sakula | 028824708db6c402fcf4e56800ba7ee2650283f87c2415d4ad18665b0652ad9a

General

Target

028824708db6c402fcf4e56800ba7ee2650283f87c2415d4ad18665b0652ad9a.exe
Size

99KB
MD5

c93eacb10a0f98cc12f18855f90ad3ec
SHA1

99b65354d74726465fd59b3a83102c2a3b2e47b2
SHA256

028824708db6c402fcf4e56800ba7ee2650283f87c2415d4ad18665b0652ad9a
SHA512

be73e0769aa33a582926335ec0387e8a995719702a595a71b37728bcd830d37c2844e4cc88454344e1b2cf9d3efa1b5e2ba7d3db661e5d9a67cced9ac0ccff28

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula Payload 3 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula

Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1344 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

968 cmd.exe

pid	process
1344	MediaCenter.exe

pid	process
968	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

028824708db6c402fcf4e56800ba7ee2650283f87c2415d4ad18665b0652ad9a.exe

pid	process
1632	028824708db6c402fcf4e56800ba7ee2650283f87c2415d4ad18665b0652ad9a.exe
1632	028824708db6c402fcf4e56800ba7ee2650283f87c2415d4ad18665b0652ad9a.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

028824708db6c402fcf4e56800ba7ee2650283f87c2415d4ad18665b0652ad9a.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	028824708db6c402fcf4e56800ba7ee2650283f87c2415d4ad18665b0652ad9a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1152 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

028824708db6c402fcf4e56800ba7ee2650283f87c2415d4ad18665b0652ad9a.exe

description pid process

Token: SeIncBasePriorityPrivilege 1632 028824708db6c402fcf4e56800ba7ee2650283f87c2415d4ad18665b0652ad9a.exe

pid	process
1152	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1632	028824708db6c402fcf4e56800ba7ee2650283f87c2415d4ad18665b0652ad9a.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

028824708db6c402fcf4e56800ba7ee2650283f87c2415d4ad18665b0652ad9a.execmd.exe

description	pid	process	target process
PID 1632 wrote to memory of 1344	1632	028824708db6c402fcf4e56800ba7ee2650283f87c2415d4ad18665b0652ad9a.exe	MediaCenter.exe
PID 1632 wrote to memory of 1344	1632	028824708db6c402fcf4e56800ba7ee2650283f87c2415d4ad18665b0652ad9a.exe	MediaCenter.exe
PID 1632 wrote to memory of 1344	1632	028824708db6c402fcf4e56800ba7ee2650283f87c2415d4ad18665b0652ad9a.exe	MediaCenter.exe
PID 1632 wrote to memory of 1344	1632	028824708db6c402fcf4e56800ba7ee2650283f87c2415d4ad18665b0652ad9a.exe	MediaCenter.exe
PID 1632 wrote to memory of 968	1632	028824708db6c402fcf4e56800ba7ee2650283f87c2415d4ad18665b0652ad9a.exe	cmd.exe
PID 1632 wrote to memory of 968	1632	028824708db6c402fcf4e56800ba7ee2650283f87c2415d4ad18665b0652ad9a.exe	cmd.exe
PID 1632 wrote to memory of 968	1632	028824708db6c402fcf4e56800ba7ee2650283f87c2415d4ad18665b0652ad9a.exe	cmd.exe
PID 1632 wrote to memory of 968	1632	028824708db6c402fcf4e56800ba7ee2650283f87c2415d4ad18665b0652ad9a.exe	cmd.exe
PID 968 wrote to memory of 1152	968	cmd.exe	PING.EXE
PID 968 wrote to memory of 1152	968	cmd.exe	PING.EXE
PID 968 wrote to memory of 1152	968	cmd.exe	PING.EXE
PID 968 wrote to memory of 1152	968	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\028824708db6c402fcf4e56800ba7ee2650283f87c2415d4ad18665b0652ad9a.exe
"C:\Users\Admin\AppData\Local\Temp\028824708db6c402fcf4e56800ba7ee2650283f87c2415d4ad18665b0652ad9a.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1632

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1344

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\028824708db6c402fcf4e56800ba7ee2650283f87c2415d4ad18665b0652ad9a.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:968

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1152

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
3fd67f3eb8ce3cd98211ee60e704ff5e

SHA1
618902298b1a518a7818131cbf8788745a01ea24

SHA256
366b6260cb2306525448603fe183caf9e3aeb2a4d891cd6d32ebf4d4c4ae236c

SHA512
9b3e6677fd1bf2e905daa6815214e252939808e458d146613273931718da37a227e22e37d1391120c3b4cb71ff0d8c5f6cd5dd91a5fd79d34174fe5466902181

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
3fd67f3eb8ce3cd98211ee60e704ff5e

SHA1
618902298b1a518a7818131cbf8788745a01ea24

SHA256
366b6260cb2306525448603fe183caf9e3aeb2a4d891cd6d32ebf4d4c4ae236c

SHA512
9b3e6677fd1bf2e905daa6815214e252939808e458d146613273931718da37a227e22e37d1391120c3b4cb71ff0d8c5f6cd5dd91a5fd79d34174fe5466902181

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
3fd67f3eb8ce3cd98211ee60e704ff5e

SHA1
618902298b1a518a7818131cbf8788745a01ea24

SHA256
366b6260cb2306525448603fe183caf9e3aeb2a4d891cd6d32ebf4d4c4ae236c

SHA512
9b3e6677fd1bf2e905daa6815214e252939808e458d146613273931718da37a227e22e37d1391120c3b4cb71ff0d8c5f6cd5dd91a5fd79d34174fe5466902181

Download Submit
memory/1632-55-0x00000000763F1000-0x00000000763F3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads