sakula | 02ecda1a613dce101b6eb84dae55be1a466cd7f8f2fc17bdf50a70b6260c2691

General

Target

02ecda1a613dce101b6eb84dae55be1a466cd7f8f2fc17bdf50a70b6260c2691.exe
Size

35KB
MD5

7c19b86413f34d9802244654b916b066
SHA1

26c46ecd8744f2155fc93720e70b53432a84c16c
SHA256

02ecda1a613dce101b6eb84dae55be1a466cd7f8f2fc17bdf50a70b6260c2691
SHA512

93cb71eecaa666451dc138772b9e57eba088338285d4aceb3c3c07bab609751734d87fb85d335efddeab3ecba2f5379d0fc1d71beed64e970550ca8f09cf0ab3

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1612 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1084 cmd.exe

pid	process
1612	MediaCenter.exe

pid	process
1084	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

02ecda1a613dce101b6eb84dae55be1a466cd7f8f2fc17bdf50a70b6260c2691.exe

pid	process
1404	02ecda1a613dce101b6eb84dae55be1a466cd7f8f2fc17bdf50a70b6260c2691.exe
1404	02ecda1a613dce101b6eb84dae55be1a466cd7f8f2fc17bdf50a70b6260c2691.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

02ecda1a613dce101b6eb84dae55be1a466cd7f8f2fc17bdf50a70b6260c2691.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	02ecda1a613dce101b6eb84dae55be1a466cd7f8f2fc17bdf50a70b6260c2691.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1984 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

02ecda1a613dce101b6eb84dae55be1a466cd7f8f2fc17bdf50a70b6260c2691.exe

description pid process

Token: SeIncBasePriorityPrivilege 1404 02ecda1a613dce101b6eb84dae55be1a466cd7f8f2fc17bdf50a70b6260c2691.exe

pid	process
1984	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1404	02ecda1a613dce101b6eb84dae55be1a466cd7f8f2fc17bdf50a70b6260c2691.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

02ecda1a613dce101b6eb84dae55be1a466cd7f8f2fc17bdf50a70b6260c2691.execmd.exe

description	pid	process	target process
PID 1404 wrote to memory of 1612	1404	02ecda1a613dce101b6eb84dae55be1a466cd7f8f2fc17bdf50a70b6260c2691.exe	MediaCenter.exe
PID 1404 wrote to memory of 1612	1404	02ecda1a613dce101b6eb84dae55be1a466cd7f8f2fc17bdf50a70b6260c2691.exe	MediaCenter.exe
PID 1404 wrote to memory of 1612	1404	02ecda1a613dce101b6eb84dae55be1a466cd7f8f2fc17bdf50a70b6260c2691.exe	MediaCenter.exe
PID 1404 wrote to memory of 1612	1404	02ecda1a613dce101b6eb84dae55be1a466cd7f8f2fc17bdf50a70b6260c2691.exe	MediaCenter.exe
PID 1404 wrote to memory of 1084	1404	02ecda1a613dce101b6eb84dae55be1a466cd7f8f2fc17bdf50a70b6260c2691.exe	cmd.exe
PID 1404 wrote to memory of 1084	1404	02ecda1a613dce101b6eb84dae55be1a466cd7f8f2fc17bdf50a70b6260c2691.exe	cmd.exe
PID 1404 wrote to memory of 1084	1404	02ecda1a613dce101b6eb84dae55be1a466cd7f8f2fc17bdf50a70b6260c2691.exe	cmd.exe
PID 1404 wrote to memory of 1084	1404	02ecda1a613dce101b6eb84dae55be1a466cd7f8f2fc17bdf50a70b6260c2691.exe	cmd.exe
PID 1084 wrote to memory of 1984	1084	cmd.exe	PING.EXE
PID 1084 wrote to memory of 1984	1084	cmd.exe	PING.EXE
PID 1084 wrote to memory of 1984	1084	cmd.exe	PING.EXE
PID 1084 wrote to memory of 1984	1084	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\02ecda1a613dce101b6eb84dae55be1a466cd7f8f2fc17bdf50a70b6260c2691.exe
"C:\Users\Admin\AppData\Local\Temp\02ecda1a613dce101b6eb84dae55be1a466cd7f8f2fc17bdf50a70b6260c2691.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1404

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1612

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\02ecda1a613dce101b6eb84dae55be1a466cd7f8f2fc17bdf50a70b6260c2691.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1084

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1984

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
1e49a4549cc85d7e150e40568e534869

SHA1
5ebab525ab760d4a99b7fa63ba2b2cc8a9743959

SHA256
8c32be09d9af2f6d845cfd727b000171a33a04cf0634f030c55b1ebaf8d60658

SHA512
19b686db12b2a5be831ac7f0bcd61af686cf63d856d08e8def84a9f54633a50c54711f389831d8aebb5e72aa7e6ee425d040af7eeb7adf1d2ec7bdcdab608901

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
1e49a4549cc85d7e150e40568e534869

SHA1
5ebab525ab760d4a99b7fa63ba2b2cc8a9743959

SHA256
8c32be09d9af2f6d845cfd727b000171a33a04cf0634f030c55b1ebaf8d60658

SHA512
19b686db12b2a5be831ac7f0bcd61af686cf63d856d08e8def84a9f54633a50c54711f389831d8aebb5e72aa7e6ee425d040af7eeb7adf1d2ec7bdcdab608901

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
1e49a4549cc85d7e150e40568e534869

SHA1
5ebab525ab760d4a99b7fa63ba2b2cc8a9743959

SHA256
8c32be09d9af2f6d845cfd727b000171a33a04cf0634f030c55b1ebaf8d60658

SHA512
19b686db12b2a5be831ac7f0bcd61af686cf63d856d08e8def84a9f54633a50c54711f389831d8aebb5e72aa7e6ee425d040af7eeb7adf1d2ec7bdcdab608901

Download Submit
memory/1404-55-0x0000000075F81000-0x0000000075F83000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads