sakula | 08b2783602db3788d61a96535a4ab5b6ff48ff33c1de16a74ce71bbe06cc7eb6

General

Target

08b2783602db3788d61a96535a4ab5b6ff48ff33c1de16a74ce71bbe06cc7eb6.exe
Size

191KB
MD5

88e2e592b8a5cd874e062150eeaefc4f
SHA1

1d8296de3e548fc2ca79e7401193666e37ec2747
SHA256

08b2783602db3788d61a96535a4ab5b6ff48ff33c1de16a74ce71bbe06cc7eb6
SHA512

b12dfeb0370c0a9b69c97b120674e5bbc3112a92402d8c6e07c352014bf10e3ad8b479aa1e6e34ad13c7acc3ca6a2fe10a75d4613ec738ffd3ce0ee6f4b0e646

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula Payload 3 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula

Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1448 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1796 cmd.exe

pid	process
1448	MediaCenter.exe

pid	process
1796	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

08b2783602db3788d61a96535a4ab5b6ff48ff33c1de16a74ce71bbe06cc7eb6.exe

pid	process
1592	08b2783602db3788d61a96535a4ab5b6ff48ff33c1de16a74ce71bbe06cc7eb6.exe
1592	08b2783602db3788d61a96535a4ab5b6ff48ff33c1de16a74ce71bbe06cc7eb6.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

08b2783602db3788d61a96535a4ab5b6ff48ff33c1de16a74ce71bbe06cc7eb6.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	08b2783602db3788d61a96535a4ab5b6ff48ff33c1de16a74ce71bbe06cc7eb6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

816 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

08b2783602db3788d61a96535a4ab5b6ff48ff33c1de16a74ce71bbe06cc7eb6.exe

description pid process

Token: SeIncBasePriorityPrivilege 1592 08b2783602db3788d61a96535a4ab5b6ff48ff33c1de16a74ce71bbe06cc7eb6.exe

pid	process
816	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1592	08b2783602db3788d61a96535a4ab5b6ff48ff33c1de16a74ce71bbe06cc7eb6.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

08b2783602db3788d61a96535a4ab5b6ff48ff33c1de16a74ce71bbe06cc7eb6.execmd.exe

description	pid	process	target process
PID 1592 wrote to memory of 1448	1592	08b2783602db3788d61a96535a4ab5b6ff48ff33c1de16a74ce71bbe06cc7eb6.exe	MediaCenter.exe
PID 1592 wrote to memory of 1448	1592	08b2783602db3788d61a96535a4ab5b6ff48ff33c1de16a74ce71bbe06cc7eb6.exe	MediaCenter.exe
PID 1592 wrote to memory of 1448	1592	08b2783602db3788d61a96535a4ab5b6ff48ff33c1de16a74ce71bbe06cc7eb6.exe	MediaCenter.exe
PID 1592 wrote to memory of 1448	1592	08b2783602db3788d61a96535a4ab5b6ff48ff33c1de16a74ce71bbe06cc7eb6.exe	MediaCenter.exe
PID 1592 wrote to memory of 1796	1592	08b2783602db3788d61a96535a4ab5b6ff48ff33c1de16a74ce71bbe06cc7eb6.exe	cmd.exe
PID 1592 wrote to memory of 1796	1592	08b2783602db3788d61a96535a4ab5b6ff48ff33c1de16a74ce71bbe06cc7eb6.exe	cmd.exe
PID 1592 wrote to memory of 1796	1592	08b2783602db3788d61a96535a4ab5b6ff48ff33c1de16a74ce71bbe06cc7eb6.exe	cmd.exe
PID 1592 wrote to memory of 1796	1592	08b2783602db3788d61a96535a4ab5b6ff48ff33c1de16a74ce71bbe06cc7eb6.exe	cmd.exe
PID 1796 wrote to memory of 816	1796	cmd.exe	PING.EXE
PID 1796 wrote to memory of 816	1796	cmd.exe	PING.EXE
PID 1796 wrote to memory of 816	1796	cmd.exe	PING.EXE
PID 1796 wrote to memory of 816	1796	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\08b2783602db3788d61a96535a4ab5b6ff48ff33c1de16a74ce71bbe06cc7eb6.exe
"C:\Users\Admin\AppData\Local\Temp\08b2783602db3788d61a96535a4ab5b6ff48ff33c1de16a74ce71bbe06cc7eb6.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1592

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1448

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\08b2783602db3788d61a96535a4ab5b6ff48ff33c1de16a74ce71bbe06cc7eb6.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1796

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:816

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
c353088e07bb1f0e5d3ea1372c7de13c

SHA1
1c7305f112cf12a998054a1f9615bd50ff69c151

SHA256
e1f8b4e8778a6eeb2a75ddcda229df78a2279ac1a305932292648373ffb43b58

SHA512
a597242264e4cc49d594eab9feb7fc921315d57b9d62e5d37ac9dffdc0c303660715abed412a81175a3d954cb3b2cae1478f4a81bb6132323e6c7fb1eb296057

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
c353088e07bb1f0e5d3ea1372c7de13c

SHA1
1c7305f112cf12a998054a1f9615bd50ff69c151

SHA256
e1f8b4e8778a6eeb2a75ddcda229df78a2279ac1a305932292648373ffb43b58

SHA512
a597242264e4cc49d594eab9feb7fc921315d57b9d62e5d37ac9dffdc0c303660715abed412a81175a3d954cb3b2cae1478f4a81bb6132323e6c7fb1eb296057

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
c353088e07bb1f0e5d3ea1372c7de13c

SHA1
1c7305f112cf12a998054a1f9615bd50ff69c151

SHA256
e1f8b4e8778a6eeb2a75ddcda229df78a2279ac1a305932292648373ffb43b58

SHA512
a597242264e4cc49d594eab9feb7fc921315d57b9d62e5d37ac9dffdc0c303660715abed412a81175a3d954cb3b2cae1478f4a81bb6132323e6c7fb1eb296057

Download Submit
memory/1592-54-0x0000000076421000-0x0000000076423000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads