sakula | 07ab635c4c27a916bffbe797fec67f5d5a406ec5cc3ba7692df8150436522baf

General

Target

07ab635c4c27a916bffbe797fec67f5d5a406ec5cc3ba7692df8150436522baf.exe
Size

216KB
MD5

b01ff1f0dd829dbdf4fe781a858f8b29
SHA1

97b38e9b4e0ac34635c6af27ee037ae9519b1cf2
SHA256

07ab635c4c27a916bffbe797fec67f5d5a406ec5cc3ba7692df8150436522baf
SHA512

f1756a3424699f8dc800a2696b01e0a571f0dfbc63f00c75ca7cd3f91647604f652e48e68f15bd5f8adf83d044b0c397f4f76f6fb530e7c27df1ce648d49247d

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula Payload 4 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
behavioral1/memory/1536-58-0x0000000000400000-0x0000000000420000-memory.dmp	family_sakula
behavioral1/memory/964-59-0x0000000000400000-0x0000000000420000-memory.dmp	family_sakula

Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

964 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

728 cmd.exe
Loads dropped DLL 1 IoCs

Processes:

07ab635c4c27a916bffbe797fec67f5d5a406ec5cc3ba7692df8150436522baf.exe

pid process

1536 07ab635c4c27a916bffbe797fec67f5d5a406ec5cc3ba7692df8150436522baf.exe

pid	process
964	MediaCenter.exe

pid	process
728	cmd.exe

pid	process
1536	07ab635c4c27a916bffbe797fec67f5d5a406ec5cc3ba7692df8150436522baf.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

07ab635c4c27a916bffbe797fec67f5d5a406ec5cc3ba7692df8150436522baf.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	07ab635c4c27a916bffbe797fec67f5d5a406ec5cc3ba7692df8150436522baf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1040 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

07ab635c4c27a916bffbe797fec67f5d5a406ec5cc3ba7692df8150436522baf.exe

description pid process

Token: SeIncBasePriorityPrivilege 1536 07ab635c4c27a916bffbe797fec67f5d5a406ec5cc3ba7692df8150436522baf.exe

pid	process
1040	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1536	07ab635c4c27a916bffbe797fec67f5d5a406ec5cc3ba7692df8150436522baf.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

07ab635c4c27a916bffbe797fec67f5d5a406ec5cc3ba7692df8150436522baf.execmd.exe

description	pid	process	target process
PID 1536 wrote to memory of 964	1536	07ab635c4c27a916bffbe797fec67f5d5a406ec5cc3ba7692df8150436522baf.exe	MediaCenter.exe
PID 1536 wrote to memory of 964	1536	07ab635c4c27a916bffbe797fec67f5d5a406ec5cc3ba7692df8150436522baf.exe	MediaCenter.exe
PID 1536 wrote to memory of 964	1536	07ab635c4c27a916bffbe797fec67f5d5a406ec5cc3ba7692df8150436522baf.exe	MediaCenter.exe
PID 1536 wrote to memory of 964	1536	07ab635c4c27a916bffbe797fec67f5d5a406ec5cc3ba7692df8150436522baf.exe	MediaCenter.exe
PID 1536 wrote to memory of 728	1536	07ab635c4c27a916bffbe797fec67f5d5a406ec5cc3ba7692df8150436522baf.exe	cmd.exe
PID 1536 wrote to memory of 728	1536	07ab635c4c27a916bffbe797fec67f5d5a406ec5cc3ba7692df8150436522baf.exe	cmd.exe
PID 1536 wrote to memory of 728	1536	07ab635c4c27a916bffbe797fec67f5d5a406ec5cc3ba7692df8150436522baf.exe	cmd.exe
PID 1536 wrote to memory of 728	1536	07ab635c4c27a916bffbe797fec67f5d5a406ec5cc3ba7692df8150436522baf.exe	cmd.exe
PID 728 wrote to memory of 1040	728	cmd.exe	PING.EXE
PID 728 wrote to memory of 1040	728	cmd.exe	PING.EXE
PID 728 wrote to memory of 1040	728	cmd.exe	PING.EXE
PID 728 wrote to memory of 1040	728	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\07ab635c4c27a916bffbe797fec67f5d5a406ec5cc3ba7692df8150436522baf.exe
"C:\Users\Admin\AppData\Local\Temp\07ab635c4c27a916bffbe797fec67f5d5a406ec5cc3ba7692df8150436522baf.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1536

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:964

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\07ab635c4c27a916bffbe797fec67f5d5a406ec5cc3ba7692df8150436522baf.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:728

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1040

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
a520fc0d866cebaade31e521a61f8f6a

SHA1
0777451ee22589c78380bcc5b9fff8859fcb2576

SHA256
f762a4041941c31a9191d39d282fd7592ab1e9bdae6e7ec3568acc0b1398f6c3

SHA512
bb77568251d705f3c2c90dcf4960ec85feec2d122b4997df133edd6ead8bc2eb212fd09e2739624993fea9e9a0d1089c59c9295a7aae9e01bea2be6d9487b625

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
a520fc0d866cebaade31e521a61f8f6a

SHA1
0777451ee22589c78380bcc5b9fff8859fcb2576

SHA256
f762a4041941c31a9191d39d282fd7592ab1e9bdae6e7ec3568acc0b1398f6c3

SHA512
bb77568251d705f3c2c90dcf4960ec85feec2d122b4997df133edd6ead8bc2eb212fd09e2739624993fea9e9a0d1089c59c9295a7aae9e01bea2be6d9487b625

Download Submit
memory/964-59-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1536-54-0x0000000076C91000-0x0000000076C93000-memory.dmp

Filesize
8KB

Download
memory/1536-58-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads