sakula | 0b27a1b2bbb21aa81d1edc2eb30c654c192a0bdc785720f44f91ad2eba5ed92e

General

Target

0b27a1b2bbb21aa81d1edc2eb30c654c192a0bdc785720f44f91ad2eba5ed92e.exe
Size

176KB
MD5

23d0328e41f464e498749d6fe24c44e5
SHA1

a2b7340d9c9b4196b123a278a8de963ba80835a4
SHA256

0b27a1b2bbb21aa81d1edc2eb30c654c192a0bdc785720f44f91ad2eba5ed92e
SHA512

6375a389e0dd16f040ccd2670f29a64a315b0cc4cfb1dc21a1dffa4d4e9d79ade1429f4c7ad077d119e04798af4c1b10ef2949c6b4a0ed3c6b27f5b11ed2d9ce

Score

10^/10

sakula persistence rat suricata trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula Payload 4 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
behavioral1/memory/1796-58-0x0000000000400000-0x0000000000420000-memory.dmp	family_sakula
behavioral1/memory/628-59-0x0000000000400000-0x0000000000420000-memory.dmp	family_sakula

suricata: ET MALWARE SUSPICIOUS UA (iexplore)
suricata: ET MALWARE SUSPICIOUS UA (iexplore)
suricata
suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1
suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1
suricata
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

628 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1640 cmd.exe
Loads dropped DLL 1 IoCs

Processes:

0b27a1b2bbb21aa81d1edc2eb30c654c192a0bdc785720f44f91ad2eba5ed92e.exe

pid process

1796 0b27a1b2bbb21aa81d1edc2eb30c654c192a0bdc785720f44f91ad2eba5ed92e.exe

pid	process
628	MediaCenter.exe

pid	process
1640	cmd.exe

pid	process
1796	0b27a1b2bbb21aa81d1edc2eb30c654c192a0bdc785720f44f91ad2eba5ed92e.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

0b27a1b2bbb21aa81d1edc2eb30c654c192a0bdc785720f44f91ad2eba5ed92e.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	0b27a1b2bbb21aa81d1edc2eb30c654c192a0bdc785720f44f91ad2eba5ed92e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

676 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0b27a1b2bbb21aa81d1edc2eb30c654c192a0bdc785720f44f91ad2eba5ed92e.exe

description pid process

Token: SeIncBasePriorityPrivilege 1796 0b27a1b2bbb21aa81d1edc2eb30c654c192a0bdc785720f44f91ad2eba5ed92e.exe

pid	process
676	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1796	0b27a1b2bbb21aa81d1edc2eb30c654c192a0bdc785720f44f91ad2eba5ed92e.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

0b27a1b2bbb21aa81d1edc2eb30c654c192a0bdc785720f44f91ad2eba5ed92e.execmd.exe

description	pid	process	target process
PID 1796 wrote to memory of 628	1796	0b27a1b2bbb21aa81d1edc2eb30c654c192a0bdc785720f44f91ad2eba5ed92e.exe	MediaCenter.exe
PID 1796 wrote to memory of 628	1796	0b27a1b2bbb21aa81d1edc2eb30c654c192a0bdc785720f44f91ad2eba5ed92e.exe	MediaCenter.exe
PID 1796 wrote to memory of 628	1796	0b27a1b2bbb21aa81d1edc2eb30c654c192a0bdc785720f44f91ad2eba5ed92e.exe	MediaCenter.exe
PID 1796 wrote to memory of 628	1796	0b27a1b2bbb21aa81d1edc2eb30c654c192a0bdc785720f44f91ad2eba5ed92e.exe	MediaCenter.exe
PID 1796 wrote to memory of 1640	1796	0b27a1b2bbb21aa81d1edc2eb30c654c192a0bdc785720f44f91ad2eba5ed92e.exe	cmd.exe
PID 1796 wrote to memory of 1640	1796	0b27a1b2bbb21aa81d1edc2eb30c654c192a0bdc785720f44f91ad2eba5ed92e.exe	cmd.exe
PID 1796 wrote to memory of 1640	1796	0b27a1b2bbb21aa81d1edc2eb30c654c192a0bdc785720f44f91ad2eba5ed92e.exe	cmd.exe
PID 1796 wrote to memory of 1640	1796	0b27a1b2bbb21aa81d1edc2eb30c654c192a0bdc785720f44f91ad2eba5ed92e.exe	cmd.exe
PID 1640 wrote to memory of 676	1640	cmd.exe	PING.EXE
PID 1640 wrote to memory of 676	1640	cmd.exe	PING.EXE
PID 1640 wrote to memory of 676	1640	cmd.exe	PING.EXE
PID 1640 wrote to memory of 676	1640	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\0b27a1b2bbb21aa81d1edc2eb30c654c192a0bdc785720f44f91ad2eba5ed92e.exe
"C:\Users\Admin\AppData\Local\Temp\0b27a1b2bbb21aa81d1edc2eb30c654c192a0bdc785720f44f91ad2eba5ed92e.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1796

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:628

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\0b27a1b2bbb21aa81d1edc2eb30c654c192a0bdc785720f44f91ad2eba5ed92e.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1640

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:676

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
c354c062e640262c302083b2dd39d486

SHA1
ae17889f5448cbb48668f56e749a6e87affac9ea

SHA256
3565bafb15e477add4135d349599b53d609ae2b1ce11414c609e9f1b607439c3

SHA512
ef8a666fc3670cfc6dca728af13f31e1b4cb810c91a8c93e203f48e018789371a9fcf64ef4b5e9cf4c4feef70b2b69bd1e69f476e0c4b0e9acaffdb15d66b5e4

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
c354c062e640262c302083b2dd39d486

SHA1
ae17889f5448cbb48668f56e749a6e87affac9ea

SHA256
3565bafb15e477add4135d349599b53d609ae2b1ce11414c609e9f1b607439c3

SHA512
ef8a666fc3670cfc6dca728af13f31e1b4cb810c91a8c93e203f48e018789371a9fcf64ef4b5e9cf4c4feef70b2b69bd1e69f476e0c4b0e9acaffdb15d66b5e4

Download Submit
memory/628-59-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1796-54-0x0000000076C61000-0x0000000076C63000-memory.dmp

Filesize
8KB

Download
memory/1796-58-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads