sakula | 08bfd583e6c4ddf417cd756755bf2d2d38c100f4b39b4cf82ac95479249fc006

General

Target

08bfd583e6c4ddf417cd756755bf2d2d38c100f4b39b4cf82ac95479249fc006.exe
Size

99KB
MD5

e89fc15b316dbaed0f800e0ef18597fc
SHA1

ca4414c0070e3a51625b70b56799dc9ae7642a6b
SHA256

08bfd583e6c4ddf417cd756755bf2d2d38c100f4b39b4cf82ac95479249fc006
SHA512

46ea9c7466690cf3c35a3c4259490ba21e136e2d0795d0cd849cc5c3306715afc86baeca8d576bb3950612b06fd641251038a6f92522f4dfdf33fde84243d8a8

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula Payload 3 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula

Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1928 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1620 cmd.exe

pid	process
1928	MediaCenter.exe

pid	process
1620	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

08bfd583e6c4ddf417cd756755bf2d2d38c100f4b39b4cf82ac95479249fc006.exe

pid	process
1760	08bfd583e6c4ddf417cd756755bf2d2d38c100f4b39b4cf82ac95479249fc006.exe
1760	08bfd583e6c4ddf417cd756755bf2d2d38c100f4b39b4cf82ac95479249fc006.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

08bfd583e6c4ddf417cd756755bf2d2d38c100f4b39b4cf82ac95479249fc006.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	08bfd583e6c4ddf417cd756755bf2d2d38c100f4b39b4cf82ac95479249fc006.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1984 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

08bfd583e6c4ddf417cd756755bf2d2d38c100f4b39b4cf82ac95479249fc006.exe

description pid process

Token: SeIncBasePriorityPrivilege 1760 08bfd583e6c4ddf417cd756755bf2d2d38c100f4b39b4cf82ac95479249fc006.exe

pid	process
1984	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1760	08bfd583e6c4ddf417cd756755bf2d2d38c100f4b39b4cf82ac95479249fc006.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

08bfd583e6c4ddf417cd756755bf2d2d38c100f4b39b4cf82ac95479249fc006.execmd.exe

description	pid	process	target process
PID 1760 wrote to memory of 1928	1760	08bfd583e6c4ddf417cd756755bf2d2d38c100f4b39b4cf82ac95479249fc006.exe	MediaCenter.exe
PID 1760 wrote to memory of 1928	1760	08bfd583e6c4ddf417cd756755bf2d2d38c100f4b39b4cf82ac95479249fc006.exe	MediaCenter.exe
PID 1760 wrote to memory of 1928	1760	08bfd583e6c4ddf417cd756755bf2d2d38c100f4b39b4cf82ac95479249fc006.exe	MediaCenter.exe
PID 1760 wrote to memory of 1928	1760	08bfd583e6c4ddf417cd756755bf2d2d38c100f4b39b4cf82ac95479249fc006.exe	MediaCenter.exe
PID 1760 wrote to memory of 1620	1760	08bfd583e6c4ddf417cd756755bf2d2d38c100f4b39b4cf82ac95479249fc006.exe	cmd.exe
PID 1760 wrote to memory of 1620	1760	08bfd583e6c4ddf417cd756755bf2d2d38c100f4b39b4cf82ac95479249fc006.exe	cmd.exe
PID 1760 wrote to memory of 1620	1760	08bfd583e6c4ddf417cd756755bf2d2d38c100f4b39b4cf82ac95479249fc006.exe	cmd.exe
PID 1760 wrote to memory of 1620	1760	08bfd583e6c4ddf417cd756755bf2d2d38c100f4b39b4cf82ac95479249fc006.exe	cmd.exe
PID 1620 wrote to memory of 1984	1620	cmd.exe	PING.EXE
PID 1620 wrote to memory of 1984	1620	cmd.exe	PING.EXE
PID 1620 wrote to memory of 1984	1620	cmd.exe	PING.EXE
PID 1620 wrote to memory of 1984	1620	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\08bfd583e6c4ddf417cd756755bf2d2d38c100f4b39b4cf82ac95479249fc006.exe
"C:\Users\Admin\AppData\Local\Temp\08bfd583e6c4ddf417cd756755bf2d2d38c100f4b39b4cf82ac95479249fc006.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1760

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1928

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\08bfd583e6c4ddf417cd756755bf2d2d38c100f4b39b4cf82ac95479249fc006.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1620

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1984

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
07e7e639722c46e293ff5d7a35dd29c4

SHA1
2ddd474332aa01b9685aef32005b1b6a0b4ba880

SHA256
ec3ee3d406db18461afc510483aa916c2056ba721e8719e57433f301ba375aa0

SHA512
dbd77e0ba32deab3dfbac6d2a1bbfaf1821119eebdc6e8a2d40fc7106f13ddf62a3781f7ffa1e752b8773f771a522559342b5844e21dfb9dbf559a19dfba30eb

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
07e7e639722c46e293ff5d7a35dd29c4

SHA1
2ddd474332aa01b9685aef32005b1b6a0b4ba880

SHA256
ec3ee3d406db18461afc510483aa916c2056ba721e8719e57433f301ba375aa0

SHA512
dbd77e0ba32deab3dfbac6d2a1bbfaf1821119eebdc6e8a2d40fc7106f13ddf62a3781f7ffa1e752b8773f771a522559342b5844e21dfb9dbf559a19dfba30eb

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
07e7e639722c46e293ff5d7a35dd29c4

SHA1
2ddd474332aa01b9685aef32005b1b6a0b4ba880

SHA256
ec3ee3d406db18461afc510483aa916c2056ba721e8719e57433f301ba375aa0

SHA512
dbd77e0ba32deab3dfbac6d2a1bbfaf1821119eebdc6e8a2d40fc7106f13ddf62a3781f7ffa1e752b8773f771a522559342b5844e21dfb9dbf559a19dfba30eb

Download Submit
memory/1760-54-0x0000000075341000-0x0000000075343000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads