sakula | 0744e0466af8190daff9c821f553dfff0475938e1edffc0912f8d00b46723c51

General

Target

0744e0466af8190daff9c821f553dfff0475938e1edffc0912f8d00b46723c51.exe
Size

60KB
MD5

210584165b77480200b5aa83c53e6e6d
SHA1

38341058be6c5480a7cb68f5dca9c71dd9da0977
SHA256

0744e0466af8190daff9c821f553dfff0475938e1edffc0912f8d00b46723c51
SHA512

cd2ed9ded39a8e61d06cc49e57f6caf103841428ea8462ad0f3416bad3d2f2dd31c38f0322b258ed6fb3b409fafccfddbc5d08a1b6334431bac7b44fe1e40a11

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

808 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1856 cmd.exe

pid	process
808	MediaCenter.exe

pid	process
1856	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

0744e0466af8190daff9c821f553dfff0475938e1edffc0912f8d00b46723c51.exe

pid	process
1580	0744e0466af8190daff9c821f553dfff0475938e1edffc0912f8d00b46723c51.exe
1580	0744e0466af8190daff9c821f553dfff0475938e1edffc0912f8d00b46723c51.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

0744e0466af8190daff9c821f553dfff0475938e1edffc0912f8d00b46723c51.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	0744e0466af8190daff9c821f553dfff0475938e1edffc0912f8d00b46723c51.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1068 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0744e0466af8190daff9c821f553dfff0475938e1edffc0912f8d00b46723c51.exe

description pid process

Token: SeIncBasePriorityPrivilege 1580 0744e0466af8190daff9c821f553dfff0475938e1edffc0912f8d00b46723c51.exe

pid	process
1068	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1580	0744e0466af8190daff9c821f553dfff0475938e1edffc0912f8d00b46723c51.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

0744e0466af8190daff9c821f553dfff0475938e1edffc0912f8d00b46723c51.execmd.exe

description	pid	process	target process
PID 1580 wrote to memory of 808	1580	0744e0466af8190daff9c821f553dfff0475938e1edffc0912f8d00b46723c51.exe	MediaCenter.exe
PID 1580 wrote to memory of 808	1580	0744e0466af8190daff9c821f553dfff0475938e1edffc0912f8d00b46723c51.exe	MediaCenter.exe
PID 1580 wrote to memory of 808	1580	0744e0466af8190daff9c821f553dfff0475938e1edffc0912f8d00b46723c51.exe	MediaCenter.exe
PID 1580 wrote to memory of 808	1580	0744e0466af8190daff9c821f553dfff0475938e1edffc0912f8d00b46723c51.exe	MediaCenter.exe
PID 1580 wrote to memory of 1856	1580	0744e0466af8190daff9c821f553dfff0475938e1edffc0912f8d00b46723c51.exe	cmd.exe
PID 1580 wrote to memory of 1856	1580	0744e0466af8190daff9c821f553dfff0475938e1edffc0912f8d00b46723c51.exe	cmd.exe
PID 1580 wrote to memory of 1856	1580	0744e0466af8190daff9c821f553dfff0475938e1edffc0912f8d00b46723c51.exe	cmd.exe
PID 1580 wrote to memory of 1856	1580	0744e0466af8190daff9c821f553dfff0475938e1edffc0912f8d00b46723c51.exe	cmd.exe
PID 1856 wrote to memory of 1068	1856	cmd.exe	PING.EXE
PID 1856 wrote to memory of 1068	1856	cmd.exe	PING.EXE
PID 1856 wrote to memory of 1068	1856	cmd.exe	PING.EXE
PID 1856 wrote to memory of 1068	1856	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\0744e0466af8190daff9c821f553dfff0475938e1edffc0912f8d00b46723c51.exe
"C:\Users\Admin\AppData\Local\Temp\0744e0466af8190daff9c821f553dfff0475938e1edffc0912f8d00b46723c51.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1580

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:808

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\0744e0466af8190daff9c821f553dfff0475938e1edffc0912f8d00b46723c51.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1856

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1068

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
b45f47652c8f5effdb6e774e17a7a43e

SHA1
ecc2e8a94092deb1262c2488da22ee1d633bc977

SHA256
23699561c0eb959ef4843a2ea02d582529314358f6c2b008fec5bbe3281c7b8a

SHA512
e57b8ab2fb591a682b9ef7f0183495f28d3fc6fde9386de5a7bdd405b1eb7e9ee58e84bd40dad07a09218d8fec20dab207b35bf695f42d02615abe9364594551

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
b45f47652c8f5effdb6e774e17a7a43e

SHA1
ecc2e8a94092deb1262c2488da22ee1d633bc977

SHA256
23699561c0eb959ef4843a2ea02d582529314358f6c2b008fec5bbe3281c7b8a

SHA512
e57b8ab2fb591a682b9ef7f0183495f28d3fc6fde9386de5a7bdd405b1eb7e9ee58e84bd40dad07a09218d8fec20dab207b35bf695f42d02615abe9364594551

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
b45f47652c8f5effdb6e774e17a7a43e

SHA1
ecc2e8a94092deb1262c2488da22ee1d633bc977

SHA256
23699561c0eb959ef4843a2ea02d582529314358f6c2b008fec5bbe3281c7b8a

SHA512
e57b8ab2fb591a682b9ef7f0183495f28d3fc6fde9386de5a7bdd405b1eb7e9ee58e84bd40dad07a09218d8fec20dab207b35bf695f42d02615abe9364594551

Download Submit
memory/1580-54-0x00000000754B1000-0x00000000754B3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads