	612	0c0f54df5c7e6c8c0efd2c4aa63cdd204ae4b1953fbbcb7c822819c3526febc2.exe	MediaCenter.exe
PID 612 wrote to memory of 1972	612	0c0f54df5c7e6c8c0efd2c4aa63cdd204ae4b1953fbbcb7c822819c3526febc2.exe	cmd.exe
PID 612 wrote to memory of 1972	612	0c0f54df5c7e6c8c0efd2c4aa63cdd204ae4b1953fbbcb7c822819c3526febc2.exe	cmd.exe
PID 612 wrote to memory of 1972	612	0c0f54df5c7e6c8c0efd2c4aa63cdd204ae4b1953fbbcb7c822819c3526febc2.exe	cmd.exe
PID 612 wrote to memory of 1972	612	0c0f54df5c7e6c8c0efd2c4aa63cdd204ae4b1953fbbcb7c822819c3526febc2.exe	cmd.exe
PID 1972 wrote to memory of 1044	1972	cmd.exe	PING.EXE
PID 1972 wrote to memory of 1044	1972	cmd.exe	PING.EXE
PID 1972 wrote to memory of 1044	1972	cmd.exe	PING.EXE
PID 1972 wrote to memory of 1044	1972	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\0c0f54df5c7e6c8c0efd2c4aa63cdd204ae4b1953fbbcb7c822819c3526febc2.exe
"C:\Users\Admin\AppData\Local\Temp\0c0f54df5c7e6c8c0efd2c4aa63cdd204ae4b1953fbbcb7c822819c3526febc2.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:612

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1860

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\0c0f54df5c7e6c8c0efd2c4aa63cdd204ae4b1953fbbcb7c822819c3526febc2.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1972

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1044

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
32568b052796c85cbfeea05aaa5a35d0

SHA1
0a0112ce6947554dc29c73396a9282ece66edf82

SHA256
d887d39f1888ae1df5154c6a9f4e6c662c3fcadf9fda90f7e4d9af08ab6d52b7

SHA512
03edaf00a8afef107e576e92f1261d614436c9a2a1daa95025e7598dcb2041ad0356ce9e60f2d57c966900d565f85e1a86d071ec23f28f91cc344a67746d7456

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
32568b052796c85cbfeea05aaa5a35d0

SHA1
0a0112ce6947554dc29c73396a9282ece66edf82

SHA256
d887d39f1888ae1df5154c6a9f4e6c662c3fcadf9fda90f7e4d9af08ab6d52b7

SHA512
03edaf00a8afef107e576e92f1261d614436c9a2a1daa95025e7598dcb2041ad0356ce9e60f2d57c966900d565f85e1a86d071ec23f28f91cc344a67746d7456

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
32568b052796c85cbfeea05aaa5a35d0

SHA1
0a0112ce6947554dc29c73396a9282ece66edf82

SHA256
d887d39f1888ae1df5154c6a9f4e6c662c3fcadf9fda90f7e4d9af08ab6d52b7

SHA512
03edaf00a8afef107e576e92f1261d614436c9a2a1daa95025e7598dcb2041ad0356ce9e60f2d57c966900d565f85e1a86d071ec23f28f91cc344a67746d7456

Download Submit
memory/612-54-0x0000000075891000-0x0000000075893000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads