sakula | 089bab16b3f48e42e40f2514e52b9490bc1f84a6f6ec6d3b469fe13a88ecdacd

General

Target

089bab16b3f48e42e40f2514e52b9490bc1f84a6f6ec6d3b469fe13a88ecdacd.exe
Size

79KB
MD5

24f58bb0ddf2f61ab7388e60f8bc3070
SHA1

2aeee50bac7de5fd3d699042790d69f707bcddcb
SHA256

089bab16b3f48e42e40f2514e52b9490bc1f84a6f6ec6d3b469fe13a88ecdacd
SHA512

2a5243ed5e94d4b071ccec7de28cb10d8069e464d58eda9ede61e032e7b3e3f683c631bc7bfbd757f688c2aa09da03233f818f6f882e6ea8dab0ff78436a94d5

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula Payload 3 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula

Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1468 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

816 cmd.exe

pid	process
1468	MediaCenter.exe

pid	process
816	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

089bab16b3f48e42e40f2514e52b9490bc1f84a6f6ec6d3b469fe13a88ecdacd.exe

pid	process
1668	089bab16b3f48e42e40f2514e52b9490bc1f84a6f6ec6d3b469fe13a88ecdacd.exe
1668	089bab16b3f48e42e40f2514e52b9490bc1f84a6f6ec6d3b469fe13a88ecdacd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

089bab16b3f48e42e40f2514e52b9490bc1f84a6f6ec6d3b469fe13a88ecdacd.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	089bab16b3f48e42e40f2514e52b9490bc1f84a6f6ec6d3b469fe13a88ecdacd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1780 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

089bab16b3f48e42e40f2514e52b9490bc1f84a6f6ec6d3b469fe13a88ecdacd.exe

description pid process

Token: SeIncBasePriorityPrivilege 1668 089bab16b3f48e42e40f2514e52b9490bc1f84a6f6ec6d3b469fe13a88ecdacd.exe

pid	process
1780	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1668	089bab16b3f48e42e40f2514e52b9490bc1f84a6f6ec6d3b469fe13a88ecdacd.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

089bab16b3f48e42e40f2514e52b9490bc1f84a6f6ec6d3b469fe13a88ecdacd.execmd.exe

description	pid	process	target process
PID 1668 wrote to memory of 1468	1668	089bab16b3f48e42e40f2514e52b9490bc1f84a6f6ec6d3b469fe13a88ecdacd.exe	MediaCenter.exe
PID 1668 wrote to memory of 1468	1668	089bab16b3f48e42e40f2514e52b9490bc1f84a6f6ec6d3b469fe13a88ecdacd.exe	MediaCenter.exe
PID 1668 wrote to memory of 1468	1668	089bab16b3f48e42e40f2514e52b9490bc1f84a6f6ec6d3b469fe13a88ecdacd.exe	MediaCenter.exe
PID 1668 wrote to memory of 1468	1668	089bab16b3f48e42e40f2514e52b9490bc1f84a6f6ec6d3b469fe13a88ecdacd.exe	MediaCenter.exe
PID 1668 wrote to memory of 816	1668	089bab16b3f48e42e40f2514e52b9490bc1f84a6f6ec6d3b469fe13a88ecdacd.exe	cmd.exe
PID 1668 wrote to memory of 816	1668	089bab16b3f48e42e40f2514e52b9490bc1f84a6f6ec6d3b469fe13a88ecdacd.exe	cmd.exe
PID 1668 wrote to memory of 816	1668	089bab16b3f48e42e40f2514e52b9490bc1f84a6f6ec6d3b469fe13a88ecdacd.exe	cmd.exe
PID 1668 wrote to memory of 816	1668	089bab16b3f48e42e40f2514e52b9490bc1f84a6f6ec6d3b469fe13a88ecdacd.exe	cmd.exe
PID 816 wrote to memory of 1780	816	cmd.exe	PING.EXE
PID 816 wrote to memory of 1780	816	cmd.exe	PING.EXE
PID 816 wrote to memory of 1780	816	cmd.exe	PING.EXE
PID 816 wrote to memory of 1780	816	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\089bab16b3f48e42e40f2514e52b9490bc1f84a6f6ec6d3b469fe13a88ecdacd.exe
"C:\Users\Admin\AppData\Local\Temp\089bab16b3f48e42e40f2514e52b9490bc1f84a6f6ec6d3b469fe13a88ecdacd.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1668

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1468

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\089bab16b3f48e42e40f2514e52b9490bc1f84a6f6ec6d3b469fe13a88ecdacd.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:816

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1780

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
6fbdf0c41eccbd816550f9f286a00b7a

SHA1
9ed41a4c35dc9c78a65d1695119940810d80fed2

SHA256
deb71eccfcf0e5f4aeffa56ef6e41c3231f55caefa2bc1388198ad0921d009d5

SHA512
8d6301af435e9d9974f113699970fb7934b692b845d0f1e5a67f725fe67d51bb713c8a2d41ec046aa056a027329c1f60ac120fd17cb2f9e38ff0d99e20e4567f

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
6fbdf0c41eccbd816550f9f286a00b7a

SHA1
9ed41a4c35dc9c78a65d1695119940810d80fed2

SHA256
deb71eccfcf0e5f4aeffa56ef6e41c3231f55caefa2bc1388198ad0921d009d5

SHA512
8d6301af435e9d9974f113699970fb7934b692b845d0f1e5a67f725fe67d51bb713c8a2d41ec046aa056a027329c1f60ac120fd17cb2f9e38ff0d99e20e4567f

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
6fbdf0c41eccbd816550f9f286a00b7a

SHA1
9ed41a4c35dc9c78a65d1695119940810d80fed2

SHA256
deb71eccfcf0e5f4aeffa56ef6e41c3231f55caefa2bc1388198ad0921d009d5

SHA512
8d6301af435e9d9974f113699970fb7934b692b845d0f1e5a67f725fe67d51bb713c8a2d41ec046aa056a027329c1f60ac120fd17cb2f9e38ff0d99e20e4567f

Download Submit
memory/1668-54-0x0000000075B51000-0x0000000075B53000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads