sakula | 06bf26202244b7a5780d62017d33b3c501c7589f0d2ef5df48dfd6048e0c1873

General

Target

06bf26202244b7a5780d62017d33b3c501c7589f0d2ef5df48dfd6048e0c1873.exe
Size

99KB
MD5

6f74e48362675aca55ebf634893b2dee
SHA1

54c8aa3c62197d404f5ea9243443fa237933cbdb
SHA256

06bf26202244b7a5780d62017d33b3c501c7589f0d2ef5df48dfd6048e0c1873
SHA512

9520cab5233524e18fa5e0c310d7fa4613006caaad943a3d9921272c978c79a7241be8a73542fab3ec1b74439ce98ce2e39f2981545be9fd828589b908732ac6

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula Payload 3 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula

Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1904 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1084 cmd.exe

pid	process
1904	MediaCenter.exe

pid	process
1084	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

06bf26202244b7a5780d62017d33b3c501c7589f0d2ef5df48dfd6048e0c1873.exe

pid	process
1144	06bf26202244b7a5780d62017d33b3c501c7589f0d2ef5df48dfd6048e0c1873.exe
1144	06bf26202244b7a5780d62017d33b3c501c7589f0d2ef5df48dfd6048e0c1873.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

06bf26202244b7a5780d62017d33b3c501c7589f0d2ef5df48dfd6048e0c1873.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	06bf26202244b7a5780d62017d33b3c501c7589f0d2ef5df48dfd6048e0c1873.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

960 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

06bf26202244b7a5780d62017d33b3c501c7589f0d2ef5df48dfd6048e0c1873.exe

description pid process

Token: SeIncBasePriorityPrivilege 1144 06bf26202244b7a5780d62017d33b3c501c7589f0d2ef5df48dfd6048e0c1873.exe

pid	process
960	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1144	06bf26202244b7a5780d62017d33b3c501c7589f0d2ef5df48dfd6048e0c1873.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

06bf26202244b7a5780d62017d33b3c501c7589f0d2ef5df48dfd6048e0c1873.execmd.exe

description	pid	process	target process
PID 1144 wrote to memory of 1904	1144	06bf26202244b7a5780d62017d33b3c501c7589f0d2ef5df48dfd6048e0c1873.exe	MediaCenter.exe
PID 1144 wrote to memory of 1904	1144	06bf26202244b7a5780d62017d33b3c501c7589f0d2ef5df48dfd6048e0c1873.exe	MediaCenter.exe
PID 1144 wrote to memory of 1904	1144	06bf26202244b7a5780d62017d33b3c501c7589f0d2ef5df48dfd6048e0c1873.exe	MediaCenter.exe
PID 1144 wrote to memory of 1904	1144	06bf26202244b7a5780d62017d33b3c501c7589f0d2ef5df48dfd6048e0c1873.exe	MediaCenter.exe
PID 1144 wrote to memory of 1084	1144	06bf26202244b7a5780d62017d33b3c501c7589f0d2ef5df48dfd6048e0c1873.exe	cmd.exe
PID 1144 wrote to memory of 1084	1144	06bf26202244b7a5780d62017d33b3c501c7589f0d2ef5df48dfd6048e0c1873.exe	cmd.exe
PID 1144 wrote to memory of 1084	1144	06bf26202244b7a5780d62017d33b3c501c7589f0d2ef5df48dfd6048e0c1873.exe	cmd.exe
PID 1144 wrote to memory of 1084	1144	06bf26202244b7a5780d62017d33b3c501c7589f0d2ef5df48dfd6048e0c1873.exe	cmd.exe
PID 1084 wrote to memory of 960	1084	cmd.exe	PING.EXE
PID 1084 wrote to memory of 960	1084	cmd.exe	PING.EXE
PID 1084 wrote to memory of 960	1084	cmd.exe	PING.EXE
PID 1084 wrote to memory of 960	1084	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\06bf26202244b7a5780d62017d33b3c501c7589f0d2ef5df48dfd6048e0c1873.exe
"C:\Users\Admin\AppData\Local\Temp\06bf26202244b7a5780d62017d33b3c501c7589f0d2ef5df48dfd6048e0c1873.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1144

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1904

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\06bf26202244b7a5780d62017d33b3c501c7589f0d2ef5df48dfd6048e0c1873.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1084

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:960

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
13071d17c88b4149c5bf3cf004961f37

SHA1
b806953d35de0c9e5985f71a99d81fc43e3ed216

SHA256
47a7a5e07a1086da0d5637f6628b0e88397b8b168696882098ec9f2658007930

SHA512
ecdd833e9f65b85a806d5f01dd3d9967a37cdf6a08b5701a497efa3a9c995bf92c84836186fdb6eb2d7d315f80bf477c6ffd8d222abf0f18a694ebfd6713f68c

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
13071d17c88b4149c5bf3cf004961f37

SHA1
b806953d35de0c9e5985f71a99d81fc43e3ed216

SHA256
47a7a5e07a1086da0d5637f6628b0e88397b8b168696882098ec9f2658007930

SHA512
ecdd833e9f65b85a806d5f01dd3d9967a37cdf6a08b5701a497efa3a9c995bf92c84836186fdb6eb2d7d315f80bf477c6ffd8d222abf0f18a694ebfd6713f68c

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
13071d17c88b4149c5bf3cf004961f37

SHA1
b806953d35de0c9e5985f71a99d81fc43e3ed216

SHA256
47a7a5e07a1086da0d5637f6628b0e88397b8b168696882098ec9f2658007930

SHA512
ecdd833e9f65b85a806d5f01dd3d9967a37cdf6a08b5701a497efa3a9c995bf92c84836186fdb6eb2d7d315f80bf477c6ffd8d222abf0f18a694ebfd6713f68c

Download Submit
memory/1144-55-0x0000000076731000-0x0000000076733000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads