sakula | 030f2a3af21241038a51f07a8697c6ca0887ff4f7d466f472801383b4ff3a7a4

General

Target

030f2a3af21241038a51f07a8697c6ca0887ff4f7d466f472801383b4ff3a7a4.exe
Size

58KB
MD5

e4d72dcb3be2cc0babb0d1c82ddfc284
SHA1

524ea40f8f5a8eec06c4a3e80c8874cfed91c89c
SHA256

030f2a3af21241038a51f07a8697c6ca0887ff4f7d466f472801383b4ff3a7a4
SHA512

e2359fafa57cb8d45457ffb72b8fc06ece04033d8af598b8c54f6b2ca511b8a05a9613324114dea25420cd70a574bed07bcf6d91d1be2fea1d63a1bae59b7be1

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

840 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1072 cmd.exe

pid	process
840	MediaCenter.exe

pid	process
1072	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

030f2a3af21241038a51f07a8697c6ca0887ff4f7d466f472801383b4ff3a7a4.exe

pid	process
1660	030f2a3af21241038a51f07a8697c6ca0887ff4f7d466f472801383b4ff3a7a4.exe
1660	030f2a3af21241038a51f07a8697c6ca0887ff4f7d466f472801383b4ff3a7a4.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

030f2a3af21241038a51f07a8697c6ca0887ff4f7d466f472801383b4ff3a7a4.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	030f2a3af21241038a51f07a8697c6ca0887ff4f7d466f472801383b4ff3a7a4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

556 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

030f2a3af21241038a51f07a8697c6ca0887ff4f7d466f472801383b4ff3a7a4.exe

description pid process

Token: SeIncBasePriorityPrivilege 1660 030f2a3af21241038a51f07a8697c6ca0887ff4f7d466f472801383b4ff3a7a4.exe

pid	process
556	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1660	030f2a3af21241038a51f07a8697c6ca0887ff4f7d466f472801383b4ff3a7a4.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

030f2a3af21241038a51f07a8697c6ca0887ff4f7d466f472801383b4ff3a7a4.execmd.exe

description	pid	process	target process
PID 1660 wrote to memory of 840	1660	030f2a3af21241038a51f07a8697c6ca0887ff4f7d466f472801383b4ff3a7a4.exe	MediaCenter.exe
PID 1660 wrote to memory of 840	1660	030f2a3af21241038a51f07a8697c6ca0887ff4f7d466f472801383b4ff3a7a4.exe	MediaCenter.exe
PID 1660 wrote to memory of 840	1660	030f2a3af21241038a51f07a8697c6ca0887ff4f7d466f472801383b4ff3a7a4.exe	MediaCenter.exe
PID 1660 wrote to memory of 840	1660	030f2a3af21241038a51f07a8697c6ca0887ff4f7d466f472801383b4ff3a7a4.exe	MediaCenter.exe
PID 1660 wrote to memory of 1072	1660	030f2a3af21241038a51f07a8697c6ca0887ff4f7d466f472801383b4ff3a7a4.exe	cmd.exe
PID 1660 wrote to memory of 1072	1660	030f2a3af21241038a51f07a8697c6ca0887ff4f7d466f472801383b4ff3a7a4.exe	cmd.exe
PID 1660 wrote to memory of 1072	1660	030f2a3af21241038a51f07a8697c6ca0887ff4f7d466f472801383b4ff3a7a4.exe	cmd.exe
PID 1660 wrote to memory of 1072	1660	030f2a3af21241038a51f07a8697c6ca0887ff4f7d466f472801383b4ff3a7a4.exe	cmd.exe
PID 1072 wrote to memory of 556	1072	cmd.exe	PING.EXE
PID 1072 wrote to memory of 556	1072	cmd.exe	PING.EXE
PID 1072 wrote to memory of 556	1072	cmd.exe	PING.EXE
PID 1072 wrote to memory of 556	1072	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\030f2a3af21241038a51f07a8697c6ca0887ff4f7d466f472801383b4ff3a7a4.exe
"C:\Users\Admin\AppData\Local\Temp\030f2a3af21241038a51f07a8697c6ca0887ff4f7d466f472801383b4ff3a7a4.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1660

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:840

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\030f2a3af21241038a51f07a8697c6ca0887ff4f7d466f472801383b4ff3a7a4.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1072

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:556

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
149a178cf4f531ce8602f5002c5e4dd5

SHA1
913125bbe36d673200c305daf97d8a28639e3212

SHA256
d6b9a48a8cb0f82de64c956e8e9dd412ef24501176569295412fdcf75d543a64

SHA512
98e3916b2f0406f8f077a9d522da0114de6beabfcfab52b02a053a5c9368283f5c4346b8d57482cc4db5cae5c8d0081568b5000eede313ddb6fb15f3c6848a16

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
149a178cf4f531ce8602f5002c5e4dd5

SHA1
913125bbe36d673200c305daf97d8a28639e3212

SHA256
d6b9a48a8cb0f82de64c956e8e9dd412ef24501176569295412fdcf75d543a64

SHA512
98e3916b2f0406f8f077a9d522da0114de6beabfcfab52b02a053a5c9368283f5c4346b8d57482cc4db5cae5c8d0081568b5000eede313ddb6fb15f3c6848a16

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
149a178cf4f531ce8602f5002c5e4dd5

SHA1
913125bbe36d673200c305daf97d8a28639e3212

SHA256
d6b9a48a8cb0f82de64c956e8e9dd412ef24501176569295412fdcf75d543a64

SHA512
98e3916b2f0406f8f077a9d522da0114de6beabfcfab52b02a053a5c9368283f5c4346b8d57482cc4db5cae5c8d0081568b5000eede313ddb6fb15f3c6848a16

Download Submit
memory/1660-55-0x00000000763F1000-0x00000000763F3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads