sakula | 04f48a6d3ab5e7a3d39c2ebc66bbc3acbfd24f286c6d26db47789d73bbbcdca4

General

Target

04f48a6d3ab5e7a3d39c2ebc66bbc3acbfd24f286c6d26db47789d73bbbcdca4.exe
Size

58KB
MD5

003b30373ad92f672b8dcd3c4e21341e
SHA1

98006de89f6bd37914552d855a2818d0514bce89
SHA256

04f48a6d3ab5e7a3d39c2ebc66bbc3acbfd24f286c6d26db47789d73bbbcdca4
SHA512

dad5c4f1205cf5e0f810e1c6ddadbe8e7ba55628cb8707615974814bce5508cc9340dbc3adf5a7d99f6314b15dec39c7fe53b7c0a90d12e86f786ce365b694d1

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1876 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

964 cmd.exe

pid	process
1876	MediaCenter.exe

pid	process
964	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

04f48a6d3ab5e7a3d39c2ebc66bbc3acbfd24f286c6d26db47789d73bbbcdca4.exe

pid	process
528	04f48a6d3ab5e7a3d39c2ebc66bbc3acbfd24f286c6d26db47789d73bbbcdca4.exe
528	04f48a6d3ab5e7a3d39c2ebc66bbc3acbfd24f286c6d26db47789d73bbbcdca4.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

04f48a6d3ab5e7a3d39c2ebc66bbc3acbfd24f286c6d26db47789d73bbbcdca4.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	04f48a6d3ab5e7a3d39c2ebc66bbc3acbfd24f286c6d26db47789d73bbbcdca4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1824 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

04f48a6d3ab5e7a3d39c2ebc66bbc3acbfd24f286c6d26db47789d73bbbcdca4.exe

description pid process

Token: SeIncBasePriorityPrivilege 528 04f48a6d3ab5e7a3d39c2ebc66bbc3acbfd24f286c6d26db47789d73bbbcdca4.exe

pid	process
1824	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	528	04f48a6d3ab5e7a3d39c2ebc66bbc3acbfd24f286c6d26db47789d73bbbcdca4.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

04f48a6d3ab5e7a3d39c2ebc66bbc3acbfd24f286c6d26db47789d73bbbcdca4.execmd.exe

description	pid	process	target process
PID 528 wrote to memory of 1876	528	04f48a6d3ab5e7a3d39c2ebc66bbc3acbfd24f286c6d26db47789d73bbbcdca4.exe	MediaCenter.exe
PID 528 wrote to memory of 1876	528	04f48a6d3ab5e7a3d39c2ebc66bbc3acbfd24f286c6d26db47789d73bbbcdca4.exe	MediaCenter.exe
PID 528 wrote to memory of 1876	528	04f48a6d3ab5e7a3d39c2ebc66bbc3acbfd24f286c6d26db47789d73bbbcdca4.exe	MediaCenter.exe
PID 528 wrote to memory of 1876	528	04f48a6d3ab5e7a3d39c2ebc66bbc3acbfd24f286c6d26db47789d73bbbcdca4.exe	MediaCenter.exe
PID 528 wrote to memory of 964	528	04f48a6d3ab5e7a3d39c2ebc66bbc3acbfd24f286c6d26db47789d73bbbcdca4.exe	cmd.exe
PID 528 wrote to memory of 964	528	04f48a6d3ab5e7a3d39c2ebc66bbc3acbfd24f286c6d26db47789d73bbbcdca4.exe	cmd.exe
PID 528 wrote to memory of 964	528	04f48a6d3ab5e7a3d39c2ebc66bbc3acbfd24f286c6d26db47789d73bbbcdca4.exe	cmd.exe
PID 528 wrote to memory of 964	528	04f48a6d3ab5e7a3d39c2ebc66bbc3acbfd24f286c6d26db47789d73bbbcdca4.exe	cmd.exe
PID 964 wrote to memory of 1824	964	cmd.exe	PING.EXE
PID 964 wrote to memory of 1824	964	cmd.exe	PING.EXE
PID 964 wrote to memory of 1824	964	cmd.exe	PING.EXE
PID 964 wrote to memory of 1824	964	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\04f48a6d3ab5e7a3d39c2ebc66bbc3acbfd24f286c6d26db47789d73bbbcdca4.exe
"C:\Users\Admin\AppData\Local\Temp\04f48a6d3ab5e7a3d39c2ebc66bbc3acbfd24f286c6d26db47789d73bbbcdca4.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:528

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1876

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\04f48a6d3ab5e7a3d39c2ebc66bbc3acbfd24f286c6d26db47789d73bbbcdca4.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:964

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1824

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
e7822590d5d30da4cc5948db575b002a

SHA1
2f450a1fbafa6da7c854b812fe4a7d7163b1e8b9

SHA256
55fb45c4eba29c1ee3da0aa1391e7f1602d6db5aa970e068631517a4e9568438

SHA512
d4373fdad911ddd399e26c233569e7c116cbb7b3c9d09ce5fa7fa2cc21b8682b675dc42e6d0c41e7f4de68002c561ec504a339d7a34946dd2285f3f8f4c24459

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
e7822590d5d30da4cc5948db575b002a

SHA1
2f450a1fbafa6da7c854b812fe4a7d7163b1e8b9

SHA256
55fb45c4eba29c1ee3da0aa1391e7f1602d6db5aa970e068631517a4e9568438

SHA512
d4373fdad911ddd399e26c233569e7c116cbb7b3c9d09ce5fa7fa2cc21b8682b675dc42e6d0c41e7f4de68002c561ec504a339d7a34946dd2285f3f8f4c24459

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
e7822590d5d30da4cc5948db575b002a

SHA1
2f450a1fbafa6da7c854b812fe4a7d7163b1e8b9

SHA256
55fb45c4eba29c1ee3da0aa1391e7f1602d6db5aa970e068631517a4e9568438

SHA512
d4373fdad911ddd399e26c233569e7c116cbb7b3c9d09ce5fa7fa2cc21b8682b675dc42e6d0c41e7f4de68002c561ec504a339d7a34946dd2285f3f8f4c24459

Download Submit
memory/528-54-0x0000000076121000-0x0000000076123000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads