sakula | 0506462839f8a49068ec82421cc9cf118005708da5b14b5cfe1a201223bdf22f

General

Target

0506462839f8a49068ec82421cc9cf118005708da5b14b5cfe1a201223bdf22f.exe
Size

192KB
MD5

feb933eb1add8e4280d5212cd0578f48
SHA1

b9eb2f6aafc3eef61031f217f710aed39bf6429c
SHA256

0506462839f8a49068ec82421cc9cf118005708da5b14b5cfe1a201223bdf22f
SHA512

5d292a952d8717a4889ec571abdc0dda2645cb41883fba598055ce51a89263ab8a63d735d8df4cc98f616f2d43d0fdae67e073b0fcebaccb1d4f1321358ef039

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula Payload 3 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula

Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

948 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1796 cmd.exe

pid	process
948	MediaCenter.exe

pid	process
1796	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

0506462839f8a49068ec82421cc9cf118005708da5b14b5cfe1a201223bdf22f.exe

pid	process
1768	0506462839f8a49068ec82421cc9cf118005708da5b14b5cfe1a201223bdf22f.exe
1768	0506462839f8a49068ec82421cc9cf118005708da5b14b5cfe1a201223bdf22f.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

0506462839f8a49068ec82421cc9cf118005708da5b14b5cfe1a201223bdf22f.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	0506462839f8a49068ec82421cc9cf118005708da5b14b5cfe1a201223bdf22f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1572 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0506462839f8a49068ec82421cc9cf118005708da5b14b5cfe1a201223bdf22f.exe

description pid process

Token: SeIncBasePriorityPrivilege 1768 0506462839f8a49068ec82421cc9cf118005708da5b14b5cfe1a201223bdf22f.exe

pid	process
1572	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1768	0506462839f8a49068ec82421cc9cf118005708da5b14b5cfe1a201223bdf22f.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

0506462839f8a49068ec82421cc9cf118005708da5b14b5cfe1a201223bdf22f.execmd.exe

description	pid	process	target process
PID 1768 wrote to memory of 948	1768	0506462839f8a49068ec82421cc9cf118005708da5b14b5cfe1a201223bdf22f.exe	MediaCenter.exe
PID 1768 wrote to memory of 948	1768	0506462839f8a49068ec82421cc9cf118005708da5b14b5cfe1a201223bdf22f.exe	MediaCenter.exe
PID 1768 wrote to memory of 948	1768	0506462839f8a49068ec82421cc9cf118005708da5b14b5cfe1a201223bdf22f.exe	MediaCenter.exe
PID 1768 wrote to memory of 948	1768	0506462839f8a49068ec82421cc9cf118005708da5b14b5cfe1a201223bdf22f.exe	MediaCenter.exe
PID 1768 wrote to memory of 1796	1768	0506462839f8a49068ec82421cc9cf118005708da5b14b5cfe1a201223bdf22f.exe	cmd.exe
PID 1768 wrote to memory of 1796	1768	0506462839f8a49068ec82421cc9cf118005708da5b14b5cfe1a201223bdf22f.exe	cmd.exe
PID 1768 wrote to memory of 1796	1768	0506462839f8a49068ec82421cc9cf118005708da5b14b5cfe1a201223bdf22f.exe	cmd.exe
PID 1768 wrote to memory of 1796	1768	0506462839f8a49068ec82421cc9cf118005708da5b14b5cfe1a201223bdf22f.exe	cmd.exe
PID 1796 wrote to memory of 1572	1796	cmd.exe	PING.EXE
PID 1796 wrote to memory of 1572	1796	cmd.exe	PING.EXE
PID 1796 wrote to memory of 1572	1796	cmd.exe	PING.EXE
PID 1796 wrote to memory of 1572	1796	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\0506462839f8a49068ec82421cc9cf118005708da5b14b5cfe1a201223bdf22f.exe
"C:\Users\Admin\AppData\Local\Temp\0506462839f8a49068ec82421cc9cf118005708da5b14b5cfe1a201223bdf22f.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1768

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:948

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\0506462839f8a49068ec82421cc9cf118005708da5b14b5cfe1a201223bdf22f.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1796

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1572

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
8f99335ab716bb754bc64e87815a882a

SHA1
aa0f53898ee506dd99db4c1c41b79d89716f4cce

SHA256
69736e02c5ca5c3cf3ed20d11253eb2f46063f26e998704c082c63f9af76ffaf

SHA512
d184cda63a04e571b0ffe3f4d9d05dedfbf180239ff251708285b66f22586d5d8423eafb7aec383a9621a11eae47b8ca2c51d2952859a6ef0345fffd85fdf48b

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
8f99335ab716bb754bc64e87815a882a

SHA1
aa0f53898ee506dd99db4c1c41b79d89716f4cce

SHA256
69736e02c5ca5c3cf3ed20d11253eb2f46063f26e998704c082c63f9af76ffaf

SHA512
d184cda63a04e571b0ffe3f4d9d05dedfbf180239ff251708285b66f22586d5d8423eafb7aec383a9621a11eae47b8ca2c51d2952859a6ef0345fffd85fdf48b

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
8f99335ab716bb754bc64e87815a882a

SHA1
aa0f53898ee506dd99db4c1c41b79d89716f4cce

SHA256
69736e02c5ca5c3cf3ed20d11253eb2f46063f26e998704c082c63f9af76ffaf

SHA512
d184cda63a04e571b0ffe3f4d9d05dedfbf180239ff251708285b66f22586d5d8423eafb7aec383a9621a11eae47b8ca2c51d2952859a6ef0345fffd85fdf48b

Download Submit
memory/1768-55-0x00000000762C1000-0x00000000762C3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads