sakula | 064ef8d8d5cca668a387d9aa94105b94253ef2ce42165d7feff590b25d305119

General

Target

064ef8d8d5cca668a387d9aa94105b94253ef2ce42165d7feff590b25d305119.exe
Size

58KB
MD5

653e40482797486573f875008f1bf11e
SHA1

83c47e4499034d4502b14b188924dacc8ec6e820
SHA256

064ef8d8d5cca668a387d9aa94105b94253ef2ce42165d7feff590b25d305119
SHA512

f5c7c496537c8f8ed8368c8a29e18ec5319693580305b90100aed903b0d1d37b462ec3668c5a69205e2fe9b44ec6b1cb94fd490027ea08cd6c490c06f09406c0

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1824 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2016 cmd.exe

pid	process
1824	MediaCenter.exe

pid	process
2016	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

064ef8d8d5cca668a387d9aa94105b94253ef2ce42165d7feff590b25d305119.exe

pid	process
864	064ef8d8d5cca668a387d9aa94105b94253ef2ce42165d7feff590b25d305119.exe
864	064ef8d8d5cca668a387d9aa94105b94253ef2ce42165d7feff590b25d305119.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

064ef8d8d5cca668a387d9aa94105b94253ef2ce42165d7feff590b25d305119.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	064ef8d8d5cca668a387d9aa94105b94253ef2ce42165d7feff590b25d305119.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1988 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

064ef8d8d5cca668a387d9aa94105b94253ef2ce42165d7feff590b25d305119.exe

description pid process

Token: SeIncBasePriorityPrivilege 864 064ef8d8d5cca668a387d9aa94105b94253ef2ce42165d7feff590b25d305119.exe

pid	process
1988	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	864	064ef8d8d5cca668a387d9aa94105b94253ef2ce42165d7feff590b25d305119.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

064ef8d8d5cca668a387d9aa94105b94253ef2ce42165d7feff590b25d305119.execmd.exe

description	pid	process	target process
PID 864 wrote to memory of 1824	864	064ef8d8d5cca668a387d9aa94105b94253ef2ce42165d7feff590b25d305119.exe	MediaCenter.exe
PID 864 wrote to memory of 1824	864	064ef8d8d5cca668a387d9aa94105b94253ef2ce42165d7feff590b25d305119.exe	MediaCenter.exe
PID 864 wrote to memory of 1824	864	064ef8d8d5cca668a387d9aa94105b94253ef2ce42165d7feff590b25d305119.exe	MediaCenter.exe
PID 864 wrote to memory of 1824	864	064ef8d8d5cca668a387d9aa94105b94253ef2ce42165d7feff590b25d305119.exe	MediaCenter.exe
PID 864 wrote to memory of 2016	864	064ef8d8d5cca668a387d9aa94105b94253ef2ce42165d7feff590b25d305119.exe	cmd.exe
PID 864 wrote to memory of 2016	864	064ef8d8d5cca668a387d9aa94105b94253ef2ce42165d7feff590b25d305119.exe	cmd.exe
PID 864 wrote to memory of 2016	864	064ef8d8d5cca668a387d9aa94105b94253ef2ce42165d7feff590b25d305119.exe	cmd.exe
PID 864 wrote to memory of 2016	864	064ef8d8d5cca668a387d9aa94105b94253ef2ce42165d7feff590b25d305119.exe	cmd.exe
PID 2016 wrote to memory of 1988	2016	cmd.exe	PING.EXE
PID 2016 wrote to memory of 1988	2016	cmd.exe	PING.EXE
PID 2016 wrote to memory of 1988	2016	cmd.exe	PING.EXE
PID 2016 wrote to memory of 1988	2016	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\064ef8d8d5cca668a387d9aa94105b94253ef2ce42165d7feff590b25d305119.exe
"C:\Users\Admin\AppData\Local\Temp\064ef8d8d5cca668a387d9aa94105b94253ef2ce42165d7feff590b25d305119.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:864

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1824

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\064ef8d8d5cca668a387d9aa94105b94253ef2ce42165d7feff590b25d305119.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2016

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1988

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
84877dac7d56457f84e619fb5e5b4132

SHA1
00b4394543dd6592aff14b66daad79e706ac6d34

SHA256
6aa0f874b344ff5d2ea6cc402a01c3d7a16bdc8078db58effc50e1459937ba14

SHA512
307af31a9ed94615ca95cb62d2dec9c4c6104913c4af28f5f62afbebcc96335b3c52f0bd77a6e5608b278a10915da1bec94694daf034ca79d58210a87da08210

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
84877dac7d56457f84e619fb5e5b4132

SHA1
00b4394543dd6592aff14b66daad79e706ac6d34

SHA256
6aa0f874b344ff5d2ea6cc402a01c3d7a16bdc8078db58effc50e1459937ba14

SHA512
307af31a9ed94615ca95cb62d2dec9c4c6104913c4af28f5f62afbebcc96335b3c52f0bd77a6e5608b278a10915da1bec94694daf034ca79d58210a87da08210

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
84877dac7d56457f84e619fb5e5b4132

SHA1
00b4394543dd6592aff14b66daad79e706ac6d34

SHA256
6aa0f874b344ff5d2ea6cc402a01c3d7a16bdc8078db58effc50e1459937ba14

SHA512
307af31a9ed94615ca95cb62d2dec9c4c6104913c4af28f5f62afbebcc96335b3c52f0bd77a6e5608b278a10915da1bec94694daf034ca79d58210a87da08210

Download Submit
memory/864-55-0x0000000075421000-0x0000000075423000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads