sakula | 091751c441f73ec452289edc4f8996d03ffa836df68db13e369b460c3af06f79

General

Target

091751c441f73ec452289edc4f8996d03ffa836df68db13e369b460c3af06f79.exe
Size

80KB
MD5

4ebe8c3822c2bffd4a8bdbbc29c6754d
SHA1

d6f50eabc1794031d89f5f080a16ca6d30ee60e1
SHA256

091751c441f73ec452289edc4f8996d03ffa836df68db13e369b460c3af06f79
SHA512

e011ab23839d44b587bed12d5c8a1dcd4ddc1bcbf4fbd0c15a82310529cf927f28a5c009dde02dabe26eb8d28e11e055d3cdb648638f56fec01cf012b516ea4c

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula Payload 3 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula

Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

900 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1388 cmd.exe

pid	process
900	MediaCenter.exe

pid	process
1388	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

091751c441f73ec452289edc4f8996d03ffa836df68db13e369b460c3af06f79.exe

pid	process
960	091751c441f73ec452289edc4f8996d03ffa836df68db13e369b460c3af06f79.exe
960	091751c441f73ec452289edc4f8996d03ffa836df68db13e369b460c3af06f79.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

091751c441f73ec452289edc4f8996d03ffa836df68db13e369b460c3af06f79.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	091751c441f73ec452289edc4f8996d03ffa836df68db13e369b460c3af06f79.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1700 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

091751c441f73ec452289edc4f8996d03ffa836df68db13e369b460c3af06f79.exe

description pid process

Token: SeIncBasePriorityPrivilege 960 091751c441f73ec452289edc4f8996d03ffa836df68db13e369b460c3af06f79.exe

pid	process
1700	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	960	091751c441f73ec452289edc4f8996d03ffa836df68db13e369b460c3af06f79.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

091751c441f73ec452289edc4f8996d03ffa836df68db13e369b460c3af06f79.execmd.exe

description	pid	process	target process
PID 960 wrote to memory of 900	960	091751c441f73ec452289edc4f8996d03ffa836df68db13e369b460c3af06f79.exe	MediaCenter.exe
PID 960 wrote to memory of 900	960	091751c441f73ec452289edc4f8996d03ffa836df68db13e369b460c3af06f79.exe	MediaCenter.exe
PID 960 wrote to memory of 900	960	091751c441f73ec452289edc4f8996d03ffa836df68db13e369b460c3af06f79.exe	MediaCenter.exe
PID 960 wrote to memory of 900	960	091751c441f73ec452289edc4f8996d03ffa836df68db13e369b460c3af06f79.exe	MediaCenter.exe
PID 960 wrote to memory of 1388	960	091751c441f73ec452289edc4f8996d03ffa836df68db13e369b460c3af06f79.exe	cmd.exe
PID 960 wrote to memory of 1388	960	091751c441f73ec452289edc4f8996d03ffa836df68db13e369b460c3af06f79.exe	cmd.exe
PID 960 wrote to memory of 1388	960	091751c441f73ec452289edc4f8996d03ffa836df68db13e369b460c3af06f79.exe	cmd.exe
PID 960 wrote to memory of 1388	960	091751c441f73ec452289edc4f8996d03ffa836df68db13e369b460c3af06f79.exe	cmd.exe
PID 1388 wrote to memory of 1700	1388	cmd.exe	PING.EXE
PID 1388 wrote to memory of 1700	1388	cmd.exe	PING.EXE
PID 1388 wrote to memory of 1700	1388	cmd.exe	PING.EXE
PID 1388 wrote to memory of 1700	1388	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\091751c441f73ec452289edc4f8996d03ffa836df68db13e369b460c3af06f79.exe
"C:\Users\Admin\AppData\Local\Temp\091751c441f73ec452289edc4f8996d03ffa836df68db13e369b460c3af06f79.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:960

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:900

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\091751c441f73ec452289edc4f8996d03ffa836df68db13e369b460c3af06f79.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1388

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1700

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
db49ac322f27f4fee032d0d5f743eeec

SHA1
ca25809d11ae9a9b12a5052fcfb1ce41a98478de

SHA256
5a9526098a1d3c701272a47fc64dc79746209a3b9933c7cfb8e02b85650a5974

SHA512
48e1f8e319008684de537ccfae0199633174fd76ac4f56173ba3870610f5ec832cb8d3d3dfabb730e3f7df9eee749ffabf422f301e76eba1e457fc71b539ef51

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
db49ac322f27f4fee032d0d5f743eeec

SHA1
ca25809d11ae9a9b12a5052fcfb1ce41a98478de

SHA256
5a9526098a1d3c701272a47fc64dc79746209a3b9933c7cfb8e02b85650a5974

SHA512
48e1f8e319008684de537ccfae0199633174fd76ac4f56173ba3870610f5ec832cb8d3d3dfabb730e3f7df9eee749ffabf422f301e76eba1e457fc71b539ef51

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
db49ac322f27f4fee032d0d5f743eeec

SHA1
ca25809d11ae9a9b12a5052fcfb1ce41a98478de

SHA256
5a9526098a1d3c701272a47fc64dc79746209a3b9933c7cfb8e02b85650a5974

SHA512
48e1f8e319008684de537ccfae0199633174fd76ac4f56173ba3870610f5ec832cb8d3d3dfabb730e3f7df9eee749ffabf422f301e76eba1e457fc71b539ef51

Download Submit
memory/960-55-0x00000000769D1000-0x00000000769D3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads