sakula | 0948544922490f804912b9be60ad94e7ccc73a301cdfd32dbcdbd29af013952a

General

Target

0948544922490f804912b9be60ad94e7ccc73a301cdfd32dbcdbd29af013952a.exe
Size

150KB
MD5

74724506d36be87c1dd96500b62b9bd6
SHA1

ed40350253515fb27af58a3b6e62736d0e956866
SHA256

0948544922490f804912b9be60ad94e7ccc73a301cdfd32dbcdbd29af013952a
SHA512

c1e3158ff189b80b4060c78ed48c93154277e16cf5fd1c16055c387c0193f5c607ac2e1d6881d16960fba00405499841f93dcf6aeb612b037abcdbaa25fdf8dd

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula Payload 2 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula

Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1624 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1544 cmd.exe
Loads dropped DLL 1 IoCs

Processes:

0948544922490f804912b9be60ad94e7ccc73a301cdfd32dbcdbd29af013952a.exe

pid process

1220 0948544922490f804912b9be60ad94e7ccc73a301cdfd32dbcdbd29af013952a.exe

pid	process
1624	MediaCenter.exe

pid	process
1544	cmd.exe

pid	process
1220	0948544922490f804912b9be60ad94e7ccc73a301cdfd32dbcdbd29af013952a.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

0948544922490f804912b9be60ad94e7ccc73a301cdfd32dbcdbd29af013952a.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	0948544922490f804912b9be60ad94e7ccc73a301cdfd32dbcdbd29af013952a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

436 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0948544922490f804912b9be60ad94e7ccc73a301cdfd32dbcdbd29af013952a.exe

description pid process

Token: SeIncBasePriorityPrivilege 1220 0948544922490f804912b9be60ad94e7ccc73a301cdfd32dbcdbd29af013952a.exe

pid	process
436	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1220	0948544922490f804912b9be60ad94e7ccc73a301cdfd32dbcdbd29af013952a.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

0948544922490f804912b9be60ad94e7ccc73a301cdfd32dbcdbd29af013952a.execmd.exe

description	pid	process	target process
PID 1220 wrote to memory of 1624	1220	0948544922490f804912b9be60ad94e7ccc73a301cdfd32dbcdbd29af013952a.exe	MediaCenter.exe
PID 1220 wrote to memory of 1624	1220	0948544922490f804912b9be60ad94e7ccc73a301cdfd32dbcdbd29af013952a.exe	MediaCenter.exe
PID 1220 wrote to memory of 1624	1220	0948544922490f804912b9be60ad94e7ccc73a301cdfd32dbcdbd29af013952a.exe	MediaCenter.exe
PID 1220 wrote to memory of 1624	1220	0948544922490f804912b9be60ad94e7ccc73a301cdfd32dbcdbd29af013952a.exe	MediaCenter.exe
PID 1220 wrote to memory of 1544	1220	0948544922490f804912b9be60ad94e7ccc73a301cdfd32dbcdbd29af013952a.exe	cmd.exe
PID 1220 wrote to memory of 1544	1220	0948544922490f804912b9be60ad94e7ccc73a301cdfd32dbcdbd29af013952a.exe	cmd.exe
PID 1220 wrote to memory of 1544	1220	0948544922490f804912b9be60ad94e7ccc73a301cdfd32dbcdbd29af013952a.exe	cmd.exe
PID 1220 wrote to memory of 1544	1220	0948544922490f804912b9be60ad94e7ccc73a301cdfd32dbcdbd29af013952a.exe	cmd.exe
PID 1544 wrote to memory of 436	1544	cmd.exe	PING.EXE
PID 1544 wrote to memory of 436	1544	cmd.exe	PING.EXE
PID 1544 wrote to memory of 436	1544	cmd.exe	PING.EXE
PID 1544 wrote to memory of 436	1544	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\0948544922490f804912b9be60ad94e7ccc73a301cdfd32dbcdbd29af013952a.exe
"C:\Users\Admin\AppData\Local\Temp\0948544922490f804912b9be60ad94e7ccc73a301cdfd32dbcdbd29af013952a.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1220

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1624

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\0948544922490f804912b9be60ad94e7ccc73a301cdfd32dbcdbd29af013952a.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1544

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:436

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
b78c1af36a5d1ce4eae358cb0c656442

SHA1
147537233fa380b8f5976eacb0256460f5fb7a4c

SHA256
3bd36f4b1c03d90fcd7cb0c78cb8224e01fe48573f148a9b2c35b8552e475a58

SHA512
e1b2a29e098948ddb37d19acdd6f63025af0dce6e8b03e0b107a19ac8e002cf23d99631de4b000f5cc7808a4b40fcf2c084e99154e33c6440eaa49d0b0aeef7b

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
b78c1af36a5d1ce4eae358cb0c656442

SHA1
147537233fa380b8f5976eacb0256460f5fb7a4c

SHA256
3bd36f4b1c03d90fcd7cb0c78cb8224e01fe48573f148a9b2c35b8552e475a58

SHA512
e1b2a29e098948ddb37d19acdd6f63025af0dce6e8b03e0b107a19ac8e002cf23d99631de4b000f5cc7808a4b40fcf2c084e99154e33c6440eaa49d0b0aeef7b

Download Submit
memory/1220-54-0x0000000076071000-0x0000000076073000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads