sakula | 089f5a0c7bd58ac3f5db7b82193fe5516e0dd1a943de27f5f0398dd86627e925

General

Target

089f5a0c7bd58ac3f5db7b82193fe5516e0dd1a943de27f5f0398dd86627e925.exe
Size

60KB
MD5

b87cc2abca0eda8e01106c1680afe3ed
SHA1

779d7ab5059480018d2aed5e65b659b97ff36821
SHA256

089f5a0c7bd58ac3f5db7b82193fe5516e0dd1a943de27f5f0398dd86627e925
SHA512

8e3e5ff01750c8f5aa858d1d6208643e173567296f1d56203443c68aa1af57a2b9ffd1b4985e9fcba274eb1c255182ad9a28a89ea9a353a9c845f0183f78441e

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1520 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1996 cmd.exe

pid	process
1520	MediaCenter.exe

pid	process
1996	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

089f5a0c7bd58ac3f5db7b82193fe5516e0dd1a943de27f5f0398dd86627e925.exe

pid	process
1508	089f5a0c7bd58ac3f5db7b82193fe5516e0dd1a943de27f5f0398dd86627e925.exe
1508	089f5a0c7bd58ac3f5db7b82193fe5516e0dd1a943de27f5f0398dd86627e925.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

089f5a0c7bd58ac3f5db7b82193fe5516e0dd1a943de27f5f0398dd86627e925.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	089f5a0c7bd58ac3f5db7b82193fe5516e0dd1a943de27f5f0398dd86627e925.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1088 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

089f5a0c7bd58ac3f5db7b82193fe5516e0dd1a943de27f5f0398dd86627e925.exe

description pid process

Token: SeIncBasePriorityPrivilege 1508 089f5a0c7bd58ac3f5db7b82193fe5516e0dd1a943de27f5f0398dd86627e925.exe

pid	process
1088	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1508	089f5a0c7bd58ac3f5db7b82193fe5516e0dd1a943de27f5f0398dd86627e925.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

089f5a0c7bd58ac3f5db7b82193fe5516e0dd1a943de27f5f0398dd86627e925.execmd.exe

description	pid	process	target process
PID 1508 wrote to memory of 1520	1508	089f5a0c7bd58ac3f5db7b82193fe5516e0dd1a943de27f5f0398dd86627e925.exe	MediaCenter.exe
PID 1508 wrote to memory of 1520	1508	089f5a0c7bd58ac3f5db7b82193fe5516e0dd1a943de27f5f0398dd86627e925.exe	MediaCenter.exe
PID 1508 wrote to memory of 1520	1508	089f5a0c7bd58ac3f5db7b82193fe5516e0dd1a943de27f5f0398dd86627e925.exe	MediaCenter.exe
PID 1508 wrote to memory of 1520	1508	089f5a0c7bd58ac3f5db7b82193fe5516e0dd1a943de27f5f0398dd86627e925.exe	MediaCenter.exe
PID 1508 wrote to memory of 1996	1508	089f5a0c7bd58ac3f5db7b82193fe5516e0dd1a943de27f5f0398dd86627e925.exe	cmd.exe
PID 1508 wrote to memory of 1996	1508	089f5a0c7bd58ac3f5db7b82193fe5516e0dd1a943de27f5f0398dd86627e925.exe	cmd.exe
PID 1508 wrote to memory of 1996	1508	089f5a0c7bd58ac3f5db7b82193fe5516e0dd1a943de27f5f0398dd86627e925.exe	cmd.exe
PID 1508 wrote to memory of 1996	1508	089f5a0c7bd58ac3f5db7b82193fe5516e0dd1a943de27f5f0398dd86627e925.exe	cmd.exe
PID 1996 wrote to memory of 1088	1996	cmd.exe	PING.EXE
PID 1996 wrote to memory of 1088	1996	cmd.exe	PING.EXE
PID 1996 wrote to memory of 1088	1996	cmd.exe	PING.EXE
PID 1996 wrote to memory of 1088	1996	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\089f5a0c7bd58ac3f5db7b82193fe5516e0dd1a943de27f5f0398dd86627e925.exe
"C:\Users\Admin\AppData\Local\Temp\089f5a0c7bd58ac3f5db7b82193fe5516e0dd1a943de27f5f0398dd86627e925.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1508

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1520

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\089f5a0c7bd58ac3f5db7b82193fe5516e0dd1a943de27f5f0398dd86627e925.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1996

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1088

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
068651989004cbc7b6eeed6edd1fc91e

SHA1
61c4eeb61b5fd0b2869fad7e48ec340f97b32156

SHA256
eeca42d093f787189e75ea19ebe4c82d6187f317397d233f4cb5525747502f09

SHA512
18ed3a3a73460f9ccbe678e98857a8eeea0636dd0d26d54c8be6d197309bbeb6b5ce48423dae1ce1ba779194cae3ca402e0f5b017b248c7462515fd46dc8f59c

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
068651989004cbc7b6eeed6edd1fc91e

SHA1
61c4eeb61b5fd0b2869fad7e48ec340f97b32156

SHA256
eeca42d093f787189e75ea19ebe4c82d6187f317397d233f4cb5525747502f09

SHA512
18ed3a3a73460f9ccbe678e98857a8eeea0636dd0d26d54c8be6d197309bbeb6b5ce48423dae1ce1ba779194cae3ca402e0f5b017b248c7462515fd46dc8f59c

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
068651989004cbc7b6eeed6edd1fc91e

SHA1
61c4eeb61b5fd0b2869fad7e48ec340f97b32156

SHA256
eeca42d093f787189e75ea19ebe4c82d6187f317397d233f4cb5525747502f09

SHA512
18ed3a3a73460f9ccbe678e98857a8eeea0636dd0d26d54c8be6d197309bbeb6b5ce48423dae1ce1ba779194cae3ca402e0f5b017b248c7462515fd46dc8f59c

Download Submit
memory/1508-54-0x0000000076911000-0x0000000076913000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads