sakula | 04f3531c117d1a91041bc49d37bc3e6e7ccf98fd3ff6194b97ae8c56993c14df

General

Target

04f3531c117d1a91041bc49d37bc3e6e7ccf98fd3ff6194b97ae8c56993c14df.exe
Size

80KB
MD5

199115873ff5a6cfa8932845696d56d6
SHA1

36ad25e6b37878aba108d43e8dbe2890910956e5
SHA256

04f3531c117d1a91041bc49d37bc3e6e7ccf98fd3ff6194b97ae8c56993c14df
SHA512

c44de619b5645b92b26e6af027e09b00c326ccaf8e102a15071dc7a74d67741d3ac180a9806bbb6eab70dc45fe8cc155dd2bdbefa50434c130927f136026e36b

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula Payload 3 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula

Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1816 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1992 cmd.exe

pid	process
1816	MediaCenter.exe

pid	process
1992	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

04f3531c117d1a91041bc49d37bc3e6e7ccf98fd3ff6194b97ae8c56993c14df.exe

pid	process
1864	04f3531c117d1a91041bc49d37bc3e6e7ccf98fd3ff6194b97ae8c56993c14df.exe
1864	04f3531c117d1a91041bc49d37bc3e6e7ccf98fd3ff6194b97ae8c56993c14df.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

04f3531c117d1a91041bc49d37bc3e6e7ccf98fd3ff6194b97ae8c56993c14df.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	04f3531c117d1a91041bc49d37bc3e6e7ccf98fd3ff6194b97ae8c56993c14df.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1984 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

04f3531c117d1a91041bc49d37bc3e6e7ccf98fd3ff6194b97ae8c56993c14df.exe

description pid process

Token: SeIncBasePriorityPrivilege 1864 04f3531c117d1a91041bc49d37bc3e6e7ccf98fd3ff6194b97ae8c56993c14df.exe

pid	process
1984	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1864	04f3531c117d1a91041bc49d37bc3e6e7ccf98fd3ff6194b97ae8c56993c14df.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

04f3531c117d1a91041bc49d37bc3e6e7ccf98fd3ff6194b97ae8c56993c14df.execmd.exe

description	pid	process	target process
PID 1864 wrote to memory of 1816	1864	04f3531c117d1a91041bc49d37bc3e6e7ccf98fd3ff6194b97ae8c56993c14df.exe	MediaCenter.exe
PID 1864 wrote to memory of 1816	1864	04f3531c117d1a91041bc49d37bc3e6e7ccf98fd3ff6194b97ae8c56993c14df.exe	MediaCenter.exe
PID 1864 wrote to memory of 1816	1864	04f3531c117d1a91041bc49d37bc3e6e7ccf98fd3ff6194b97ae8c56993c14df.exe	MediaCenter.exe
PID 1864 wrote to memory of 1816	1864	04f3531c117d1a91041bc49d37bc3e6e7ccf98fd3ff6194b97ae8c56993c14df.exe	MediaCenter.exe
PID 1864 wrote to memory of 1992	1864	04f3531c117d1a91041bc49d37bc3e6e7ccf98fd3ff6194b97ae8c56993c14df.exe	cmd.exe
PID 1864 wrote to memory of 1992	1864	04f3531c117d1a91041bc49d37bc3e6e7ccf98fd3ff6194b97ae8c56993c14df.exe	cmd.exe
PID 1864 wrote to memory of 1992	1864	04f3531c117d1a91041bc49d37bc3e6e7ccf98fd3ff6194b97ae8c56993c14df.exe	cmd.exe
PID 1864 wrote to memory of 1992	1864	04f3531c117d1a91041bc49d37bc3e6e7ccf98fd3ff6194b97ae8c56993c14df.exe	cmd.exe
PID 1992 wrote to memory of 1984	1992	cmd.exe	PING.EXE
PID 1992 wrote to memory of 1984	1992	cmd.exe	PING.EXE
PID 1992 wrote to memory of 1984	1992	cmd.exe	PING.EXE
PID 1992 wrote to memory of 1984	1992	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\04f3531c117d1a91041bc49d37bc3e6e7ccf98fd3ff6194b97ae8c56993c14df.exe
"C:\Users\Admin\AppData\Local\Temp\04f3531c117d1a91041bc49d37bc3e6e7ccf98fd3ff6194b97ae8c56993c14df.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1864

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1816

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\04f3531c117d1a91041bc49d37bc3e6e7ccf98fd3ff6194b97ae8c56993c14df.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1992

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1984

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
1996c511e92a0086e2465f87d93efcf0

SHA1
68af036d8a24de2ead8f7384258e836a89c90e0d

SHA256
4ce0ac08ecf8819740a47d2f7d63089abadc4a7822c8da920bbf1823c0eeda50

SHA512
465f80aa31cc6c847e6a7560ae6dbf01d9d06581139e1a2b029114f6b92d9c5ad047baafb16f712cd921b8b29464527be978b21631053a92ad291799e25aa3c3

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
1996c511e92a0086e2465f87d93efcf0

SHA1
68af036d8a24de2ead8f7384258e836a89c90e0d

SHA256
4ce0ac08ecf8819740a47d2f7d63089abadc4a7822c8da920bbf1823c0eeda50

SHA512
465f80aa31cc6c847e6a7560ae6dbf01d9d06581139e1a2b029114f6b92d9c5ad047baafb16f712cd921b8b29464527be978b21631053a92ad291799e25aa3c3

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
1996c511e92a0086e2465f87d93efcf0

SHA1
68af036d8a24de2ead8f7384258e836a89c90e0d

SHA256
4ce0ac08ecf8819740a47d2f7d63089abadc4a7822c8da920bbf1823c0eeda50

SHA512
465f80aa31cc6c847e6a7560ae6dbf01d9d06581139e1a2b029114f6b92d9c5ad047baafb16f712cd921b8b29464527be978b21631053a92ad291799e25aa3c3

Download Submit
memory/1864-54-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads