sakula | 0b2e57db56f5c927fc14bdd6cc0d5d59eff3ab25822d39179b4227ce944dd6b1

General

Target

0b2e57db56f5c927fc14bdd6cc0d5d59eff3ab25822d39179b4227ce944dd6b1.exe
Size

150KB
MD5

7c06599c579fe8dffb581d5f50c84742
SHA1

4d9dd7ea1c7cf398de824a651d59c57c366a1ba2
SHA256

0b2e57db56f5c927fc14bdd6cc0d5d59eff3ab25822d39179b4227ce944dd6b1
SHA512

7efdcad7e2ea43472939967dc30435cf5c652246c628fb4e8571f00673aa3b540bff15abb7e5314d16d618b04ef5e8beb938fb194c59bc9bbcbaefe10802ac3c

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula Payload 2 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula

Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1532 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1848 cmd.exe
Loads dropped DLL 1 IoCs

Processes:

0b2e57db56f5c927fc14bdd6cc0d5d59eff3ab25822d39179b4227ce944dd6b1.exe

pid process

1600 0b2e57db56f5c927fc14bdd6cc0d5d59eff3ab25822d39179b4227ce944dd6b1.exe

pid	process
1532	MediaCenter.exe

pid	process
1848	cmd.exe

pid	process
1600	0b2e57db56f5c927fc14bdd6cc0d5d59eff3ab25822d39179b4227ce944dd6b1.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

0b2e57db56f5c927fc14bdd6cc0d5d59eff3ab25822d39179b4227ce944dd6b1.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	0b2e57db56f5c927fc14bdd6cc0d5d59eff3ab25822d39179b4227ce944dd6b1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1048 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0b2e57db56f5c927fc14bdd6cc0d5d59eff3ab25822d39179b4227ce944dd6b1.exe

description pid process

Token: SeIncBasePriorityPrivilege 1600 0b2e57db56f5c927fc14bdd6cc0d5d59eff3ab25822d39179b4227ce944dd6b1.exe

pid	process
1048	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1600	0b2e57db56f5c927fc14bdd6cc0d5d59eff3ab25822d39179b4227ce944dd6b1.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

0b2e57db56f5c927fc14bdd6cc0d5d59eff3ab25822d39179b4227ce944dd6b1.execmd.exe

description	pid	process	target process
PID 1600 wrote to memory of 1532	1600	0b2e57db56f5c927fc14bdd6cc0d5d59eff3ab25822d39179b4227ce944dd6b1.exe	MediaCenter.exe
PID 1600 wrote to memory of 1532	1600	0b2e57db56f5c927fc14bdd6cc0d5d59eff3ab25822d39179b4227ce944dd6b1.exe	MediaCenter.exe
PID 1600 wrote to memory of 1532	1600	0b2e57db56f5c927fc14bdd6cc0d5d59eff3ab25822d39179b4227ce944dd6b1.exe	MediaCenter.exe
PID 1600 wrote to memory of 1532	1600	0b2e57db56f5c927fc14bdd6cc0d5d59eff3ab25822d39179b4227ce944dd6b1.exe	MediaCenter.exe
PID 1600 wrote to memory of 1848	1600	0b2e57db56f5c927fc14bdd6cc0d5d59eff3ab25822d39179b4227ce944dd6b1.exe	cmd.exe
PID 1600 wrote to memory of 1848	1600	0b2e57db56f5c927fc14bdd6cc0d5d59eff3ab25822d39179b4227ce944dd6b1.exe	cmd.exe
PID 1600 wrote to memory of 1848	1600	0b2e57db56f5c927fc14bdd6cc0d5d59eff3ab25822d39179b4227ce944dd6b1.exe	cmd.exe
PID 1600 wrote to memory of 1848	1600	0b2e57db56f5c927fc14bdd6cc0d5d59eff3ab25822d39179b4227ce944dd6b1.exe	cmd.exe
PID 1848 wrote to memory of 1048	1848	cmd.exe	PING.EXE
PID 1848 wrote to memory of 1048	1848	cmd.exe	PING.EXE
PID 1848 wrote to memory of 1048	1848	cmd.exe	PING.EXE
PID 1848 wrote to memory of 1048	1848	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\0b2e57db56f5c927fc14bdd6cc0d5d59eff3ab25822d39179b4227ce944dd6b1.exe
"C:\Users\Admin\AppData\Local\Temp\0b2e57db56f5c927fc14bdd6cc0d5d59eff3ab25822d39179b4227ce944dd6b1.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1600

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1532

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\0b2e57db56f5c927fc14bdd6cc0d5d59eff3ab25822d39179b4227ce944dd6b1.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1848

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1048

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
9fb4cadc5b292faf08131251caf14ecb

SHA1
cb822ae7e522325f3a89c8dd72a41108434eca7b

SHA256
da48bd159fd3079e3ec4e00811060e423353e1ed032e1eea40648ca1735f30e0

SHA512
900d144025f913fbc1bfc2c2ed51a170548b862f3a10586c61b3c3731415ef9fbd20ea00f329c57cd36ade8f06309005091cf668e9b974e765fef312874a3c2d

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
9fb4cadc5b292faf08131251caf14ecb

SHA1
cb822ae7e522325f3a89c8dd72a41108434eca7b

SHA256
da48bd159fd3079e3ec4e00811060e423353e1ed032e1eea40648ca1735f30e0

SHA512
900d144025f913fbc1bfc2c2ed51a170548b862f3a10586c61b3c3731415ef9fbd20ea00f329c57cd36ade8f06309005091cf668e9b974e765fef312874a3c2d

Download Submit
memory/1600-55-0x0000000076851000-0x0000000076853000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads