sakula | 06b1cf05e64946edbae8f8f625da5de743d6f15af0ce59960ea77768586cc49c

General

Target

06b1cf05e64946edbae8f8f625da5de743d6f15af0ce59960ea77768586cc49c.exe
Size

99KB
MD5

9be9f50ec6a98e80f05e38a80a40d63d
SHA1

1fc6edcdb25cb342f18eaf86d54d2b0eb1dcdd08
SHA256

06b1cf05e64946edbae8f8f625da5de743d6f15af0ce59960ea77768586cc49c
SHA512

9a16cc9c0dc7163e8ec161d10abc29afc128a4a07a88c38a13d92827867798219f8c6da18cbeceb94b139ac713fec37c1b224b0507b318c813264c9ff02940ff

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula Payload 3 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula

Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1540 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1412 cmd.exe

pid	process
1540	MediaCenter.exe

pid	process
1412	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

06b1cf05e64946edbae8f8f625da5de743d6f15af0ce59960ea77768586cc49c.exe

pid	process
624	06b1cf05e64946edbae8f8f625da5de743d6f15af0ce59960ea77768586cc49c.exe
624	06b1cf05e64946edbae8f8f625da5de743d6f15af0ce59960ea77768586cc49c.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

06b1cf05e64946edbae8f8f625da5de743d6f15af0ce59960ea77768586cc49c.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	06b1cf05e64946edbae8f8f625da5de743d6f15af0ce59960ea77768586cc49c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

984 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

06b1cf05e64946edbae8f8f625da5de743d6f15af0ce59960ea77768586cc49c.exe

description pid process

Token: SeIncBasePriorityPrivilege 624 06b1cf05e64946edbae8f8f625da5de743d6f15af0ce59960ea77768586cc49c.exe

pid	process
984	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	624	06b1cf05e64946edbae8f8f625da5de743d6f15af0ce59960ea77768586cc49c.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

06b1cf05e64946edbae8f8f625da5de743d6f15af0ce59960ea77768586cc49c.execmd.exe

description	pid	process	target process
PID 624 wrote to memory of 1540	624	06b1cf05e64946edbae8f8f625da5de743d6f15af0ce59960ea77768586cc49c.exe	MediaCenter.exe
PID 624 wrote to memory of 1540	624	06b1cf05e64946edbae8f8f625da5de743d6f15af0ce59960ea77768586cc49c.exe	MediaCenter.exe
PID 624 wrote to memory of 1540	624	06b1cf05e64946edbae8f8f625da5de743d6f15af0ce59960ea77768586cc49c.exe	MediaCenter.exe
PID 624 wrote to memory of 1540	624	06b1cf05e64946edbae8f8f625da5de743d6f15af0ce59960ea77768586cc49c.exe	MediaCenter.exe
PID 624 wrote to memory of 1412	624	06b1cf05e64946edbae8f8f625da5de743d6f15af0ce59960ea77768586cc49c.exe	cmd.exe
PID 624 wrote to memory of 1412	624	06b1cf05e64946edbae8f8f625da5de743d6f15af0ce59960ea77768586cc49c.exe	cmd.exe
PID 624 wrote to memory of 1412	624	06b1cf05e64946edbae8f8f625da5de743d6f15af0ce59960ea77768586cc49c.exe	cmd.exe
PID 624 wrote to memory of 1412	624	06b1cf05e64946edbae8f8f625da5de743d6f15af0ce59960ea77768586cc49c.exe	cmd.exe
PID 1412 wrote to memory of 984	1412	cmd.exe	PING.EXE
PID 1412 wrote to memory of 984	1412	cmd.exe	PING.EXE
PID 1412 wrote to memory of 984	1412	cmd.exe	PING.EXE
PID 1412 wrote to memory of 984	1412	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\06b1cf05e64946edbae8f8f625da5de743d6f15af0ce59960ea77768586cc49c.exe
"C:\Users\Admin\AppData\Local\Temp\06b1cf05e64946edbae8f8f625da5de743d6f15af0ce59960ea77768586cc49c.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:624

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1540

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\06b1cf05e64946edbae8f8f625da5de743d6f15af0ce59960ea77768586cc49c.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1412

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:984

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
bc083702a854235180ea7b70c3d70f6f

SHA1
f24a8fd5618e4247fd9971fb846a4afd3c74e8ea

SHA256
563c5c2ca6d7dd66697265ec6f8c917c39889e6885d8b4da775ad7bb253c2b9e

SHA512
9c5bf12e5370f36fe13f7bcb08a3f837af17d395953357d49dd11c4047205c5b23109dc003d480aff8df0633060d3cfa628bd70716ad8e72e112a584f7046739

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
bc083702a854235180ea7b70c3d70f6f

SHA1
f24a8fd5618e4247fd9971fb846a4afd3c74e8ea

SHA256
563c5c2ca6d7dd66697265ec6f8c917c39889e6885d8b4da775ad7bb253c2b9e

SHA512
9c5bf12e5370f36fe13f7bcb08a3f837af17d395953357d49dd11c4047205c5b23109dc003d480aff8df0633060d3cfa628bd70716ad8e72e112a584f7046739

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
bc083702a854235180ea7b70c3d70f6f

SHA1
f24a8fd5618e4247fd9971fb846a4afd3c74e8ea

SHA256
563c5c2ca6d7dd66697265ec6f8c917c39889e6885d8b4da775ad7bb253c2b9e

SHA512
9c5bf12e5370f36fe13f7bcb08a3f837af17d395953357d49dd11c4047205c5b23109dc003d480aff8df0633060d3cfa628bd70716ad8e72e112a584f7046739

Download Submit
memory/624-55-0x0000000076731000-0x0000000076733000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads