sakula | 059cd1953d411c37e2b23830ffcd8e244afffa6e09ad146b64205ede12e1c770

General

Target

059cd1953d411c37e2b23830ffcd8e244afffa6e09ad146b64205ede12e1c770.exe
Size

60KB
MD5

ed2e8c214c18a7e29a6a7178e21a2711
SHA1

45be1d3af64a15cebad31dd8670a288ad8625f8c
SHA256

059cd1953d411c37e2b23830ffcd8e244afffa6e09ad146b64205ede12e1c770
SHA512

ab75b40ec6db364be19d10c3726aef6f75cfb8fc2710a1fce10ba07b2fc070591f61edaf4292f9cc7ac0e4086f3b95ad60f543d1f51459ad9146997c5dda2c3e

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1668 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

844 cmd.exe

pid	process
1668	MediaCenter.exe

pid	process
844	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

059cd1953d411c37e2b23830ffcd8e244afffa6e09ad146b64205ede12e1c770.exe

pid	process
740	059cd1953d411c37e2b23830ffcd8e244afffa6e09ad146b64205ede12e1c770.exe
740	059cd1953d411c37e2b23830ffcd8e244afffa6e09ad146b64205ede12e1c770.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

059cd1953d411c37e2b23830ffcd8e244afffa6e09ad146b64205ede12e1c770.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	059cd1953d411c37e2b23830ffcd8e244afffa6e09ad146b64205ede12e1c770.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

992 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

059cd1953d411c37e2b23830ffcd8e244afffa6e09ad146b64205ede12e1c770.exe

description pid process

Token: SeIncBasePriorityPrivilege 740 059cd1953d411c37e2b23830ffcd8e244afffa6e09ad146b64205ede12e1c770.exe

pid	process
992	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	740	059cd1953d411c37e2b23830ffcd8e244afffa6e09ad146b64205ede12e1c770.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

059cd1953d411c37e2b23830ffcd8e244afffa6e09ad146b64205ede12e1c770.execmd.exe

description	pid	process	target process
PID 740 wrote to memory of 1668	740	059cd1953d411c37e2b23830ffcd8e244afffa6e09ad146b64205ede12e1c770.exe	MediaCenter.exe
PID 740 wrote to memory of 1668	740	059cd1953d411c37e2b23830ffcd8e244afffa6e09ad146b64205ede12e1c770.exe	MediaCenter.exe
PID 740 wrote to memory of 1668	740	059cd1953d411c37e2b23830ffcd8e244afffa6e09ad146b64205ede12e1c770.exe	MediaCenter.exe
PID 740 wrote to memory of 1668	740	059cd1953d411c37e2b23830ffcd8e244afffa6e09ad146b64205ede12e1c770.exe	MediaCenter.exe
PID 740 wrote to memory of 844	740	059cd1953d411c37e2b23830ffcd8e244afffa6e09ad146b64205ede12e1c770.exe	cmd.exe
PID 740 wrote to memory of 844	740	059cd1953d411c37e2b23830ffcd8e244afffa6e09ad146b64205ede12e1c770.exe	cmd.exe
PID 740 wrote to memory of 844	740	059cd1953d411c37e2b23830ffcd8e244afffa6e09ad146b64205ede12e1c770.exe	cmd.exe
PID 740 wrote to memory of 844	740	059cd1953d411c37e2b23830ffcd8e244afffa6e09ad146b64205ede12e1c770.exe	cmd.exe
PID 844 wrote to memory of 992	844	cmd.exe	PING.EXE
PID 844 wrote to memory of 992	844	cmd.exe	PING.EXE
PID 844 wrote to memory of 992	844	cmd.exe	PING.EXE
PID 844 wrote to memory of 992	844	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\059cd1953d411c37e2b23830ffcd8e244afffa6e09ad146b64205ede12e1c770.exe
"C:\Users\Admin\AppData\Local\Temp\059cd1953d411c37e2b23830ffcd8e244afffa6e09ad146b64205ede12e1c770.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:740

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1668

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\059cd1953d411c37e2b23830ffcd8e244afffa6e09ad146b64205ede12e1c770.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:844

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:992

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
7eaf4b42fd6a7c0765e7a947af79aa6a

SHA1
615a6aa2461049e92784d3384d8b7a0483a52e31

SHA256
9d67f332b9ced41603230d3983ca666b9a36c5ad576338bc46deb101bbc9c761

SHA512
7f860871584ce250c4413a47dba3ff55f01427281cd504fbb5025f1baea1d9875d9b8c1902b3c9bda3b89f0b44c0bae0666bc9d003f7030458e94a4fb7d01724

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
7eaf4b42fd6a7c0765e7a947af79aa6a

SHA1
615a6aa2461049e92784d3384d8b7a0483a52e31

SHA256
9d67f332b9ced41603230d3983ca666b9a36c5ad576338bc46deb101bbc9c761

SHA512
7f860871584ce250c4413a47dba3ff55f01427281cd504fbb5025f1baea1d9875d9b8c1902b3c9bda3b89f0b44c0bae0666bc9d003f7030458e94a4fb7d01724

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
7eaf4b42fd6a7c0765e7a947af79aa6a

SHA1
615a6aa2461049e92784d3384d8b7a0483a52e31

SHA256
9d67f332b9ced41603230d3983ca666b9a36c5ad576338bc46deb101bbc9c761

SHA512
7f860871584ce250c4413a47dba3ff55f01427281cd504fbb5025f1baea1d9875d9b8c1902b3c9bda3b89f0b44c0bae0666bc9d003f7030458e94a4fb7d01724

Download Submit
memory/740-55-0x0000000075321000-0x0000000075323000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads