sakula | 02eb66e4297ca3f42391071883afe5cab000eab469e432f47f4bfdfda060ab77

General

Target

02eb66e4297ca3f42391071883afe5cab000eab469e432f47f4bfdfda060ab77.exe
Size

60KB
MD5

c91e268c4270749257d3fc22d1350764
SHA1

826c5a394be048392c4b17b72793126e622a59b7
SHA256

02eb66e4297ca3f42391071883afe5cab000eab469e432f47f4bfdfda060ab77
SHA512

31aabf5001b030bf88227e1e501c6c6cb0b29f0a890a664ef0f074c8ca80b20164156d9e86fd8dcfd5231d0d1c8211427c421aa7bb2d668b6c6c9c5c5083e1a1

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1572 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1088 cmd.exe

pid	process
1572	MediaCenter.exe

pid	process
1088	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

02eb66e4297ca3f42391071883afe5cab000eab469e432f47f4bfdfda060ab77.exe

pid	process
1560	02eb66e4297ca3f42391071883afe5cab000eab469e432f47f4bfdfda060ab77.exe
1560	02eb66e4297ca3f42391071883afe5cab000eab469e432f47f4bfdfda060ab77.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

02eb66e4297ca3f42391071883afe5cab000eab469e432f47f4bfdfda060ab77.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	02eb66e4297ca3f42391071883afe5cab000eab469e432f47f4bfdfda060ab77.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1080 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

02eb66e4297ca3f42391071883afe5cab000eab469e432f47f4bfdfda060ab77.exe

description pid process

Token: SeIncBasePriorityPrivilege 1560 02eb66e4297ca3f42391071883afe5cab000eab469e432f47f4bfdfda060ab77.exe

pid	process
1080	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1560	02eb66e4297ca3f42391071883afe5cab000eab469e432f47f4bfdfda060ab77.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

02eb66e4297ca3f42391071883afe5cab000eab469e432f47f4bfdfda060ab77.execmd.exe

description	pid	process	target process
PID 1560 wrote to memory of 1572	1560	02eb66e4297ca3f42391071883afe5cab000eab469e432f47f4bfdfda060ab77.exe	MediaCenter.exe
PID 1560 wrote to memory of 1572	1560	02eb66e4297ca3f42391071883afe5cab000eab469e432f47f4bfdfda060ab77.exe	MediaCenter.exe
PID 1560 wrote to memory of 1572	1560	02eb66e4297ca3f42391071883afe5cab000eab469e432f47f4bfdfda060ab77.exe	MediaCenter.exe
PID 1560 wrote to memory of 1572	1560	02eb66e4297ca3f42391071883afe5cab000eab469e432f47f4bfdfda060ab77.exe	MediaCenter.exe
PID 1560 wrote to memory of 1088	1560	02eb66e4297ca3f42391071883afe5cab000eab469e432f47f4bfdfda060ab77.exe	cmd.exe
PID 1560 wrote to memory of 1088	1560	02eb66e4297ca3f42391071883afe5cab000eab469e432f47f4bfdfda060ab77.exe	cmd.exe
PID 1560 wrote to memory of 1088	1560	02eb66e4297ca3f42391071883afe5cab000eab469e432f47f4bfdfda060ab77.exe	cmd.exe
PID 1560 wrote to memory of 1088	1560	02eb66e4297ca3f42391071883afe5cab000eab469e432f47f4bfdfda060ab77.exe	cmd.exe
PID 1088 wrote to memory of 1080	1088	cmd.exe	PING.EXE
PID 1088 wrote to memory of 1080	1088	cmd.exe	PING.EXE
PID 1088 wrote to memory of 1080	1088	cmd.exe	PING.EXE
PID 1088 wrote to memory of 1080	1088	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\02eb66e4297ca3f42391071883afe5cab000eab469e432f47f4bfdfda060ab77.exe
"C:\Users\Admin\AppData\Local\Temp\02eb66e4297ca3f42391071883afe5cab000eab469e432f47f4bfdfda060ab77.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1560

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1572

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\02eb66e4297ca3f42391071883afe5cab000eab469e432f47f4bfdfda060ab77.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1088

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1080

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
a95a0a3fc585d8bd60e031787c35e0cd

SHA1
0b06962bc437d91d1dfdbda551e7b8b2172536fa

SHA256
c9bb8d7c11ad9083ed0d8275a49ca872c83188a361c1020b73fc3f486ca96a50

SHA512
ec981e981f92d0499926b9a198554e025edd37b9c52be0f1de8d36c2e73f69fc9354641ad0c4dcc62ba2a931290dba2a3b9e4540edf0dc2931331d70ebf62b26

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
a95a0a3fc585d8bd60e031787c35e0cd

SHA1
0b06962bc437d91d1dfdbda551e7b8b2172536fa

SHA256
c9bb8d7c11ad9083ed0d8275a49ca872c83188a361c1020b73fc3f486ca96a50

SHA512
ec981e981f92d0499926b9a198554e025edd37b9c52be0f1de8d36c2e73f69fc9354641ad0c4dcc62ba2a931290dba2a3b9e4540edf0dc2931331d70ebf62b26

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
a95a0a3fc585d8bd60e031787c35e0cd

SHA1
0b06962bc437d91d1dfdbda551e7b8b2172536fa

SHA256
c9bb8d7c11ad9083ed0d8275a49ca872c83188a361c1020b73fc3f486ca96a50

SHA512
ec981e981f92d0499926b9a198554e025edd37b9c52be0f1de8d36c2e73f69fc9354641ad0c4dcc62ba2a931290dba2a3b9e4540edf0dc2931331d70ebf62b26

Download Submit
memory/1560-54-0x0000000076911000-0x0000000076913000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads