sakula | 08fa44bffaeb2a5054af71102d2c96f815ac496f78c19d52b64d132849f96489

General

Target

08fa44bffaeb2a5054af71102d2c96f815ac496f78c19d52b64d132849f96489.exe
Size

35KB
MD5

129386e6ba7418931b58deeb282b05cd
SHA1

0f757cc073dcb2913e24fdcbd770660690f7bb4d
SHA256

08fa44bffaeb2a5054af71102d2c96f815ac496f78c19d52b64d132849f96489
SHA512

7df7f452f38d44ca18f7ad6be332e7dcd53122a3b061eef7befd941011d004362cca79fa1b9d32237a2b4cabf9cf630f2c1d88dbf074366f7716ee1e7eeb36a4

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1604 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

428 cmd.exe

pid	process
1604	MediaCenter.exe

pid	process
428	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

08fa44bffaeb2a5054af71102d2c96f815ac496f78c19d52b64d132849f96489.exe

pid	process
1592	08fa44bffaeb2a5054af71102d2c96f815ac496f78c19d52b64d132849f96489.exe
1592	08fa44bffaeb2a5054af71102d2c96f815ac496f78c19d52b64d132849f96489.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

08fa44bffaeb2a5054af71102d2c96f815ac496f78c19d52b64d132849f96489.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	08fa44bffaeb2a5054af71102d2c96f815ac496f78c19d52b64d132849f96489.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1868 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

08fa44bffaeb2a5054af71102d2c96f815ac496f78c19d52b64d132849f96489.exe

description pid process

Token: SeIncBasePriorityPrivilege 1592 08fa44bffaeb2a5054af71102d2c96f815ac496f78c19d52b64d132849f96489.exe

pid	process
1868	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1592	08fa44bffaeb2a5054af71102d2c96f815ac496f78c19d52b64d132849f96489.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

08fa44bffaeb2a5054af71102d2c96f815ac496f78c19d52b64d132849f96489.execmd.exe

description	pid	process	target process
PID 1592 wrote to memory of 1604	1592	08fa44bffaeb2a5054af71102d2c96f815ac496f78c19d52b64d132849f96489.exe	MediaCenter.exe
PID 1592 wrote to memory of 1604	1592	08fa44bffaeb2a5054af71102d2c96f815ac496f78c19d52b64d132849f96489.exe	MediaCenter.exe
PID 1592 wrote to memory of 1604	1592	08fa44bffaeb2a5054af71102d2c96f815ac496f78c19d52b64d132849f96489.exe	MediaCenter.exe
PID 1592 wrote to memory of 1604	1592	08fa44bffaeb2a5054af71102d2c96f815ac496f78c19d52b64d132849f96489.exe	MediaCenter.exe
PID 1592 wrote to memory of 428	1592	08fa44bffaeb2a5054af71102d2c96f815ac496f78c19d52b64d132849f96489.exe	cmd.exe
PID 1592 wrote to memory of 428	1592	08fa44bffaeb2a5054af71102d2c96f815ac496f78c19d52b64d132849f96489.exe	cmd.exe
PID 1592 wrote to memory of 428	1592	08fa44bffaeb2a5054af71102d2c96f815ac496f78c19d52b64d132849f96489.exe	cmd.exe
PID 1592 wrote to memory of 428	1592	08fa44bffaeb2a5054af71102d2c96f815ac496f78c19d52b64d132849f96489.exe	cmd.exe
PID 428 wrote to memory of 1868	428	cmd.exe	PING.EXE
PID 428 wrote to memory of 1868	428	cmd.exe	PING.EXE
PID 428 wrote to memory of 1868	428	cmd.exe	PING.EXE
PID 428 wrote to memory of 1868	428	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\08fa44bffaeb2a5054af71102d2c96f815ac496f78c19d52b64d132849f96489.exe
"C:\Users\Admin\AppData\Local\Temp\08fa44bffaeb2a5054af71102d2c96f815ac496f78c19d52b64d132849f96489.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1592

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1604

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\08fa44bffaeb2a5054af71102d2c96f815ac496f78c19d52b64d132849f96489.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:428

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1868

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
9fa69eed1ec715240a3d68a1d4fd9680

SHA1
f4dbf6c2ed8da7260be3b0278b454141724bcd53

SHA256
f0926f0657b73a6b2c050e75db3910b26a825fc77631813739c8295ddc04e884

SHA512
edef76c72463bc930166b8ffbebb4d03934f7a5ec1e1bf12221c051f47cdc2abdb088910b871006150fdd676ebc226cf5859e3fbb9be0714b742e0350ca15a42

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
9fa69eed1ec715240a3d68a1d4fd9680

SHA1
f4dbf6c2ed8da7260be3b0278b454141724bcd53

SHA256
f0926f0657b73a6b2c050e75db3910b26a825fc77631813739c8295ddc04e884

SHA512
edef76c72463bc930166b8ffbebb4d03934f7a5ec1e1bf12221c051f47cdc2abdb088910b871006150fdd676ebc226cf5859e3fbb9be0714b742e0350ca15a42

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
9fa69eed1ec715240a3d68a1d4fd9680

SHA1
f4dbf6c2ed8da7260be3b0278b454141724bcd53

SHA256
f0926f0657b73a6b2c050e75db3910b26a825fc77631813739c8295ddc04e884

SHA512
edef76c72463bc930166b8ffbebb4d03934f7a5ec1e1bf12221c051f47cdc2abdb088910b871006150fdd676ebc226cf5859e3fbb9be0714b742e0350ca15a42

Download Submit
memory/1592-54-0x0000000075471000-0x0000000075473000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads