sakula | 04a2e3b5d9f94300d1cc791649fa3d903edef79b7efe0207ade15755a91dfe2c

General

Target

04a2e3b5d9f94300d1cc791649fa3d903edef79b7efe0207ade15755a91dfe2c.exe
Size

216KB
MD5

6cb110e70e3a7d6d2d69a9bf829d24dd
SHA1

4552f20f64f73da4d51597950611b4c72dcf8716
SHA256

04a2e3b5d9f94300d1cc791649fa3d903edef79b7efe0207ade15755a91dfe2c
SHA512

3e4fb9a9c5729e23aceefca097a53824dbdffb9a3bc7ea0a6c4f444d7156257f3f1615a61b0bc47ab7d8e20b48a4ccb4fb9bd6db508d735f55fd9a1aa657743d

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula Payload 4 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
behavioral2/memory/2996-135-0x0000000000400000-0x0000000000420000-memory.dmp	family_sakula
behavioral2/memory/3932-136-0x0000000000400000-0x0000000000420000-memory.dmp	family_sakula

Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

3932 MediaCenter.exe

pid	process
3932	MediaCenter.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

04a2e3b5d9f94300d1cc791649fa3d903edef79b7efe0207ade15755a91dfe2c.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	04a2e3b5d9f94300d1cc791649fa3d903edef79b7efe0207ade15755a91dfe2c.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

04a2e3b5d9f94300d1cc791649fa3d903edef79b7efe0207ade15755a91dfe2c.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	04a2e3b5d9f94300d1cc791649fa3d903edef79b7efe0207ade15755a91dfe2c.exe

Drops file in Windows directory 8 IoCs

Processes:

svchost.exeTiWorker.exe

description	ioc	process
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TiWorker.exe
File opened for modification	C:\Windows\WinSxS\pending.xml	TiWorker.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2088 PING.EXE

pid	process
2088	PING.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

svchost.exe04a2e3b5d9f94300d1cc791649fa3d903edef79b7efe0207ade15755a91dfe2c.exeTiWorker.exe

description	pid	process
Token: SeShutdownPrivilege	3132	svchost.exe
Token: SeCreatePagefilePrivilege	3132	svchost.exe
Token: SeShutdownPrivilege	3132	svchost.exe
Token: SeCreatePagefilePrivilege	3132	svchost.exe
Token: SeShutdownPrivilege	3132	svchost.exe
Token: SeCreatePagefilePrivilege	3132	svchost.exe
Token: SeIncBasePriorityPrivilege	2996	04a2e3b5d9f94300d1cc791649fa3d903edef79b7efe0207ade15755a91dfe2c.exe
Token: SeSecurityPrivilege	1240	TiWorker.exe
Token: SeRestorePrivilege	1240	TiWorker.exe
Token: SeBackupPrivilege	1240	TiWorker.exe
Token: SeBackupPrivilege	1240	TiWorker.exe
Token: SeRestorePrivilege	1240	TiWorker.exe
Token: SeSecurityPrivilege	1240	TiWorker.exe
Token: SeBackupPrivilege	1240	TiWorker.exe
Token: SeRestorePrivilege	1240	TiWorker.exe
Token: SeSecurityPrivilege	1240	TiWorker.exe
Token: SeBackupPrivilege	1240	TiWorker.exe
Token: SeRestorePrivilege	1240	TiWorker.exe
Token: SeSecurityPrivilege	1240	TiWorker.exe
Token: SeBackupPrivilege	1240	TiWorker.exe
Token: SeRestorePrivilege	1240	TiWorker.exe
Token: SeSecurityPrivilege	1240	TiWorker.exe
Token: SeBackupPrivilege	1240	TiWorker.exe
Token: SeRestorePrivilege	1240	TiWorker.exe
Token: SeSecurityPrivilege	1240	TiWorker.exe
Token: SeBackupPrivilege	1240	TiWorker.exe
Token: SeRestorePrivilege	1240	TiWorker.exe
Token: SeSecurityPrivilege	1240	TiWorker.exe
Token: SeBackupPrivilege	1240	TiWorker.exe
Token: SeRestorePrivilege	1240	TiWorker.exe
Token: SeSecurityPrivilege	1240	TiWorker.exe
Token: SeBackupPrivilege	1240	TiWorker.exe
Token: SeRestorePrivilege	1240	TiWorker.exe
Token: SeSecurityPrivilege	1240	TiWorker.exe
Token: SeBackupPrivilege	1240	TiWorker.exe
Token: SeRestorePrivilege	1240	TiWorker.exe
Token: SeSecurityPrivilege	1240	TiWorker.exe
Token: SeBackupPrivilege	1240	TiWorker.exe
Token: SeRestorePrivilege	1240	TiWorker.exe
Token: SeSecurityPrivilege	1240	TiWorker.exe
Token: SeBackupPrivilege	1240	TiWorker.exe
Token: SeRestorePrivilege	1240	TiWorker.exe
Token: SeSecurityPrivilege	1240	TiWorker.exe
Token: SeBackupPrivilege	1240	TiWorker.exe
Token: SeRestorePrivilege	1240	TiWorker.exe
Token: SeSecurityPrivilege	1240	TiWorker.exe
Token: SeBackupPrivilege	1240	TiWorker.exe
Token: SeRestorePrivilege	1240	TiWorker.exe
Token: SeSecurityPrivilege	1240	TiWorker.exe
Token: SeBackupPrivilege	1240	TiWorker.exe
Token: SeRestorePrivilege	1240	TiWorker.exe
Token: SeSecurityPrivilege	1240	TiWorker.exe
Token: SeBackupPrivilege	1240	TiWorker.exe
Token: SeRestorePrivilege	1240	TiWorker.exe
Token: SeSecurityPrivilege	1240	TiWorker.exe
Token: SeBackupPrivilege	1240	TiWorker.exe
Token: SeRestorePrivilege	1240	TiWorker.exe
Token: SeSecurityPrivilege	1240	TiWorker.exe
Token: SeBackupPrivilege	1240	TiWorker.exe
Token: SeRestorePrivilege	1240	TiWorker.exe
Token: SeSecurityPrivilege	1240	TiWorker.exe
Token: SeBackupPrivilege	1240	TiWorker.exe
Token: SeRestorePrivilege	1240	TiWorker.exe
Token: SeSecurityPrivilege	1240	TiWorker.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

04a2e3b5d9f94300d1cc791649fa3d903edef79b7efe0207ade15755a91dfe2c.execmd.exe

description	pid	process	target process
PID 2996 wrote to memory of 3932	2996	04a2e3b5d9f94300d1cc791649fa3d903edef79b7efe0207ade15755a91dfe2c.exe	MediaCenter.exe
PID 2996 wrote to memory of 3932	2996	04a2e3b5d9f94300d1cc791649fa3d903edef79b7efe0207ade15755a91dfe2c.exe	MediaCenter.exe
PID 2996 wrote to memory of 3932	2996	04a2e3b5d9f94300d1cc791649fa3d903edef79b7efe0207ade15755a91dfe2c.exe	MediaCenter.exe
PID 2996 wrote to memory of 644	2996	04a2e3b5d9f94300d1cc791649fa3d903edef79b7efe0207ade15755a91dfe2c.exe	cmd.exe
PID 2996 wrote to memory of 644	2996	04a2e3b5d9f94300d1cc791649fa3d903edef79b7efe0207ade15755a91dfe2c.exe	cmd.exe
PID 2996 wrote to memory of 644	2996	04a2e3b5d9f94300d1cc791649fa3d903edef79b7efe0207ade15755a91dfe2c.exe	cmd.exe
PID 644 wrote to memory of 2088	644	cmd.exe	PING.EXE
PID 644 wrote to memory of 2088	644	cmd.exe	PING.EXE
PID 644 wrote to memory of 2088	644	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\04a2e3b5d9f94300d1cc791649fa3d903edef79b7efe0207ade15755a91dfe2c.exe
"C:\Users\Admin\AppData\Local\Temp\04a2e3b5d9f94300d1cc791649fa3d903edef79b7efe0207ade15755a91dfe2c.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2996

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:3932

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\04a2e3b5d9f94300d1cc791649fa3d903edef79b7efe0207ade15755a91dfe2c.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:644

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:2088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3132

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1240

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
4c0115ee2de485e63d99f392071d6244

SHA1
e6e2270b223a8b17755d1a99534df2a0646075b8

SHA256
4556549e068cd3d6be4680bc0fd9e42b0bc4f9053b2c79cd5b48c229bc9f4773

SHA512
169023d6314e2554b61c0c6f72d9a2bbc68ac3bf5082905dc53a1af213d3e77ef7b129578d33212f8158f662e3c305be5d568815d78e47689da62b09fb118cc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
4c0115ee2de485e63d99f392071d6244

SHA1
e6e2270b223a8b17755d1a99534df2a0646075b8

SHA256
4556549e068cd3d6be4680bc0fd9e42b0bc4f9053b2c79cd5b48c229bc9f4773

SHA512
169023d6314e2554b61c0c6f72d9a2bbc68ac3bf5082905dc53a1af213d3e77ef7b129578d33212f8158f662e3c305be5d568815d78e47689da62b09fb118cc9

Download Submit
memory/2996-135-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3132-132-0x0000025CC0990000-0x0000025CC09A0000-memory.dmp

Filesize
64KB

Download
memory/3132-133-0x0000025CC1160000-0x0000025CC1170000-memory.dmp

Filesize
64KB

Download
memory/3132-134-0x0000025CC3D70000-0x0000025CC3D74000-memory.dmp

Filesize
16KB

Download
memory/3932-136-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads