sakula | 0be33c091a303947501e0859a5b3abb0621aef34b1cc5b3a706ea8dc72c80afe

General

Target

0be33c091a303947501e0859a5b3abb0621aef34b1cc5b3a706ea8dc72c80afe.exe
Size

35KB
MD5

072f784196a205fd0ec37a122b04f571
SHA1

7e863e15d34747c03b3193d184369b75120ec664
SHA256

0be33c091a303947501e0859a5b3abb0621aef34b1cc5b3a706ea8dc72c80afe
SHA512

874e5ed18e32efa714ad0ff8b47a7b3580c102cdbf304910b4bc41b1f57a93c6bf03f714c810fd2b19a7492cd69200dfb0cd27f1f596444ddb443b9e2d5aadda

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

880 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1204 cmd.exe

pid	process
880	MediaCenter.exe

pid	process
1204	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

0be33c091a303947501e0859a5b3abb0621aef34b1cc5b3a706ea8dc72c80afe.exe

pid	process
1492	0be33c091a303947501e0859a5b3abb0621aef34b1cc5b3a706ea8dc72c80afe.exe
1492	0be33c091a303947501e0859a5b3abb0621aef34b1cc5b3a706ea8dc72c80afe.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

0be33c091a303947501e0859a5b3abb0621aef34b1cc5b3a706ea8dc72c80afe.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	0be33c091a303947501e0859a5b3abb0621aef34b1cc5b3a706ea8dc72c80afe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1080 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0be33c091a303947501e0859a5b3abb0621aef34b1cc5b3a706ea8dc72c80afe.exe

description pid process

Token: SeIncBasePriorityPrivilege 1492 0be33c091a303947501e0859a5b3abb0621aef34b1cc5b3a706ea8dc72c80afe.exe

pid	process
1080	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1492	0be33c091a303947501e0859a5b3abb0621aef34b1cc5b3a706ea8dc72c80afe.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

0be33c091a303947501e0859a5b3abb0621aef34b1cc5b3a706ea8dc72c80afe.execmd.exe

description	pid	process	target process
PID 1492 wrote to memory of 880	1492	0be33c091a303947501e0859a5b3abb0621aef34b1cc5b3a706ea8dc72c80afe.exe	MediaCenter.exe
PID 1492 wrote to memory of 880	1492	0be33c091a303947501e0859a5b3abb0621aef34b1cc5b3a706ea8dc72c80afe.exe	MediaCenter.exe
PID 1492 wrote to memory of 880	1492	0be33c091a303947501e0859a5b3abb0621aef34b1cc5b3a706ea8dc72c80afe.exe	MediaCenter.exe
PID 1492 wrote to memory of 880	1492	0be33c091a303947501e0859a5b3abb0621aef34b1cc5b3a706ea8dc72c80afe.exe	MediaCenter.exe
PID 1492 wrote to memory of 1204	1492	0be33c091a303947501e0859a5b3abb0621aef34b1cc5b3a706ea8dc72c80afe.exe	cmd.exe
PID 1492 wrote to memory of 1204	1492	0be33c091a303947501e0859a5b3abb0621aef34b1cc5b3a706ea8dc72c80afe.exe	cmd.exe
PID 1492 wrote to memory of 1204	1492	0be33c091a303947501e0859a5b3abb0621aef34b1cc5b3a706ea8dc72c80afe.exe	cmd.exe
PID 1492 wrote to memory of 1204	1492	0be33c091a303947501e0859a5b3abb0621aef34b1cc5b3a706ea8dc72c80afe.exe	cmd.exe
PID 1204 wrote to memory of 1080	1204	cmd.exe	PING.EXE
PID 1204 wrote to memory of 1080	1204	cmd.exe	PING.EXE
PID 1204 wrote to memory of 1080	1204	cmd.exe	PING.EXE
PID 1204 wrote to memory of 1080	1204	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\0be33c091a303947501e0859a5b3abb0621aef34b1cc5b3a706ea8dc72c80afe.exe
"C:\Users\Admin\AppData\Local\Temp\0be33c091a303947501e0859a5b3abb0621aef34b1cc5b3a706ea8dc72c80afe.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1492

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:880

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\0be33c091a303947501e0859a5b3abb0621aef34b1cc5b3a706ea8dc72c80afe.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1204

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1080

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
52bcaf0b10a24e41e3e11c4e5cfbf743

SHA1
499d512cfecac7aeec66c7dc9687483ca0e0130d

SHA256
c3bbad8ea0862882e1f3065dd2a874765e351ab836be5d8a556c57ab6b2104d0

SHA512
eaeac9d626400253916e13f5f17aa147eb1b1a541c1a7b34445626a2f371c599badf75c0ce8ee3732a2dab5a75ae19ea6e25d908b5b6664217e2fa6ead79e376

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
52bcaf0b10a24e41e3e11c4e5cfbf743

SHA1
499d512cfecac7aeec66c7dc9687483ca0e0130d

SHA256
c3bbad8ea0862882e1f3065dd2a874765e351ab836be5d8a556c57ab6b2104d0

SHA512
eaeac9d626400253916e13f5f17aa147eb1b1a541c1a7b34445626a2f371c599badf75c0ce8ee3732a2dab5a75ae19ea6e25d908b5b6664217e2fa6ead79e376

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
52bcaf0b10a24e41e3e11c4e5cfbf743

SHA1
499d512cfecac7aeec66c7dc9687483ca0e0130d

SHA256
c3bbad8ea0862882e1f3065dd2a874765e351ab836be5d8a556c57ab6b2104d0

SHA512
eaeac9d626400253916e13f5f17aa147eb1b1a541c1a7b34445626a2f371c599badf75c0ce8ee3732a2dab5a75ae19ea6e25d908b5b6664217e2fa6ead79e376

Download Submit
memory/1492-54-0x0000000075D51000-0x0000000075D53000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads