sakula | 058d435f47da03c5604b3b14ccae3cdcddcff597274d7ef6d59b746edf6460e1

General

Target

058d435f47da03c5604b3b14ccae3cdcddcff597274d7ef6d59b746edf6460e1.exe
Size

58KB
MD5

03d20828b434f08c6f9b1914a3363ec6
SHA1

ac78b0141019a470985baa01a68689ad805ecda1
SHA256

058d435f47da03c5604b3b14ccae3cdcddcff597274d7ef6d59b746edf6460e1
SHA512

3c32f0a4b25a13b895b2e2699eb3dd1a0fb41f1cda4eb9c1fa47453344f4f8c147dca8fe028c7f3192bf5a518e062b7b84d9d0bdb2e473ba776166200556336f

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

2764 MediaCenter.exe

pid	process
2764	MediaCenter.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

058d435f47da03c5604b3b14ccae3cdcddcff597274d7ef6d59b746edf6460e1.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	058d435f47da03c5604b3b14ccae3cdcddcff597274d7ef6d59b746edf6460e1.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

058d435f47da03c5604b3b14ccae3cdcddcff597274d7ef6d59b746edf6460e1.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	058d435f47da03c5604b3b14ccae3cdcddcff597274d7ef6d59b746edf6460e1.exe

Drops file in Windows directory 8 IoCs

Processes:

TiWorker.exesvchost.exe

description	ioc	process
File opened for modification	C:\Windows\WinSxS\pending.xml	TiWorker.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TiWorker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

3940 PING.EXE

pid	process
3940	PING.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

svchost.exe058d435f47da03c5604b3b14ccae3cdcddcff597274d7ef6d59b746edf6460e1.exeTiWorker.exe

description	pid	process
Token: SeShutdownPrivilege	2988	svchost.exe
Token: SeCreatePagefilePrivilege	2988	svchost.exe
Token: SeShutdownPrivilege	2988	svchost.exe
Token: SeCreatePagefilePrivilege	2988	svchost.exe
Token: SeShutdownPrivilege	2988	svchost.exe
Token: SeCreatePagefilePrivilege	2988	svchost.exe
Token: SeIncBasePriorityPrivilege	1600	058d435f47da03c5604b3b14ccae3cdcddcff597274d7ef6d59b746edf6460e1.exe
Token: SeSecurityPrivilege	768	TiWorker.exe
Token: SeRestorePrivilege	768	TiWorker.exe
Token: SeBackupPrivilege	768	TiWorker.exe
Token: SeBackupPrivilege	768	TiWorker.exe
Token: SeRestorePrivilege	768	TiWorker.exe
Token: SeSecurityPrivilege	768	TiWorker.exe
Token: SeBackupPrivilege	768	TiWorker.exe
Token: SeRestorePrivilege	768	TiWorker.exe
Token: SeSecurityPrivilege	768	TiWorker.exe
Token: SeBackupPrivilege	768	TiWorker.exe
Token: SeRestorePrivilege	768	TiWorker.exe
Token: SeSecurityPrivilege	768	TiWorker.exe
Token: SeBackupPrivilege	768	TiWorker.exe
Token: SeRestorePrivilege	768	TiWorker.exe
Token: SeSecurityPrivilege	768	TiWorker.exe
Token: SeBackupPrivilege	768	TiWorker.exe
Token: SeRestorePrivilege	768	TiWorker.exe
Token: SeSecurityPrivilege	768	TiWorker.exe
Token: SeBackupPrivilege	768	TiWorker.exe
Token: SeRestorePrivilege	768	TiWorker.exe
Token: SeSecurityPrivilege	768	TiWorker.exe
Token: SeBackupPrivilege	768	TiWorker.exe
Token: SeRestorePrivilege	768	TiWorker.exe
Token: SeSecurityPrivilege	768	TiWorker.exe
Token: SeBackupPrivilege	768	TiWorker.exe
Token: SeRestorePrivilege	768	TiWorker.exe
Token: SeSecurityPrivilege	768	TiWorker.exe
Token: SeBackupPrivilege	768	TiWorker.exe
Token: SeRestorePrivilege	768	TiWorker.exe
Token: SeSecurityPrivilege	768	TiWorker.exe
Token: SeBackupPrivilege	768	TiWorker.exe
Token: SeRestorePrivilege	768	TiWorker.exe
Token: SeSecurityPrivilege	768	TiWorker.exe
Token: SeBackupPrivilege	768	TiWorker.exe
Token: SeRestorePrivilege	768	TiWorker.exe
Token: SeSecurityPrivilege	768	TiWorker.exe
Token: SeBackupPrivilege	768	TiWorker.exe
Token: SeRestorePrivilege	768	TiWorker.exe
Token: SeSecurityPrivilege	768	TiWorker.exe
Token: SeBackupPrivilege	768	TiWorker.exe
Token: SeRestorePrivilege	768	TiWorker.exe
Token: SeSecurityPrivilege	768	TiWorker.exe
Token: SeBackupPrivilege	768	TiWorker.exe
Token: SeRestorePrivilege	768	TiWorker.exe
Token: SeSecurityPrivilege	768	TiWorker.exe
Token: SeBackupPrivilege	768	TiWorker.exe
Token: SeRestorePrivilege	768	TiWorker.exe
Token: SeSecurityPrivilege	768	TiWorker.exe
Token: SeBackupPrivilege	768	TiWorker.exe
Token: SeRestorePrivilege	768	TiWorker.exe
Token: SeSecurityPrivilege	768	TiWorker.exe
Token: SeBackupPrivilege	768	TiWorker.exe
Token: SeRestorePrivilege	768	TiWorker.exe
Token: SeSecurityPrivilege	768	TiWorker.exe
Token: SeBackupPrivilege	768	TiWorker.exe
Token: SeRestorePrivilege	768	TiWorker.exe
Token: SeSecurityPrivilege	768	TiWorker.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

058d435f47da03c5604b3b14ccae3cdcddcff597274d7ef6d59b746edf6460e1.execmd.exe

description	pid	process	target process
PID 1600 wrote to memory of 2764	1600	058d435f47da03c5604b3b14ccae3cdcddcff597274d7ef6d59b746edf6460e1.exe	MediaCenter.exe
PID 1600 wrote to memory of 2764	1600	058d435f47da03c5604b3b14ccae3cdcddcff597274d7ef6d59b746edf6460e1.exe	MediaCenter.exe
PID 1600 wrote to memory of 2764	1600	058d435f47da03c5604b3b14ccae3cdcddcff597274d7ef6d59b746edf6460e1.exe	MediaCenter.exe
PID 1600 wrote to memory of 3160	1600	058d435f47da03c5604b3b14ccae3cdcddcff597274d7ef6d59b746edf6460e1.exe	cmd.exe
PID 1600 wrote to memory of 3160	1600	058d435f47da03c5604b3b14ccae3cdcddcff597274d7ef6d59b746edf6460e1.exe	cmd.exe
PID 1600 wrote to memory of 3160	1600	058d435f47da03c5604b3b14ccae3cdcddcff597274d7ef6d59b746edf6460e1.exe	cmd.exe
PID 3160 wrote to memory of 3940	3160	cmd.exe	PING.EXE
PID 3160 wrote to memory of 3940	3160	cmd.exe	PING.EXE
PID 3160 wrote to memory of 3940	3160	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\058d435f47da03c5604b3b14ccae3cdcddcff597274d7ef6d59b746edf6460e1.exe
"C:\Users\Admin\AppData\Local\Temp\058d435f47da03c5604b3b14ccae3cdcddcff597274d7ef6d59b746edf6460e1.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1600

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:2764

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\058d435f47da03c5604b3b14ccae3cdcddcff597274d7ef6d59b746edf6460e1.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:3160

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:3940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2988

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:768

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
b9c6df79eb92998e358a6fc436938b6a

SHA1
25fe6fa77487d641a61caacd4c05917c5cc26763

SHA256
62de05efe6ee47b27fbc4bd4d0763a751c08e6294a8cd725b04f40f794acae53

SHA512
ee0538b3fff1a47e7d3cc87106781f7cc068afbd52c9f6af14b3e1f53dbb0f5940548b8f28178fda15c5f74727ecb43fe0927303455af095cb12295b9abf154a

Download Submit
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
b9c6df79eb92998e358a6fc436938b6a

SHA1
25fe6fa77487d641a61caacd4c05917c5cc26763

SHA256
62de05efe6ee47b27fbc4bd4d0763a751c08e6294a8cd725b04f40f794acae53

SHA512
ee0538b3fff1a47e7d3cc87106781f7cc068afbd52c9f6af14b3e1f53dbb0f5940548b8f28178fda15c5f74727ecb43fe0927303455af095cb12295b9abf154a

Download Submit
memory/2988-132-0x0000011219E70000-0x0000011219E80000-memory.dmp

Filesize
64KB

Download
memory/2988-133-0x0000011219ED0000-0x0000011219EE0000-memory.dmp

Filesize
64KB

Download
memory/2988-134-0x000001121C580000-0x000001121C584000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads