sakula | 071160af873051b4d621c532cd36a5070204f23fc53924e952a59fc026088a61

General

Target

071160af873051b4d621c532cd36a5070204f23fc53924e952a59fc026088a61.exe
Size

36KB
MD5

cf03548b412e73addf5203c58f503158
SHA1

eab7e8c669a1881282afc3f735ba441b2392ba0e
SHA256

071160af873051b4d621c532cd36a5070204f23fc53924e952a59fc026088a61
SHA512

adeb880c4e11005578e4ca4e434be2224be2616b76c0eabd55a709416bfeb4fc9cec8e04c3c3caefd12875836229a8e37b96f24a8bd4150bffd3cd28a3e3b86a

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1796 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1164 cmd.exe

pid	process
1796	MediaCenter.exe

pid	process
1164	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

071160af873051b4d621c532cd36a5070204f23fc53924e952a59fc026088a61.exe

pid	process
1184	071160af873051b4d621c532cd36a5070204f23fc53924e952a59fc026088a61.exe
1184	071160af873051b4d621c532cd36a5070204f23fc53924e952a59fc026088a61.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

071160af873051b4d621c532cd36a5070204f23fc53924e952a59fc026088a61.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	071160af873051b4d621c532cd36a5070204f23fc53924e952a59fc026088a61.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1232 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

071160af873051b4d621c532cd36a5070204f23fc53924e952a59fc026088a61.exe

description pid process

Token: SeIncBasePriorityPrivilege 1184 071160af873051b4d621c532cd36a5070204f23fc53924e952a59fc026088a61.exe

pid	process
1232	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1184	071160af873051b4d621c532cd36a5070204f23fc53924e952a59fc026088a61.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

071160af873051b4d621c532cd36a5070204f23fc53924e952a59fc026088a61.execmd.exe

description	pid	process	target process
PID 1184 wrote to memory of 1796	1184	071160af873051b4d621c532cd36a5070204f23fc53924e952a59fc026088a61.exe	MediaCenter.exe
PID 1184 wrote to memory of 1796	1184	071160af873051b4d621c532cd36a5070204f23fc53924e952a59fc026088a61.exe	MediaCenter.exe
PID 1184 wrote to memory of 1796	1184	071160af873051b4d621c532cd36a5070204f23fc53924e952a59fc026088a61.exe	MediaCenter.exe
PID 1184 wrote to memory of 1796	1184	071160af873051b4d621c532cd36a5070204f23fc53924e952a59fc026088a61.exe	MediaCenter.exe
PID 1184 wrote to memory of 1164	1184	071160af873051b4d621c532cd36a5070204f23fc53924e952a59fc026088a61.exe	cmd.exe
PID 1184 wrote to memory of 1164	1184	071160af873051b4d621c532cd36a5070204f23fc53924e952a59fc026088a61.exe	cmd.exe
PID 1184 wrote to memory of 1164	1184	071160af873051b4d621c532cd36a5070204f23fc53924e952a59fc026088a61.exe	cmd.exe
PID 1184 wrote to memory of 1164	1184	071160af873051b4d621c532cd36a5070204f23fc53924e952a59fc026088a61.exe	cmd.exe
PID 1164 wrote to memory of 1232	1164	cmd.exe	PING.EXE
PID 1164 wrote to memory of 1232	1164	cmd.exe	PING.EXE
PID 1164 wrote to memory of 1232	1164	cmd.exe	PING.EXE
PID 1164 wrote to memory of 1232	1164	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\071160af873051b4d621c532cd36a5070204f23fc53924e952a59fc026088a61.exe
"C:\Users\Admin\AppData\Local\Temp\071160af873051b4d621c532cd36a5070204f23fc53924e952a59fc026088a61.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1184

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1796

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\071160af873051b4d621c532cd36a5070204f23fc53924e952a59fc026088a61.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1164

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1232

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
0d726dd38dde6b51f8b734ab7ea11254

SHA1
68221558dafe1960bc760a1b735747acc826af7f

SHA256
0b8d9810fa0158acfa19991647db46502bc6d68020c4e2ede5c28736d4fb028f

SHA512
31bf0f7d59b3b5dcd6bdb40ec25990c6a64412bb75f4004766078950675350ee91ab479ea56d150de5dc60ed76878b176468db5fa204268fd889d25268e94d46

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
0d726dd38dde6b51f8b734ab7ea11254

SHA1
68221558dafe1960bc760a1b735747acc826af7f

SHA256
0b8d9810fa0158acfa19991647db46502bc6d68020c4e2ede5c28736d4fb028f

SHA512
31bf0f7d59b3b5dcd6bdb40ec25990c6a64412bb75f4004766078950675350ee91ab479ea56d150de5dc60ed76878b176468db5fa204268fd889d25268e94d46

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
0d726dd38dde6b51f8b734ab7ea11254

SHA1
68221558dafe1960bc760a1b735747acc826af7f

SHA256
0b8d9810fa0158acfa19991647db46502bc6d68020c4e2ede5c28736d4fb028f

SHA512
31bf0f7d59b3b5dcd6bdb40ec25990c6a64412bb75f4004766078950675350ee91ab479ea56d150de5dc60ed76878b176468db5fa204268fd889d25268e94d46

Download Submit
memory/1184-55-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads