sakula | 04febef830732ae91908ad41a55c2ac8c8972cf0d584411afd7d7fc22c8da5c6

General

Target

04febef830732ae91908ad41a55c2ac8c8972cf0d584411afd7d7fc22c8da5c6.exe
Size

191KB
MD5

fb879a17cc26940b811ddef9fee58595
SHA1

f448ab673d73f6f9a065d1150c466e526443ad22
SHA256

04febef830732ae91908ad41a55c2ac8c8972cf0d584411afd7d7fc22c8da5c6
SHA512

0483141027c7fcbc89fb75e0e9c1532fd53496f9a98a429e0222141ec522ff16f11b6022b8613b20146548dc0e7603b7a5bcf2e11379d1f03934627a45b80c13

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula Payload 3 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula

Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

964 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

820 cmd.exe

pid	process
964	MediaCenter.exe

pid	process
820	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

04febef830732ae91908ad41a55c2ac8c8972cf0d584411afd7d7fc22c8da5c6.exe

pid	process
1536	04febef830732ae91908ad41a55c2ac8c8972cf0d584411afd7d7fc22c8da5c6.exe
1536	04febef830732ae91908ad41a55c2ac8c8972cf0d584411afd7d7fc22c8da5c6.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

04febef830732ae91908ad41a55c2ac8c8972cf0d584411afd7d7fc22c8da5c6.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	04febef830732ae91908ad41a55c2ac8c8972cf0d584411afd7d7fc22c8da5c6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

956 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

04febef830732ae91908ad41a55c2ac8c8972cf0d584411afd7d7fc22c8da5c6.exe

description pid process

Token: SeIncBasePriorityPrivilege 1536 04febef830732ae91908ad41a55c2ac8c8972cf0d584411afd7d7fc22c8da5c6.exe

pid	process
956	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1536	04febef830732ae91908ad41a55c2ac8c8972cf0d584411afd7d7fc22c8da5c6.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

04febef830732ae91908ad41a55c2ac8c8972cf0d584411afd7d7fc22c8da5c6.execmd.exe

description	pid	process	target process
PID 1536 wrote to memory of 964	1536	04febef830732ae91908ad41a55c2ac8c8972cf0d584411afd7d7fc22c8da5c6.exe	MediaCenter.exe
PID 1536 wrote to memory of 964	1536	04febef830732ae91908ad41a55c2ac8c8972cf0d584411afd7d7fc22c8da5c6.exe	MediaCenter.exe
PID 1536 wrote to memory of 964	1536	04febef830732ae91908ad41a55c2ac8c8972cf0d584411afd7d7fc22c8da5c6.exe	MediaCenter.exe
PID 1536 wrote to memory of 964	1536	04febef830732ae91908ad41a55c2ac8c8972cf0d584411afd7d7fc22c8da5c6.exe	MediaCenter.exe
PID 1536 wrote to memory of 820	1536	04febef830732ae91908ad41a55c2ac8c8972cf0d584411afd7d7fc22c8da5c6.exe	cmd.exe
PID 1536 wrote to memory of 820	1536	04febef830732ae91908ad41a55c2ac8c8972cf0d584411afd7d7fc22c8da5c6.exe	cmd.exe
PID 1536 wrote to memory of 820	1536	04febef830732ae91908ad41a55c2ac8c8972cf0d584411afd7d7fc22c8da5c6.exe	cmd.exe
PID 1536 wrote to memory of 820	1536	04febef830732ae91908ad41a55c2ac8c8972cf0d584411afd7d7fc22c8da5c6.exe	cmd.exe
PID 820 wrote to memory of 956	820	cmd.exe	PING.EXE
PID 820 wrote to memory of 956	820	cmd.exe	PING.EXE
PID 820 wrote to memory of 956	820	cmd.exe	PING.EXE
PID 820 wrote to memory of 956	820	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\04febef830732ae91908ad41a55c2ac8c8972cf0d584411afd7d7fc22c8da5c6.exe
"C:\Users\Admin\AppData\Local\Temp\04febef830732ae91908ad41a55c2ac8c8972cf0d584411afd7d7fc22c8da5c6.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1536

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:964

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\04febef830732ae91908ad41a55c2ac8c8972cf0d584411afd7d7fc22c8da5c6.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:820

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:956

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
b6bcb5fa7944dd9ef49744220f0227c8

SHA1
d1bf8c4260ba41573aae7b4d65965ea0e67c8159

SHA256
3fdf2576e0855645a1969c755dbd6e4cf69c718746a847c6168889631cc3a147

SHA512
03e9afcf4e4362ca039b6de8acab7836c339d000d6fa1f16fa77de5a661ae526dc4a962c8bd847eab9777c6a7c7b84010ff78fc2983de6a4373f0bfedf10cf32

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
b6bcb5fa7944dd9ef49744220f0227c8

SHA1
d1bf8c4260ba41573aae7b4d65965ea0e67c8159

SHA256
3fdf2576e0855645a1969c755dbd6e4cf69c718746a847c6168889631cc3a147

SHA512
03e9afcf4e4362ca039b6de8acab7836c339d000d6fa1f16fa77de5a661ae526dc4a962c8bd847eab9777c6a7c7b84010ff78fc2983de6a4373f0bfedf10cf32

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
b6bcb5fa7944dd9ef49744220f0227c8

SHA1
d1bf8c4260ba41573aae7b4d65965ea0e67c8159

SHA256
3fdf2576e0855645a1969c755dbd6e4cf69c718746a847c6168889631cc3a147

SHA512
03e9afcf4e4362ca039b6de8acab7836c339d000d6fa1f16fa77de5a661ae526dc4a962c8bd847eab9777c6a7c7b84010ff78fc2983de6a4373f0bfedf10cf32

Download Submit
memory/1536-54-0x0000000076C91000-0x0000000076C93000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads