sakula | 08bfd583e6c4ddf417cd756755bf2d2d38c100f4b39b4cf82ac95479249fc006

General

Target

08bfd583e6c4ddf417cd756755bf2d2d38c100f4b39b4cf82ac95479249fc006.exe
Size

99KB
MD5

e89fc15b316dbaed0f800e0ef18597fc
SHA1

ca4414c0070e3a51625b70b56799dc9ae7642a6b
SHA256

08bfd583e6c4ddf417cd756755bf2d2d38c100f4b39b4cf82ac95479249fc006
SHA512

46ea9c7466690cf3c35a3c4259490ba21e136e2d0795d0cd849cc5c3306715afc86baeca8d576bb3950612b06fd641251038a6f92522f4dfdf33fde84243d8a8

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula Payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula

Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

4384 MediaCenter.exe

pid	process
4384	MediaCenter.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

08bfd583e6c4ddf417cd756755bf2d2d38c100f4b39b4cf82ac95479249fc006.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	08bfd583e6c4ddf417cd756755bf2d2d38c100f4b39b4cf82ac95479249fc006.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

08bfd583e6c4ddf417cd756755bf2d2d38c100f4b39b4cf82ac95479249fc006.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	08bfd583e6c4ddf417cd756755bf2d2d38c100f4b39b4cf82ac95479249fc006.exe

Drops file in Windows directory 8 IoCs

Processes:

svchost.exeTiWorker.exe

description	ioc	process
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TiWorker.exe
File opened for modification	C:\Windows\WinSxS\pending.xml	TiWorker.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

3076 PING.EXE

pid	process
3076	PING.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

svchost.exe08bfd583e6c4ddf417cd756755bf2d2d38c100f4b39b4cf82ac95479249fc006.exeTiWorker.exe

description	pid	process
Token: SeShutdownPrivilege	1936	svchost.exe
Token: SeCreatePagefilePrivilege	1936	svchost.exe
Token: SeShutdownPrivilege	1936	svchost.exe
Token: SeCreatePagefilePrivilege	1936	svchost.exe
Token: SeShutdownPrivilege	1936	svchost.exe
Token: SeCreatePagefilePrivilege	1936	svchost.exe
Token: SeIncBasePriorityPrivilege	4708	08bfd583e6c4ddf417cd756755bf2d2d38c100f4b39b4cf82ac95479249fc006.exe
Token: SeSecurityPrivilege	4508	TiWorker.exe
Token: SeRestorePrivilege	4508	TiWorker.exe
Token: SeBackupPrivilege	4508	TiWorker.exe
Token: SeBackupPrivilege	4508	TiWorker.exe
Token: SeRestorePrivilege	4508	TiWorker.exe
Token: SeSecurityPrivilege	4508	TiWorker.exe
Token: SeBackupPrivilege	4508	TiWorker.exe
Token: SeRestorePrivilege	4508	TiWorker.exe
Token: SeSecurityPrivilege	4508	TiWorker.exe
Token: SeBackupPrivilege	4508	TiWorker.exe
Token: SeRestorePrivilege	4508	TiWorker.exe
Token: SeSecurityPrivilege	4508	TiWorker.exe
Token: SeBackupPrivilege	4508	TiWorker.exe
Token: SeRestorePrivilege	4508	TiWorker.exe
Token: SeSecurityPrivilege	4508	TiWorker.exe
Token: SeBackupPrivilege	4508	TiWorker.exe
Token: SeRestorePrivilege	4508	TiWorker.exe
Token: SeSecurityPrivilege	4508	TiWorker.exe
Token: SeBackupPrivilege	4508	TiWorker.exe
Token: SeRestorePrivilege	4508	TiWorker.exe
Token: SeSecurityPrivilege	4508	TiWorker.exe
Token: SeBackupPrivilege	4508	TiWorker.exe
Token: SeRestorePrivilege	4508	TiWorker.exe
Token: SeSecurityPrivilege	4508	TiWorker.exe
Token: SeBackupPrivilege	4508	TiWorker.exe
Token: SeRestorePrivilege	4508	TiWorker.exe
Token: SeSecurityPrivilege	4508	TiWorker.exe
Token: SeBackupPrivilege	4508	TiWorker.exe
Token: SeRestorePrivilege	4508	TiWorker.exe
Token: SeSecurityPrivilege	4508	TiWorker.exe
Token: SeBackupPrivilege	4508	TiWorker.exe
Token: SeRestorePrivilege	4508	TiWorker.exe
Token: SeSecurityPrivilege	4508	TiWorker.exe
Token: SeBackupPrivilege	4508	TiWorker.exe
Token: SeRestorePrivilege	4508	TiWorker.exe
Token: SeSecurityPrivilege	4508	TiWorker.exe
Token: SeBackupPrivilege	4508	TiWorker.exe
Token: SeRestorePrivilege	4508	TiWorker.exe
Token: SeSecurityPrivilege	4508	TiWorker.exe
Token: SeBackupPrivilege	4508	TiWorker.exe
Token: SeRestorePrivilege	4508	TiWorker.exe
Token: SeSecurityPrivilege	4508	TiWorker.exe
Token: SeBackupPrivilege	4508	TiWorker.exe
Token: SeRestorePrivilege	4508	TiWorker.exe
Token: SeSecurityPrivilege	4508	TiWorker.exe
Token: SeBackupPrivilege	4508	TiWorker.exe
Token: SeRestorePrivilege	4508	TiWorker.exe
Token: SeSecurityPrivilege	4508	TiWorker.exe
Token: SeBackupPrivilege	4508	TiWorker.exe
Token: SeRestorePrivilege	4508	TiWorker.exe
Token: SeSecurityPrivilege	4508	TiWorker.exe
Token: SeBackupPrivilege	4508	TiWorker.exe
Token: SeRestorePrivilege	4508	TiWorker.exe
Token: SeSecurityPrivilege	4508	TiWorker.exe
Token: SeBackupPrivilege	4508	TiWorker.exe
Token: SeRestorePrivilege	4508	TiWorker.exe
Token: SeSecurityPrivilege	4508	TiWorker.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

08bfd583e6c4ddf417cd756755bf2d2d38c100f4b39b4cf82ac95479249fc006.execmd.exe

description	pid	process	target process
PID 4708 wrote to memory of 4384	4708	08bfd583e6c4ddf417cd756755bf2d2d38c100f4b39b4cf82ac95479249fc006.exe	MediaCenter.exe
PID 4708 wrote to memory of 4384	4708	08bfd583e6c4ddf417cd756755bf2d2d38c100f4b39b4cf82ac95479249fc006.exe	MediaCenter.exe
PID 4708 wrote to memory of 4384	4708	08bfd583e6c4ddf417cd756755bf2d2d38c100f4b39b4cf82ac95479249fc006.exe	MediaCenter.exe
PID 4708 wrote to memory of 5100	4708	08bfd583e6c4ddf417cd756755bf2d2d38c100f4b39b4cf82ac95479249fc006.exe	cmd.exe
PID 4708 wrote to memory of 5100	4708	08bfd583e6c4ddf417cd756755bf2d2d38c100f4b39b4cf82ac95479249fc006.exe	cmd.exe
PID 4708 wrote to memory of 5100	4708	08bfd583e6c4ddf417cd756755bf2d2d38c100f4b39b4cf82ac95479249fc006.exe	cmd.exe
PID 5100 wrote to memory of 3076	5100	cmd.exe	PING.EXE
PID 5100 wrote to memory of 3076	5100	cmd.exe	PING.EXE
PID 5100 wrote to memory of 3076	5100	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\08bfd583e6c4ddf417cd756755bf2d2d38c100f4b39b4cf82ac95479249fc006.exe
"C:\Users\Admin\AppData\Local\Temp\08bfd583e6c4ddf417cd756755bf2d2d38c100f4b39b4cf82ac95479249fc006.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4708

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:4384

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\08bfd583e6c4ddf417cd756755bf2d2d38c100f4b39b4cf82ac95479249fc006.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:5100

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:3076

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1936

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4508

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
0127344f80cbb3137efc10db089f934c

SHA1
42b25e2d07530cd420540e0e6eef247cc761cd68

SHA256
aa7f5e0b0c87f2d5cb725109d2b7efa7152c754eac6a5cf783316727d25e2edc

SHA512
d61a4bb96097f1d62e12793926f7a2468feaa75476776b94251c09eb3a819253c6b4c37e6adc5f90b230c34a20a6da5c5bc6c901cb67ed37bb402c6f4ae6a888

Download Submit
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
0127344f80cbb3137efc10db089f934c

SHA1
42b25e2d07530cd420540e0e6eef247cc761cd68

SHA256
aa7f5e0b0c87f2d5cb725109d2b7efa7152c754eac6a5cf783316727d25e2edc

SHA512
d61a4bb96097f1d62e12793926f7a2468feaa75476776b94251c09eb3a819253c6b4c37e6adc5f90b230c34a20a6da5c5bc6c901cb67ed37bb402c6f4ae6a888

Download Submit
memory/1936-132-0x0000023200380000-0x0000023200390000-memory.dmp

Filesize
64KB

Download
memory/1936-133-0x0000023200920000-0x0000023200930000-memory.dmp

Filesize
64KB

Download
memory/1936-134-0x0000023203000000-0x0000023203004000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads