sakula | 0b279149b9bbb72640c5263dfcff07db7bba7c3017759d67716d3257c372ab91

General

Target

0b279149b9bbb72640c5263dfcff07db7bba7c3017759d67716d3257c372ab91.exe
Size

80KB
MD5

1b2f8f6d930b88622f2b15dc876483d2
SHA1

5168e25d26db7688bef6c8c7637f145b5bfba4d5
SHA256

0b279149b9bbb72640c5263dfcff07db7bba7c3017759d67716d3257c372ab91
SHA512

3640a4f4b2d18e5423fc9b2436f0373775438ccdf7c4f7dc7a76be38860318ab239c5e2427e81017e922cbf938bf08e2fa83699a949113fca7f539f29dc2ad0f

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula Payload 3 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula

Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

480 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

812 cmd.exe

pid	process
480	MediaCenter.exe

pid	process
812	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

0b279149b9bbb72640c5263dfcff07db7bba7c3017759d67716d3257c372ab91.exe

pid	process
1052	0b279149b9bbb72640c5263dfcff07db7bba7c3017759d67716d3257c372ab91.exe
1052	0b279149b9bbb72640c5263dfcff07db7bba7c3017759d67716d3257c372ab91.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

0b279149b9bbb72640c5263dfcff07db7bba7c3017759d67716d3257c372ab91.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	0b279149b9bbb72640c5263dfcff07db7bba7c3017759d67716d3257c372ab91.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1960 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0b279149b9bbb72640c5263dfcff07db7bba7c3017759d67716d3257c372ab91.exe

description pid process

Token: SeIncBasePriorityPrivilege 1052 0b279149b9bbb72640c5263dfcff07db7bba7c3017759d67716d3257c372ab91.exe

pid	process
1960	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1052	0b279149b9bbb72640c5263dfcff07db7bba7c3017759d67716d3257c372ab91.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

0b279149b9bbb72640c5263dfcff07db7bba7c3017759d67716d3257c372ab91.execmd.exe

description	pid	process	target process
PID 1052 wrote to memory of 480	1052	0b279149b9bbb72640c5263dfcff07db7bba7c3017759d67716d3257c372ab91.exe	MediaCenter.exe
PID 1052 wrote to memory of 480	1052	0b279149b9bbb72640c5263dfcff07db7bba7c3017759d67716d3257c372ab91.exe	MediaCenter.exe
PID 1052 wrote to memory of 480	1052	0b279149b9bbb72640c5263dfcff07db7bba7c3017759d67716d3257c372ab91.exe	MediaCenter.exe
PID 1052 wrote to memory of 480	1052	0b279149b9bbb72640c5263dfcff07db7bba7c3017759d67716d3257c372ab91.exe	MediaCenter.exe
PID 1052 wrote to memory of 812	1052	0b279149b9bbb72640c5263dfcff07db7bba7c3017759d67716d3257c372ab91.exe	cmd.exe
PID 1052 wrote to memory of 812	1052	0b279149b9bbb72640c5263dfcff07db7bba7c3017759d67716d3257c372ab91.exe	cmd.exe
PID 1052 wrote to memory of 812	1052	0b279149b9bbb72640c5263dfcff07db7bba7c3017759d67716d3257c372ab91.exe	cmd.exe
PID 1052 wrote to memory of 812	1052	0b279149b9bbb72640c5263dfcff07db7bba7c3017759d67716d3257c372ab91.exe	cmd.exe
PID 812 wrote to memory of 1960	812	cmd.exe	PING.EXE
PID 812 wrote to memory of 1960	812	cmd.exe	PING.EXE
PID 812 wrote to memory of 1960	812	cmd.exe	PING.EXE
PID 812 wrote to memory of 1960	812	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\0b279149b9bbb72640c5263dfcff07db7bba7c3017759d67716d3257c372ab91.exe
"C:\Users\Admin\AppData\Local\Temp\0b279149b9bbb72640c5263dfcff07db7bba7c3017759d67716d3257c372ab91.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1052

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:480

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\0b279149b9bbb72640c5263dfcff07db7bba7c3017759d67716d3257c372ab91.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:812

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1960

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
de8aa461def90671fc5151f031f475ee

SHA1
3e0ba96bc3b90c5d93634fcaf0f9948c424437d6

SHA256
103ebf5a5b97ae2348fa2707ab8ebed7a88f904537ce2ec1b50da0b4b8e91b77

SHA512
eda5aa36578afaaf9c7f6bf75c0a4e7391245526cb9e321c57ee0d671c40f32dab43824d194b89e3d04e5790fc8ce46ddb9197c2bb2f3c43ac2ba8f136e35c87

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
de8aa461def90671fc5151f031f475ee

SHA1
3e0ba96bc3b90c5d93634fcaf0f9948c424437d6

SHA256
103ebf5a5b97ae2348fa2707ab8ebed7a88f904537ce2ec1b50da0b4b8e91b77

SHA512
eda5aa36578afaaf9c7f6bf75c0a4e7391245526cb9e321c57ee0d671c40f32dab43824d194b89e3d04e5790fc8ce46ddb9197c2bb2f3c43ac2ba8f136e35c87

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
de8aa461def90671fc5151f031f475ee

SHA1
3e0ba96bc3b90c5d93634fcaf0f9948c424437d6

SHA256
103ebf5a5b97ae2348fa2707ab8ebed7a88f904537ce2ec1b50da0b4b8e91b77

SHA512
eda5aa36578afaaf9c7f6bf75c0a4e7391245526cb9e321c57ee0d671c40f32dab43824d194b89e3d04e5790fc8ce46ddb9197c2bb2f3c43ac2ba8f136e35c87

Download Submit
memory/1052-55-0x0000000074EC1000-0x0000000074EC3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads