sakula | 0603ea7f01bf518ab11717230278e805cd81f2a7255008c5b7e94bb8c936cc44

General

Target

0603ea7f01bf518ab11717230278e805cd81f2a7255008c5b7e94bb8c936cc44.exe
Size

150KB
MD5

0d46e73775f85757e19449ee4c48071e
SHA1

5d1bbb106d56e1c31332f3ab344ff1056112e041
SHA256

0603ea7f01bf518ab11717230278e805cd81f2a7255008c5b7e94bb8c936cc44
SHA512

bc0a32aa46beb9733f0a13410fa1a327200bbf6d5257c7853a0a6829b7f30117aa32782c73c4d31fc5f9b2c8806627977033eabd66f9fecb87929c8c9249b02d

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula Payload 2 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula

Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

792 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1912 cmd.exe
Loads dropped DLL 1 IoCs

Processes:

0603ea7f01bf518ab11717230278e805cd81f2a7255008c5b7e94bb8c936cc44.exe

pid process

744 0603ea7f01bf518ab11717230278e805cd81f2a7255008c5b7e94bb8c936cc44.exe

pid	process
792	MediaCenter.exe

pid	process
1912	cmd.exe

pid	process
744	0603ea7f01bf518ab11717230278e805cd81f2a7255008c5b7e94bb8c936cc44.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

0603ea7f01bf518ab11717230278e805cd81f2a7255008c5b7e94bb8c936cc44.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	0603ea7f01bf518ab11717230278e805cd81f2a7255008c5b7e94bb8c936cc44.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1788 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0603ea7f01bf518ab11717230278e805cd81f2a7255008c5b7e94bb8c936cc44.exe

description pid process

Token: SeIncBasePriorityPrivilege 744 0603ea7f01bf518ab11717230278e805cd81f2a7255008c5b7e94bb8c936cc44.exe

pid	process
1788	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	744	0603ea7f01bf518ab11717230278e805cd81f2a7255008c5b7e94bb8c936cc44.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

0603ea7f01bf518ab11717230278e805cd81f2a7255008c5b7e94bb8c936cc44.execmd.exe

description	pid	process	target process
PID 744 wrote to memory of 792	744	0603ea7f01bf518ab11717230278e805cd81f2a7255008c5b7e94bb8c936cc44.exe	MediaCenter.exe
PID 744 wrote to memory of 792	744	0603ea7f01bf518ab11717230278e805cd81f2a7255008c5b7e94bb8c936cc44.exe	MediaCenter.exe
PID 744 wrote to memory of 792	744	0603ea7f01bf518ab11717230278e805cd81f2a7255008c5b7e94bb8c936cc44.exe	MediaCenter.exe
PID 744 wrote to memory of 792	744	0603ea7f01bf518ab11717230278e805cd81f2a7255008c5b7e94bb8c936cc44.exe	MediaCenter.exe
PID 744 wrote to memory of 1912	744	0603ea7f01bf518ab11717230278e805cd81f2a7255008c5b7e94bb8c936cc44.exe	cmd.exe
PID 744 wrote to memory of 1912	744	0603ea7f01bf518ab11717230278e805cd81f2a7255008c5b7e94bb8c936cc44.exe	cmd.exe
PID 744 wrote to memory of 1912	744	0603ea7f01bf518ab11717230278e805cd81f2a7255008c5b7e94bb8c936cc44.exe	cmd.exe
PID 744 wrote to memory of 1912	744	0603ea7f01bf518ab11717230278e805cd81f2a7255008c5b7e94bb8c936cc44.exe	cmd.exe
PID 1912 wrote to memory of 1788	1912	cmd.exe	PING.EXE
PID 1912 wrote to memory of 1788	1912	cmd.exe	PING.EXE
PID 1912 wrote to memory of 1788	1912	cmd.exe	PING.EXE
PID 1912 wrote to memory of 1788	1912	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\0603ea7f01bf518ab11717230278e805cd81f2a7255008c5b7e94bb8c936cc44.exe
"C:\Users\Admin\AppData\Local\Temp\0603ea7f01bf518ab11717230278e805cd81f2a7255008c5b7e94bb8c936cc44.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:744

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:792

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\0603ea7f01bf518ab11717230278e805cd81f2a7255008c5b7e94bb8c936cc44.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1912

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1788

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
b7f179fec9dc2c3c33439faa77af6bef

SHA1
575bfa668fbbba4d9bed7c7ab30127adf1d10d16

SHA256
8553ce258d098732d5ded53ed0c6515592b6b4f85ddce7bb0ea90c475d6d1461

SHA512
7a4c117bcbb8dd422c5d79de3293feb5533d9a0f216079a4b6d3a6951e7521eb26f49042edccea487446e069d7f3375bb39360d0340c0298e29b0646fe3962a5

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
b7f179fec9dc2c3c33439faa77af6bef

SHA1
575bfa668fbbba4d9bed7c7ab30127adf1d10d16

SHA256
8553ce258d098732d5ded53ed0c6515592b6b4f85ddce7bb0ea90c475d6d1461

SHA512
7a4c117bcbb8dd422c5d79de3293feb5533d9a0f216079a4b6d3a6951e7521eb26f49042edccea487446e069d7f3375bb39360d0340c0298e29b0646fe3962a5

Download Submit
memory/744-54-0x0000000075D11000-0x0000000075D13000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads