sakula | 0543a496b43f6b4a1662b8509a91bb35449e4129435b517517fd28252e0a3541

General

Target

0543a496b43f6b4a1662b8509a91bb35449e4129435b517517fd28252e0a3541.exe
Size

58KB
MD5

3317d8098f66f34da3063b64e75f281f
SHA1

5c7b0d7a75d9b6ce4f2c416eeb69bcfb06e95794
SHA256

0543a496b43f6b4a1662b8509a91bb35449e4129435b517517fd28252e0a3541
SHA512

1c7ddab2913b87a8a300596d71de56ae052d8be49f611b646394e620243278aaef34bbb813c442ff32d5e61ace786b30cf4ee46f8725765dac8693ed94ecbb30

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1592 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1848 cmd.exe

pid	process
1592	MediaCenter.exe

pid	process
1848	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

0543a496b43f6b4a1662b8509a91bb35449e4129435b517517fd28252e0a3541.exe

pid	process
792	0543a496b43f6b4a1662b8509a91bb35449e4129435b517517fd28252e0a3541.exe
792	0543a496b43f6b4a1662b8509a91bb35449e4129435b517517fd28252e0a3541.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

0543a496b43f6b4a1662b8509a91bb35449e4129435b517517fd28252e0a3541.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	0543a496b43f6b4a1662b8509a91bb35449e4129435b517517fd28252e0a3541.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1648 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0543a496b43f6b4a1662b8509a91bb35449e4129435b517517fd28252e0a3541.exe

description pid process

Token: SeIncBasePriorityPrivilege 792 0543a496b43f6b4a1662b8509a91bb35449e4129435b517517fd28252e0a3541.exe

pid	process
1648	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	792	0543a496b43f6b4a1662b8509a91bb35449e4129435b517517fd28252e0a3541.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

0543a496b43f6b4a1662b8509a91bb35449e4129435b517517fd28252e0a3541.execmd.exe

description	pid	process	target process
PID 792 wrote to memory of 1592	792	0543a496b43f6b4a1662b8509a91bb35449e4129435b517517fd28252e0a3541.exe	MediaCenter.exe
PID 792 wrote to memory of 1592	792	0543a496b43f6b4a1662b8509a91bb35449e4129435b517517fd28252e0a3541.exe	MediaCenter.exe
PID 792 wrote to memory of 1592	792	0543a496b43f6b4a1662b8509a91bb35449e4129435b517517fd28252e0a3541.exe	MediaCenter.exe
PID 792 wrote to memory of 1592	792	0543a496b43f6b4a1662b8509a91bb35449e4129435b517517fd28252e0a3541.exe	MediaCenter.exe
PID 792 wrote to memory of 1848	792	0543a496b43f6b4a1662b8509a91bb35449e4129435b517517fd28252e0a3541.exe	cmd.exe
PID 792 wrote to memory of 1848	792	0543a496b43f6b4a1662b8509a91bb35449e4129435b517517fd28252e0a3541.exe	cmd.exe
PID 792 wrote to memory of 1848	792	0543a496b43f6b4a1662b8509a91bb35449e4129435b517517fd28252e0a3541.exe	cmd.exe
PID 792 wrote to memory of 1848	792	0543a496b43f6b4a1662b8509a91bb35449e4129435b517517fd28252e0a3541.exe	cmd.exe
PID 1848 wrote to memory of 1648	1848	cmd.exe	PING.EXE
PID 1848 wrote to memory of 1648	1848	cmd.exe	PING.EXE
PID 1848 wrote to memory of 1648	1848	cmd.exe	PING.EXE
PID 1848 wrote to memory of 1648	1848	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\0543a496b43f6b4a1662b8509a91bb35449e4129435b517517fd28252e0a3541.exe
"C:\Users\Admin\AppData\Local\Temp\0543a496b43f6b4a1662b8509a91bb35449e4129435b517517fd28252e0a3541.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:792

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1592

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\0543a496b43f6b4a1662b8509a91bb35449e4129435b517517fd28252e0a3541.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1848

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1648

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
fee12905afe28f4865964314f9c2b4d2

SHA1
7af32e408a5d1db118acc1b014db4b385976d582

SHA256
73690caff3710f2683e056818db38a08b7d1bdc5507576cdf5391d6899d1b0c9

SHA512
7c5de6d9b018d62e859f4dfc10f588efa01d65f7a91055ae1014176c9bbcea85a4688cc90ba5606719a9767bc24977a334390ddd7b85cf7e90bcc856f2a065bb

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
fee12905afe28f4865964314f9c2b4d2

SHA1
7af32e408a5d1db118acc1b014db4b385976d582

SHA256
73690caff3710f2683e056818db38a08b7d1bdc5507576cdf5391d6899d1b0c9

SHA512
7c5de6d9b018d62e859f4dfc10f588efa01d65f7a91055ae1014176c9bbcea85a4688cc90ba5606719a9767bc24977a334390ddd7b85cf7e90bcc856f2a065bb

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
fee12905afe28f4865964314f9c2b4d2

SHA1
7af32e408a5d1db118acc1b014db4b385976d582

SHA256
73690caff3710f2683e056818db38a08b7d1bdc5507576cdf5391d6899d1b0c9

SHA512
7c5de6d9b018d62e859f4dfc10f588efa01d65f7a91055ae1014176c9bbcea85a4688cc90ba5606719a9767bc24977a334390ddd7b85cf7e90bcc856f2a065bb

Download Submit
memory/792-55-0x0000000075321000-0x0000000075323000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads