sakula | 057db5b5cb34822167fd80b7a9310b2355195aa2abbd20b236b550f0f1e16830

General

Target

057db5b5cb34822167fd80b7a9310b2355195aa2abbd20b236b550f0f1e16830.exe
Size

60KB
MD5

85d9c7207ef1464b6ebaad26678ee697
SHA1

60d5f3d2bb01069ee55b47e495d62676acd63ce5
SHA256

057db5b5cb34822167fd80b7a9310b2355195aa2abbd20b236b550f0f1e16830
SHA512

c4e1a653b13a737462d07f5b88c7b2e0022dc9169ac3c0a92d681e1b5ea2395b6c4751f690344eaf32a959ecaef65a4df841b8dfcd9b89809c988d2084763a4e

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1848 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

396 cmd.exe

pid	process
1848	MediaCenter.exe

pid	process
396	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

057db5b5cb34822167fd80b7a9310b2355195aa2abbd20b236b550f0f1e16830.exe

pid	process
832	057db5b5cb34822167fd80b7a9310b2355195aa2abbd20b236b550f0f1e16830.exe
832	057db5b5cb34822167fd80b7a9310b2355195aa2abbd20b236b550f0f1e16830.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

057db5b5cb34822167fd80b7a9310b2355195aa2abbd20b236b550f0f1e16830.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	057db5b5cb34822167fd80b7a9310b2355195aa2abbd20b236b550f0f1e16830.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1972 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

057db5b5cb34822167fd80b7a9310b2355195aa2abbd20b236b550f0f1e16830.exe

description pid process

Token: SeIncBasePriorityPrivilege 832 057db5b5cb34822167fd80b7a9310b2355195aa2abbd20b236b550f0f1e16830.exe

pid	process
1972	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	832	057db5b5cb34822167fd80b7a9310b2355195aa2abbd20b236b550f0f1e16830.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

057db5b5cb34822167fd80b7a9310b2355195aa2abbd20b236b550f0f1e16830.execmd.exe

description	pid	process	target process
PID 832 wrote to memory of 1848	832	057db5b5cb34822167fd80b7a9310b2355195aa2abbd20b236b550f0f1e16830.exe	MediaCenter.exe
PID 832 wrote to memory of 1848	832	057db5b5cb34822167fd80b7a9310b2355195aa2abbd20b236b550f0f1e16830.exe	MediaCenter.exe
PID 832 wrote to memory of 1848	832	057db5b5cb34822167fd80b7a9310b2355195aa2abbd20b236b550f0f1e16830.exe	MediaCenter.exe
PID 832 wrote to memory of 1848	832	057db5b5cb34822167fd80b7a9310b2355195aa2abbd20b236b550f0f1e16830.exe	MediaCenter.exe
PID 832 wrote to memory of 396	832	057db5b5cb34822167fd80b7a9310b2355195aa2abbd20b236b550f0f1e16830.exe	cmd.exe
PID 832 wrote to memory of 396	832	057db5b5cb34822167fd80b7a9310b2355195aa2abbd20b236b550f0f1e16830.exe	cmd.exe
PID 832 wrote to memory of 396	832	057db5b5cb34822167fd80b7a9310b2355195aa2abbd20b236b550f0f1e16830.exe	cmd.exe
PID 832 wrote to memory of 396	832	057db5b5cb34822167fd80b7a9310b2355195aa2abbd20b236b550f0f1e16830.exe	cmd.exe
PID 396 wrote to memory of 1972	396	cmd.exe	PING.EXE
PID 396 wrote to memory of 1972	396	cmd.exe	PING.EXE
PID 396 wrote to memory of 1972	396	cmd.exe	PING.EXE
PID 396 wrote to memory of 1972	396	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\057db5b5cb34822167fd80b7a9310b2355195aa2abbd20b236b550f0f1e16830.exe
"C:\Users\Admin\AppData\Local\Temp\057db5b5cb34822167fd80b7a9310b2355195aa2abbd20b236b550f0f1e16830.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:832

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1848

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\057db5b5cb34822167fd80b7a9310b2355195aa2abbd20b236b550f0f1e16830.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:396

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1972

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
2dd7c59e9230eb76cf000419f9cfebf4

SHA1
cf75f50941c0055c1a05ee65788f2309e496fe2a

SHA256
160881357344d34b2521ac54de1d42523e630ccd347546e901624d3b980e1c71

SHA512
b460beb53ed189ede29c610b7bfcfcb286caa7cfb5331189ab45d26e6f25088113fb75c42b5396ce4b9ed08b4cfdfc7dbb33706f8a49a25a74fc621672611e03

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
2dd7c59e9230eb76cf000419f9cfebf4

SHA1
cf75f50941c0055c1a05ee65788f2309e496fe2a

SHA256
160881357344d34b2521ac54de1d42523e630ccd347546e901624d3b980e1c71

SHA512
b460beb53ed189ede29c610b7bfcfcb286caa7cfb5331189ab45d26e6f25088113fb75c42b5396ce4b9ed08b4cfdfc7dbb33706f8a49a25a74fc621672611e03

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
2dd7c59e9230eb76cf000419f9cfebf4

SHA1
cf75f50941c0055c1a05ee65788f2309e496fe2a

SHA256
160881357344d34b2521ac54de1d42523e630ccd347546e901624d3b980e1c71

SHA512
b460beb53ed189ede29c610b7bfcfcb286caa7cfb5331189ab45d26e6f25088113fb75c42b5396ce4b9ed08b4cfdfc7dbb33706f8a49a25a74fc621672611e03

Download Submit
memory/832-54-0x0000000075891000-0x0000000075893000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads