sakula | 06582dacdb7d9d2c4b5ec93772b5086d438ef1fd4a764fafbc33186667842f55

General

Target

06582dacdb7d9d2c4b5ec93772b5086d438ef1fd4a764fafbc33186667842f55.exe
Size

191KB
MD5

f58f39bae3dbacb62798a7a5a41a973a
SHA1

4ad676bba6e91064a27719dc681cdd0dba66cab9
SHA256

06582dacdb7d9d2c4b5ec93772b5086d438ef1fd4a764fafbc33186667842f55
SHA512

0bdce152f9d6ba3bcdaa1c07558dee727ac99a76afe0f50b92269ca51853a43abd809aec7c88a0294a2d13dddf5ec23d1ea39688c8fd8d69cd13d188559526fb

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula Payload 3 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula

Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1588 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1376 cmd.exe

pid	process
1588	MediaCenter.exe

pid	process
1376	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

06582dacdb7d9d2c4b5ec93772b5086d438ef1fd4a764fafbc33186667842f55.exe

pid	process
1564	06582dacdb7d9d2c4b5ec93772b5086d438ef1fd4a764fafbc33186667842f55.exe
1564	06582dacdb7d9d2c4b5ec93772b5086d438ef1fd4a764fafbc33186667842f55.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

06582dacdb7d9d2c4b5ec93772b5086d438ef1fd4a764fafbc33186667842f55.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	06582dacdb7d9d2c4b5ec93772b5086d438ef1fd4a764fafbc33186667842f55.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

360 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

06582dacdb7d9d2c4b5ec93772b5086d438ef1fd4a764fafbc33186667842f55.exe

description pid process

Token: SeIncBasePriorityPrivilege 1564 06582dacdb7d9d2c4b5ec93772b5086d438ef1fd4a764fafbc33186667842f55.exe

pid	process
360	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1564	06582dacdb7d9d2c4b5ec93772b5086d438ef1fd4a764fafbc33186667842f55.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

06582dacdb7d9d2c4b5ec93772b5086d438ef1fd4a764fafbc33186667842f55.execmd.exe

description	pid	process	target process
PID 1564 wrote to memory of 1588	1564	06582dacdb7d9d2c4b5ec93772b5086d438ef1fd4a764fafbc33186667842f55.exe	MediaCenter.exe
PID 1564 wrote to memory of 1588	1564	06582dacdb7d9d2c4b5ec93772b5086d438ef1fd4a764fafbc33186667842f55.exe	MediaCenter.exe
PID 1564 wrote to memory of 1588	1564	06582dacdb7d9d2c4b5ec93772b5086d438ef1fd4a764fafbc33186667842f55.exe	MediaCenter.exe
PID 1564 wrote to memory of 1588	1564	06582dacdb7d9d2c4b5ec93772b5086d438ef1fd4a764fafbc33186667842f55.exe	MediaCenter.exe
PID 1564 wrote to memory of 1376	1564	06582dacdb7d9d2c4b5ec93772b5086d438ef1fd4a764fafbc33186667842f55.exe	cmd.exe
PID 1564 wrote to memory of 1376	1564	06582dacdb7d9d2c4b5ec93772b5086d438ef1fd4a764fafbc33186667842f55.exe	cmd.exe
PID 1564 wrote to memory of 1376	1564	06582dacdb7d9d2c4b5ec93772b5086d438ef1fd4a764fafbc33186667842f55.exe	cmd.exe
PID 1564 wrote to memory of 1376	1564	06582dacdb7d9d2c4b5ec93772b5086d438ef1fd4a764fafbc33186667842f55.exe	cmd.exe
PID 1376 wrote to memory of 360	1376	cmd.exe	PING.EXE
PID 1376 wrote to memory of 360	1376	cmd.exe	PING.EXE
PID 1376 wrote to memory of 360	1376	cmd.exe	PING.EXE
PID 1376 wrote to memory of 360	1376	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\06582dacdb7d9d2c4b5ec93772b5086d438ef1fd4a764fafbc33186667842f55.exe
"C:\Users\Admin\AppData\Local\Temp\06582dacdb7d9d2c4b5ec93772b5086d438ef1fd4a764fafbc33186667842f55.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1564

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1588

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\06582dacdb7d9d2c4b5ec93772b5086d438ef1fd4a764fafbc33186667842f55.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1376

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:360

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
389d475cf32f3dba134abd29cebafb4e

SHA1
b8089a48a90833cdadd4a771b28206a22274a5c0

SHA256
006f65f27016d1246f2f91d86a3fed181a5847bf79509448aa22a6d04652ac91

SHA512
c2e1be3cd018d4b0be01722b308213e414edc4f7698fa9b2be79c6075242ffe0068836390eba0b255a654ec60bc08a5190fc10e9425c69743fd7d3fea05ea793

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
389d475cf32f3dba134abd29cebafb4e

SHA1
b8089a48a90833cdadd4a771b28206a22274a5c0

SHA256
006f65f27016d1246f2f91d86a3fed181a5847bf79509448aa22a6d04652ac91

SHA512
c2e1be3cd018d4b0be01722b308213e414edc4f7698fa9b2be79c6075242ffe0068836390eba0b255a654ec60bc08a5190fc10e9425c69743fd7d3fea05ea793

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
389d475cf32f3dba134abd29cebafb4e

SHA1
b8089a48a90833cdadd4a771b28206a22274a5c0

SHA256
006f65f27016d1246f2f91d86a3fed181a5847bf79509448aa22a6d04652ac91

SHA512
c2e1be3cd018d4b0be01722b308213e414edc4f7698fa9b2be79c6075242ffe0068836390eba0b255a654ec60bc08a5190fc10e9425c69743fd7d3fea05ea793

Download Submit
memory/1564-55-0x00000000756C1000-0x00000000756C3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads