sakula | 0276e4d5cf2514a2b01d98f36ac84eeef8c6d407400cbbc330bcf5770faf692c

General

Target

0276e4d5cf2514a2b01d98f36ac84eeef8c6d407400cbbc330bcf5770faf692c.exe
Size

60KB
MD5

6bcf49d8fa9052101e6746e7f19a4035
SHA1

b4b89bae8c661f1b2f502572b42ca9aa1efb2be9
SHA256

0276e4d5cf2514a2b01d98f36ac84eeef8c6d407400cbbc330bcf5770faf692c
SHA512

3a3c82f6eadf0dff94a394650983899bdbad6721c1482028aadfd2ff94e8adf8e658681924e721213aaf517a81221c8eee1e8ac02c2380813a3bede70ec94cb9

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1920 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1848 cmd.exe

pid	process
1920	MediaCenter.exe

pid	process
1848	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

0276e4d5cf2514a2b01d98f36ac84eeef8c6d407400cbbc330bcf5770faf692c.exe

pid	process
1668	0276e4d5cf2514a2b01d98f36ac84eeef8c6d407400cbbc330bcf5770faf692c.exe
1668	0276e4d5cf2514a2b01d98f36ac84eeef8c6d407400cbbc330bcf5770faf692c.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

0276e4d5cf2514a2b01d98f36ac84eeef8c6d407400cbbc330bcf5770faf692c.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	0276e4d5cf2514a2b01d98f36ac84eeef8c6d407400cbbc330bcf5770faf692c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1648 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0276e4d5cf2514a2b01d98f36ac84eeef8c6d407400cbbc330bcf5770faf692c.exe

description pid process

Token: SeIncBasePriorityPrivilege 1668 0276e4d5cf2514a2b01d98f36ac84eeef8c6d407400cbbc330bcf5770faf692c.exe

pid	process
1648	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1668	0276e4d5cf2514a2b01d98f36ac84eeef8c6d407400cbbc330bcf5770faf692c.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

0276e4d5cf2514a2b01d98f36ac84eeef8c6d407400cbbc330bcf5770faf692c.execmd.exe

description	pid	process	target process
PID 1668 wrote to memory of 1920	1668	0276e4d5cf2514a2b01d98f36ac84eeef8c6d407400cbbc330bcf5770faf692c.exe	MediaCenter.exe
PID 1668 wrote to memory of 1920	1668	0276e4d5cf2514a2b01d98f36ac84eeef8c6d407400cbbc330bcf5770faf692c.exe	MediaCenter.exe
PID 1668 wrote to memory of 1920	1668	0276e4d5cf2514a2b01d98f36ac84eeef8c6d407400cbbc330bcf5770faf692c.exe	MediaCenter.exe
PID 1668 wrote to memory of 1920	1668	0276e4d5cf2514a2b01d98f36ac84eeef8c6d407400cbbc330bcf5770faf692c.exe	MediaCenter.exe
PID 1668 wrote to memory of 1848	1668	0276e4d5cf2514a2b01d98f36ac84eeef8c6d407400cbbc330bcf5770faf692c.exe	cmd.exe
PID 1668 wrote to memory of 1848	1668	0276e4d5cf2514a2b01d98f36ac84eeef8c6d407400cbbc330bcf5770faf692c.exe	cmd.exe
PID 1668 wrote to memory of 1848	1668	0276e4d5cf2514a2b01d98f36ac84eeef8c6d407400cbbc330bcf5770faf692c.exe	cmd.exe
PID 1668 wrote to memory of 1848	1668	0276e4d5cf2514a2b01d98f36ac84eeef8c6d407400cbbc330bcf5770faf692c.exe	cmd.exe
PID 1848 wrote to memory of 1648	1848	cmd.exe	PING.EXE
PID 1848 wrote to memory of 1648	1848	cmd.exe	PING.EXE
PID 1848 wrote to memory of 1648	1848	cmd.exe	PING.EXE
PID 1848 wrote to memory of 1648	1848	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\0276e4d5cf2514a2b01d98f36ac84eeef8c6d407400cbbc330bcf5770faf692c.exe
"C:\Users\Admin\AppData\Local\Temp\0276e4d5cf2514a2b01d98f36ac84eeef8c6d407400cbbc330bcf5770faf692c.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1668

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1920

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\0276e4d5cf2514a2b01d98f36ac84eeef8c6d407400cbbc330bcf5770faf692c.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1848

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1648

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
ec1b8792ec05607ada7d8a60052c55ae

SHA1
876d8fbc37ef9510a2d3ab35c0c6d1d2b70494f1

SHA256
41dfa27c6165ff21195d3272643ec9a720aac03b025eb2fade913e82f843e5a3

SHA512
1b1203d7a757ab0be38405152c0cb856a506eaa2eb4294726b63b74766fa4571672ea2039c204801e01949b3f7c4ac9d24f2438977392471435d76a6c4d3d943

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
ec1b8792ec05607ada7d8a60052c55ae

SHA1
876d8fbc37ef9510a2d3ab35c0c6d1d2b70494f1

SHA256
41dfa27c6165ff21195d3272643ec9a720aac03b025eb2fade913e82f843e5a3

SHA512
1b1203d7a757ab0be38405152c0cb856a506eaa2eb4294726b63b74766fa4571672ea2039c204801e01949b3f7c4ac9d24f2438977392471435d76a6c4d3d943

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
ec1b8792ec05607ada7d8a60052c55ae

SHA1
876d8fbc37ef9510a2d3ab35c0c6d1d2b70494f1

SHA256
41dfa27c6165ff21195d3272643ec9a720aac03b025eb2fade913e82f843e5a3

SHA512
1b1203d7a757ab0be38405152c0cb856a506eaa2eb4294726b63b74766fa4571672ea2039c204801e01949b3f7c4ac9d24f2438977392471435d76a6c4d3d943

Download Submit
memory/1668-55-0x0000000075321000-0x0000000075323000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads