sakula | 0609b8351c67723398dfb7d2802e1987b539c88cb854595a500bd1141e0b1646

General

Target

0609b8351c67723398dfb7d2802e1987b539c88cb854595a500bd1141e0b1646.exe
Size

150KB
MD5

61c490e880a1f9158ab9d7e62a49ffa2
SHA1

dcfc54d79fdedcd6b9c62ac532494b8f969e9ec0
SHA256

0609b8351c67723398dfb7d2802e1987b539c88cb854595a500bd1141e0b1646
SHA512

7e42c9d9496d1537217cf2ea223ab0a00bc522e2016e1178210f762fa25fb7a8bd71854029d64bd0b0fe2a408555e35c7252e1c05564417399f61386c0bec220

Score

10^/10

sakula persistence rat suricata trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula Payload 2 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula

suricata: ET MALWARE SUSPICIOUS UA (iexplore)
suricata: ET MALWARE SUSPICIOUS UA (iexplore)
suricata
suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1
suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 1
suricata
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1716 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2044 cmd.exe
Loads dropped DLL 1 IoCs

Processes:

0609b8351c67723398dfb7d2802e1987b539c88cb854595a500bd1141e0b1646.exe

pid process

860 0609b8351c67723398dfb7d2802e1987b539c88cb854595a500bd1141e0b1646.exe

pid	process
1716	MediaCenter.exe

pid	process
2044	cmd.exe

pid	process
860	0609b8351c67723398dfb7d2802e1987b539c88cb854595a500bd1141e0b1646.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

0609b8351c67723398dfb7d2802e1987b539c88cb854595a500bd1141e0b1646.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	0609b8351c67723398dfb7d2802e1987b539c88cb854595a500bd1141e0b1646.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1836 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0609b8351c67723398dfb7d2802e1987b539c88cb854595a500bd1141e0b1646.exe

description pid process

Token: SeIncBasePriorityPrivilege 860 0609b8351c67723398dfb7d2802e1987b539c88cb854595a500bd1141e0b1646.exe

pid	process
1836	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	860	0609b8351c67723398dfb7d2802e1987b539c88cb854595a500bd1141e0b1646.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

0609b8351c67723398dfb7d2802e1987b539c88cb854595a500bd1141e0b1646.execmd.exe

description	pid	process	target process
PID 860 wrote to memory of 1716	860	0609b8351c67723398dfb7d2802e1987b539c88cb854595a500bd1141e0b1646.exe	MediaCenter.exe
PID 860 wrote to memory of 1716	860	0609b8351c67723398dfb7d2802e1987b539c88cb854595a500bd1141e0b1646.exe	MediaCenter.exe
PID 860 wrote to memory of 1716	860	0609b8351c67723398dfb7d2802e1987b539c88cb854595a500bd1141e0b1646.exe	MediaCenter.exe
PID 860 wrote to memory of 1716	860	0609b8351c67723398dfb7d2802e1987b539c88cb854595a500bd1141e0b1646.exe	MediaCenter.exe
PID 860 wrote to memory of 2044	860	0609b8351c67723398dfb7d2802e1987b539c88cb854595a500bd1141e0b1646.exe	cmd.exe
PID 860 wrote to memory of 2044	860	0609b8351c67723398dfb7d2802e1987b539c88cb854595a500bd1141e0b1646.exe	cmd.exe
PID 860 wrote to memory of 2044	860	0609b8351c67723398dfb7d2802e1987b539c88cb854595a500bd1141e0b1646.exe	cmd.exe
PID 860 wrote to memory of 2044	860	0609b8351c67723398dfb7d2802e1987b539c88cb854595a500bd1141e0b1646.exe	cmd.exe
PID 2044 wrote to memory of 1836	2044	cmd.exe	PING.EXE
PID 2044 wrote to memory of 1836	2044	cmd.exe	PING.EXE
PID 2044 wrote to memory of 1836	2044	cmd.exe	PING.EXE
PID 2044 wrote to memory of 1836	2044	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\0609b8351c67723398dfb7d2802e1987b539c88cb854595a500bd1141e0b1646.exe
"C:\Users\Admin\AppData\Local\Temp\0609b8351c67723398dfb7d2802e1987b539c88cb854595a500bd1141e0b1646.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:860

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1716

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\0609b8351c67723398dfb7d2802e1987b539c88cb854595a500bd1141e0b1646.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2044

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1836

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
b2ff5da6ad153e052ce6be412b6a6eb0

SHA1
3d24d7ed7041ebdac2f17286caf3128cb8eb1ce2

SHA256
7190909a56894d0b150a85b815246045f810627aeb4b9cb5a98868dc1ba2c4db

SHA512
cad29dac8ec81444dd9e4ec05ad8d951082a9777adbe9de721e5484c7b23d7a9f5e31a25335ce809b925a4583aa48ec924c8ab637c0f65ce97c41384504fa736

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
b2ff5da6ad153e052ce6be412b6a6eb0

SHA1
3d24d7ed7041ebdac2f17286caf3128cb8eb1ce2

SHA256
7190909a56894d0b150a85b815246045f810627aeb4b9cb5a98868dc1ba2c4db

SHA512
cad29dac8ec81444dd9e4ec05ad8d951082a9777adbe9de721e5484c7b23d7a9f5e31a25335ce809b925a4583aa48ec924c8ab637c0f65ce97c41384504fa736

Download Submit
memory/860-55-0x0000000076731000-0x0000000076733000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads