sakula | 062e3a4d396211fc04099c6224661a7f480bb4b7c49e9826a43736eba6bc90c6

General

Target

062e3a4d396211fc04099c6224661a7f480bb4b7c49e9826a43736eba6bc90c6.exe
Size

35KB
MD5

9fd0cba7cf1f154f60207c446669bf4f
SHA1

8de06170ffea061704c322c6879f675bbb9d2afb
SHA256

062e3a4d396211fc04099c6224661a7f480bb4b7c49e9826a43736eba6bc90c6
SHA512

1ec48a5a1d6fe3ba85a70c9ccbb65446f4c52f294b8bb0fd4ed4c61fb60abd126d694312354de154ae91cd13c9f3b552c135f5f81a2e09fc69bf3b3b3a44e6a8

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

948 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1696 cmd.exe

pid	process
948	MediaCenter.exe

pid	process
1696	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

062e3a4d396211fc04099c6224661a7f480bb4b7c49e9826a43736eba6bc90c6.exe

pid	process
1768	062e3a4d396211fc04099c6224661a7f480bb4b7c49e9826a43736eba6bc90c6.exe
1768	062e3a4d396211fc04099c6224661a7f480bb4b7c49e9826a43736eba6bc90c6.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

062e3a4d396211fc04099c6224661a7f480bb4b7c49e9826a43736eba6bc90c6.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	062e3a4d396211fc04099c6224661a7f480bb4b7c49e9826a43736eba6bc90c6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1084 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

062e3a4d396211fc04099c6224661a7f480bb4b7c49e9826a43736eba6bc90c6.exe

description pid process

Token: SeIncBasePriorityPrivilege 1768 062e3a4d396211fc04099c6224661a7f480bb4b7c49e9826a43736eba6bc90c6.exe

pid	process
1084	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1768	062e3a4d396211fc04099c6224661a7f480bb4b7c49e9826a43736eba6bc90c6.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

062e3a4d396211fc04099c6224661a7f480bb4b7c49e9826a43736eba6bc90c6.execmd.exe

description	pid	process	target process
PID 1768 wrote to memory of 948	1768	062e3a4d396211fc04099c6224661a7f480bb4b7c49e9826a43736eba6bc90c6.exe	MediaCenter.exe
PID 1768 wrote to memory of 948	1768	062e3a4d396211fc04099c6224661a7f480bb4b7c49e9826a43736eba6bc90c6.exe	MediaCenter.exe
PID 1768 wrote to memory of 948	1768	062e3a4d396211fc04099c6224661a7f480bb4b7c49e9826a43736eba6bc90c6.exe	MediaCenter.exe
PID 1768 wrote to memory of 948	1768	062e3a4d396211fc04099c6224661a7f480bb4b7c49e9826a43736eba6bc90c6.exe	MediaCenter.exe
PID 1768 wrote to memory of 1696	1768	062e3a4d396211fc04099c6224661a7f480bb4b7c49e9826a43736eba6bc90c6.exe	cmd.exe
PID 1768 wrote to memory of 1696	1768	062e3a4d396211fc04099c6224661a7f480bb4b7c49e9826a43736eba6bc90c6.exe	cmd.exe
PID 1768 wrote to memory of 1696	1768	062e3a4d396211fc04099c6224661a7f480bb4b7c49e9826a43736eba6bc90c6.exe	cmd.exe
PID 1768 wrote to memory of 1696	1768	062e3a4d396211fc04099c6224661a7f480bb4b7c49e9826a43736eba6bc90c6.exe	cmd.exe
PID 1696 wrote to memory of 1084	1696	cmd.exe	PING.EXE
PID 1696 wrote to memory of 1084	1696	cmd.exe	PING.EXE
PID 1696 wrote to memory of 1084	1696	cmd.exe	PING.EXE
PID 1696 wrote to memory of 1084	1696	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\062e3a4d396211fc04099c6224661a7f480bb4b7c49e9826a43736eba6bc90c6.exe
"C:\Users\Admin\AppData\Local\Temp\062e3a4d396211fc04099c6224661a7f480bb4b7c49e9826a43736eba6bc90c6.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1768

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:948

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\062e3a4d396211fc04099c6224661a7f480bb4b7c49e9826a43736eba6bc90c6.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1696

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1084

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
535e859dc12b3139568de73d39dcb666

SHA1
56a82ca1c65825461dc2127d40fd0047a53a3252

SHA256
65eda598fab5b8f125b50ddbeed71e9c037c5a947b3f4e058bf238238c8061c4

SHA512
8512972afb7d06fe56a2462a057da473a4ef46be783803324b67246e843b8cb8797e5515df171df8bdb4a77eeda0f5634a59e628f20c9c1e85e8643347413960

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
535e859dc12b3139568de73d39dcb666

SHA1
56a82ca1c65825461dc2127d40fd0047a53a3252

SHA256
65eda598fab5b8f125b50ddbeed71e9c037c5a947b3f4e058bf238238c8061c4

SHA512
8512972afb7d06fe56a2462a057da473a4ef46be783803324b67246e843b8cb8797e5515df171df8bdb4a77eeda0f5634a59e628f20c9c1e85e8643347413960

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
535e859dc12b3139568de73d39dcb666

SHA1
56a82ca1c65825461dc2127d40fd0047a53a3252

SHA256
65eda598fab5b8f125b50ddbeed71e9c037c5a947b3f4e058bf238238c8061c4

SHA512
8512972afb7d06fe56a2462a057da473a4ef46be783803324b67246e843b8cb8797e5515df171df8bdb4a77eeda0f5634a59e628f20c9c1e85e8643347413960

Download Submit
memory/1768-55-0x00000000762C1000-0x00000000762C3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads