sakula | 06212260432d2b80ec1226ecf72839b11edf8f080152ad6e5a42093d8456191c

General

Target

06212260432d2b80ec1226ecf72839b11edf8f080152ad6e5a42093d8456191c.exe
Size

58KB
MD5

6fcd910e4221a6df5a23757ca723cd7f
SHA1

a5f30166b9ac80c7370a81b428a9da38d4e0a618
SHA256

06212260432d2b80ec1226ecf72839b11edf8f080152ad6e5a42093d8456191c
SHA512

4ce21f94947e76c169375c26cba1d4ec648b9bf79a0a285b22cc9e5b126e103236ab662609cae34ff0da3595de4f4aa5a25c06abea2f64875281109886136929

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1224 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1484 cmd.exe

pid	process
1224	MediaCenter.exe

pid	process
1484	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

06212260432d2b80ec1226ecf72839b11edf8f080152ad6e5a42093d8456191c.exe

pid	process
1892	06212260432d2b80ec1226ecf72839b11edf8f080152ad6e5a42093d8456191c.exe
1892	06212260432d2b80ec1226ecf72839b11edf8f080152ad6e5a42093d8456191c.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

06212260432d2b80ec1226ecf72839b11edf8f080152ad6e5a42093d8456191c.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	06212260432d2b80ec1226ecf72839b11edf8f080152ad6e5a42093d8456191c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1800 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

06212260432d2b80ec1226ecf72839b11edf8f080152ad6e5a42093d8456191c.exe

description pid process

Token: SeIncBasePriorityPrivilege 1892 06212260432d2b80ec1226ecf72839b11edf8f080152ad6e5a42093d8456191c.exe

pid	process
1800	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1892	06212260432d2b80ec1226ecf72839b11edf8f080152ad6e5a42093d8456191c.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

06212260432d2b80ec1226ecf72839b11edf8f080152ad6e5a42093d8456191c.execmd.exe

description	pid	process	target process
PID 1892 wrote to memory of 1224	1892	06212260432d2b80ec1226ecf72839b11edf8f080152ad6e5a42093d8456191c.exe	MediaCenter.exe
PID 1892 wrote to memory of 1224	1892	06212260432d2b80ec1226ecf72839b11edf8f080152ad6e5a42093d8456191c.exe	MediaCenter.exe
PID 1892 wrote to memory of 1224	1892	06212260432d2b80ec1226ecf72839b11edf8f080152ad6e5a42093d8456191c.exe	MediaCenter.exe
PID 1892 wrote to memory of 1224	1892	06212260432d2b80ec1226ecf72839b11edf8f080152ad6e5a42093d8456191c.exe	MediaCenter.exe
PID 1892 wrote to memory of 1484	1892	06212260432d2b80ec1226ecf72839b11edf8f080152ad6e5a42093d8456191c.exe	cmd.exe
PID 1892 wrote to memory of 1484	1892	06212260432d2b80ec1226ecf72839b11edf8f080152ad6e5a42093d8456191c.exe	cmd.exe
PID 1892 wrote to memory of 1484	1892	06212260432d2b80ec1226ecf72839b11edf8f080152ad6e5a42093d8456191c.exe	cmd.exe
PID 1892 wrote to memory of 1484	1892	06212260432d2b80ec1226ecf72839b11edf8f080152ad6e5a42093d8456191c.exe	cmd.exe
PID 1484 wrote to memory of 1800	1484	cmd.exe	PING.EXE
PID 1484 wrote to memory of 1800	1484	cmd.exe	PING.EXE
PID 1484 wrote to memory of 1800	1484	cmd.exe	PING.EXE
PID 1484 wrote to memory of 1800	1484	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\06212260432d2b80ec1226ecf72839b11edf8f080152ad6e5a42093d8456191c.exe
"C:\Users\Admin\AppData\Local\Temp\06212260432d2b80ec1226ecf72839b11edf8f080152ad6e5a42093d8456191c.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1892

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1224

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\06212260432d2b80ec1226ecf72839b11edf8f080152ad6e5a42093d8456191c.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1484

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1800

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
63d3e9fcbae00f0d64382fad23e2451e

SHA1
6981e8324312593ad34f37c2d64ee9cc26cbd728

SHA256
b20c1ce44392659d233741ce515014161d454e082e6d045261b033c3d21c47cf

SHA512
1667a34f5484740121cdf58ed805c0a45f7d7ed056a7679cdc8f7986065da293437bf1febc9b07d6129d2e77b03fa6a25bd13ea611a51b1a4808ca4992607f69

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
63d3e9fcbae00f0d64382fad23e2451e

SHA1
6981e8324312593ad34f37c2d64ee9cc26cbd728

SHA256
b20c1ce44392659d233741ce515014161d454e082e6d045261b033c3d21c47cf

SHA512
1667a34f5484740121cdf58ed805c0a45f7d7ed056a7679cdc8f7986065da293437bf1febc9b07d6129d2e77b03fa6a25bd13ea611a51b1a4808ca4992607f69

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
63d3e9fcbae00f0d64382fad23e2451e

SHA1
6981e8324312593ad34f37c2d64ee9cc26cbd728

SHA256
b20c1ce44392659d233741ce515014161d454e082e6d045261b033c3d21c47cf

SHA512
1667a34f5484740121cdf58ed805c0a45f7d7ed056a7679cdc8f7986065da293437bf1febc9b07d6129d2e77b03fa6a25bd13ea611a51b1a4808ca4992607f69

Download Submit
memory/1892-54-0x0000000076071000-0x0000000076073000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads