sakula | 09bbf3bffecbd9efd0570e7736d3a963d2e2b84ed6323789734b9fadc2f8ed65

General

Target

09bbf3bffecbd9efd0570e7736d3a963d2e2b84ed6323789734b9fadc2f8ed65.exe
Size

80KB
MD5

a81aca0ebd9222df0bcf7e0b11f69ae9
SHA1

7646215b4b20003bf1ea09c3c9b8e0660fea524b
SHA256

09bbf3bffecbd9efd0570e7736d3a963d2e2b84ed6323789734b9fadc2f8ed65
SHA512

14f36fbaa792c91699af4eeab445de096c6275205bf9b9d475093b8dcd2e625c90ea243e8c872e0b23dcdc82034e3360b7a242433f785174e014a1a3a1b85c21

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula Payload 3 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula

Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1684 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1996 cmd.exe

pid	process
1684	MediaCenter.exe

pid	process
1996	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

09bbf3bffecbd9efd0570e7736d3a963d2e2b84ed6323789734b9fadc2f8ed65.exe

pid	process
1212	09bbf3bffecbd9efd0570e7736d3a963d2e2b84ed6323789734b9fadc2f8ed65.exe
1212	09bbf3bffecbd9efd0570e7736d3a963d2e2b84ed6323789734b9fadc2f8ed65.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

09bbf3bffecbd9efd0570e7736d3a963d2e2b84ed6323789734b9fadc2f8ed65.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	09bbf3bffecbd9efd0570e7736d3a963d2e2b84ed6323789734b9fadc2f8ed65.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2004 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

09bbf3bffecbd9efd0570e7736d3a963d2e2b84ed6323789734b9fadc2f8ed65.exe

description pid process

Token: SeIncBasePriorityPrivilege 1212 09bbf3bffecbd9efd0570e7736d3a963d2e2b84ed6323789734b9fadc2f8ed65.exe

pid	process
2004	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1212	09bbf3bffecbd9efd0570e7736d3a963d2e2b84ed6323789734b9fadc2f8ed65.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

09bbf3bffecbd9efd0570e7736d3a963d2e2b84ed6323789734b9fadc2f8ed65.execmd.exe

description	pid	process	target process
PID 1212 wrote to memory of 1684	1212	09bbf3bffecbd9efd0570e7736d3a963d2e2b84ed6323789734b9fadc2f8ed65.exe	MediaCenter.exe
PID 1212 wrote to memory of 1684	1212	09bbf3bffecbd9efd0570e7736d3a963d2e2b84ed6323789734b9fadc2f8ed65.exe	MediaCenter.exe
PID 1212 wrote to memory of 1684	1212	09bbf3bffecbd9efd0570e7736d3a963d2e2b84ed6323789734b9fadc2f8ed65.exe	MediaCenter.exe
PID 1212 wrote to memory of 1684	1212	09bbf3bffecbd9efd0570e7736d3a963d2e2b84ed6323789734b9fadc2f8ed65.exe	MediaCenter.exe
PID 1212 wrote to memory of 1996	1212	09bbf3bffecbd9efd0570e7736d3a963d2e2b84ed6323789734b9fadc2f8ed65.exe	cmd.exe
PID 1212 wrote to memory of 1996	1212	09bbf3bffecbd9efd0570e7736d3a963d2e2b84ed6323789734b9fadc2f8ed65.exe	cmd.exe
PID 1212 wrote to memory of 1996	1212	09bbf3bffecbd9efd0570e7736d3a963d2e2b84ed6323789734b9fadc2f8ed65.exe	cmd.exe
PID 1212 wrote to memory of 1996	1212	09bbf3bffecbd9efd0570e7736d3a963d2e2b84ed6323789734b9fadc2f8ed65.exe	cmd.exe
PID 1996 wrote to memory of 2004	1996	cmd.exe	PING.EXE
PID 1996 wrote to memory of 2004	1996	cmd.exe	PING.EXE
PID 1996 wrote to memory of 2004	1996	cmd.exe	PING.EXE
PID 1996 wrote to memory of 2004	1996	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\09bbf3bffecbd9efd0570e7736d3a963d2e2b84ed6323789734b9fadc2f8ed65.exe
"C:\Users\Admin\AppData\Local\Temp\09bbf3bffecbd9efd0570e7736d3a963d2e2b84ed6323789734b9fadc2f8ed65.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1212

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1684

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\09bbf3bffecbd9efd0570e7736d3a963d2e2b84ed6323789734b9fadc2f8ed65.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1996

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:2004

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
7d459f5a693340bf2e843c9da7dd5262

SHA1
5dc2bfb7092a6b1643625041e5f89ad7bd83bbca

SHA256
0ca7c69d2fb46983646cc913e8139c6985be8c735e1b17aeb1d0eac4bca2c5e4

SHA512
c4f6eedb18e3388729054f12b9517d994d285e721098f499cf1fb63c4e4e9786e0626dad3a46528d8dd6c7301887eb0c6cb9b344881c8c3c45ab0fd6413f0574

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
7d459f5a693340bf2e843c9da7dd5262

SHA1
5dc2bfb7092a6b1643625041e5f89ad7bd83bbca

SHA256
0ca7c69d2fb46983646cc913e8139c6985be8c735e1b17aeb1d0eac4bca2c5e4

SHA512
c4f6eedb18e3388729054f12b9517d994d285e721098f499cf1fb63c4e4e9786e0626dad3a46528d8dd6c7301887eb0c6cb9b344881c8c3c45ab0fd6413f0574

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
7d459f5a693340bf2e843c9da7dd5262

SHA1
5dc2bfb7092a6b1643625041e5f89ad7bd83bbca

SHA256
0ca7c69d2fb46983646cc913e8139c6985be8c735e1b17aeb1d0eac4bca2c5e4

SHA512
c4f6eedb18e3388729054f12b9517d994d285e721098f499cf1fb63c4e4e9786e0626dad3a46528d8dd6c7301887eb0c6cb9b344881c8c3c45ab0fd6413f0574

Download Submit
memory/1212-54-0x0000000075891000-0x0000000075893000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads