sakula | 07df54b0a5ac32e0896d4ae48de911550f27c10f43234994d1b190cc76074744

General

Target

07df54b0a5ac32e0896d4ae48de911550f27c10f43234994d1b190cc76074744.exe
Size

58KB
MD5

b0c134cc1dc96a19c3883b23e691e4f7
SHA1

2bab85d1f85eee5171ca7f29194c36781f0dfc62
SHA256

07df54b0a5ac32e0896d4ae48de911550f27c10f43234994d1b190cc76074744
SHA512

89bcd213f954399cb978136aaaa478d97945656269011fa39a292dbd824f54a228c769324ef421110333dd6dbf4b190decb330470c7ef97a1834efc3cead7c30

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

268 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2020 cmd.exe

pid	process
268	MediaCenter.exe

pid	process
2020	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

07df54b0a5ac32e0896d4ae48de911550f27c10f43234994d1b190cc76074744.exe

pid	process
1860	07df54b0a5ac32e0896d4ae48de911550f27c10f43234994d1b190cc76074744.exe
1860	07df54b0a5ac32e0896d4ae48de911550f27c10f43234994d1b190cc76074744.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

07df54b0a5ac32e0896d4ae48de911550f27c10f43234994d1b190cc76074744.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	07df54b0a5ac32e0896d4ae48de911550f27c10f43234994d1b190cc76074744.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

836 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

07df54b0a5ac32e0896d4ae48de911550f27c10f43234994d1b190cc76074744.exe

description pid process

Token: SeIncBasePriorityPrivilege 1860 07df54b0a5ac32e0896d4ae48de911550f27c10f43234994d1b190cc76074744.exe

pid	process
836	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1860	07df54b0a5ac32e0896d4ae48de911550f27c10f43234994d1b190cc76074744.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

07df54b0a5ac32e0896d4ae48de911550f27c10f43234994d1b190cc76074744.execmd.exe

description	pid	process	target process
PID 1860 wrote to memory of 268	1860	07df54b0a5ac32e0896d4ae48de911550f27c10f43234994d1b190cc76074744.exe	MediaCenter.exe
PID 1860 wrote to memory of 268	1860	07df54b0a5ac32e0896d4ae48de911550f27c10f43234994d1b190cc76074744.exe	MediaCenter.exe
PID 1860 wrote to memory of 268	1860	07df54b0a5ac32e0896d4ae48de911550f27c10f43234994d1b190cc76074744.exe	MediaCenter.exe
PID 1860 wrote to memory of 268	1860	07df54b0a5ac32e0896d4ae48de911550f27c10f43234994d1b190cc76074744.exe	MediaCenter.exe
PID 1860 wrote to memory of 2020	1860	07df54b0a5ac32e0896d4ae48de911550f27c10f43234994d1b190cc76074744.exe	cmd.exe
PID 1860 wrote to memory of 2020	1860	07df54b0a5ac32e0896d4ae48de911550f27c10f43234994d1b190cc76074744.exe	cmd.exe
PID 1860 wrote to memory of 2020	1860	07df54b0a5ac32e0896d4ae48de911550f27c10f43234994d1b190cc76074744.exe	cmd.exe
PID 1860 wrote to memory of 2020	1860	07df54b0a5ac32e0896d4ae48de911550f27c10f43234994d1b190cc76074744.exe	cmd.exe
PID 2020 wrote to memory of 836	2020	cmd.exe	PING.EXE
PID 2020 wrote to memory of 836	2020	cmd.exe	PING.EXE
PID 2020 wrote to memory of 836	2020	cmd.exe	PING.EXE
PID 2020 wrote to memory of 836	2020	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\07df54b0a5ac32e0896d4ae48de911550f27c10f43234994d1b190cc76074744.exe
"C:\Users\Admin\AppData\Local\Temp\07df54b0a5ac32e0896d4ae48de911550f27c10f43234994d1b190cc76074744.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1860

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:268

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\07df54b0a5ac32e0896d4ae48de911550f27c10f43234994d1b190cc76074744.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2020

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:836

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
dacc29b10add4c28de7118779ad12aae

SHA1
17bf04218a41e050b29fb859795e4e43e8ac0b38

SHA256
46ecc5db297a69ccc42160dcddba9d871b63af14c32fd4c427ff212552f21a75

SHA512
9f6294f3d34de78f70813f3049e8ed1f49b477fd510ad4f1d2d487be8a79dc6cd0e2301c57901ffe50a4028f99c7589da18f981713b9b6d9cc3d6a63721344de

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
dacc29b10add4c28de7118779ad12aae

SHA1
17bf04218a41e050b29fb859795e4e43e8ac0b38

SHA256
46ecc5db297a69ccc42160dcddba9d871b63af14c32fd4c427ff212552f21a75

SHA512
9f6294f3d34de78f70813f3049e8ed1f49b477fd510ad4f1d2d487be8a79dc6cd0e2301c57901ffe50a4028f99c7589da18f981713b9b6d9cc3d6a63721344de

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
dacc29b10add4c28de7118779ad12aae

SHA1
17bf04218a41e050b29fb859795e4e43e8ac0b38

SHA256
46ecc5db297a69ccc42160dcddba9d871b63af14c32fd4c427ff212552f21a75

SHA512
9f6294f3d34de78f70813f3049e8ed1f49b477fd510ad4f1d2d487be8a79dc6cd0e2301c57901ffe50a4028f99c7589da18f981713b9b6d9cc3d6a63721344de

Download Submit
memory/1860-54-0x0000000075891000-0x0000000075893000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads