sakula | 0482b21c0db0db94a1b0552a232cc6598d34ec3010c2ddac3ad7cd4f28507044

General

Target

0482b21c0db0db94a1b0552a232cc6598d34ec3010c2ddac3ad7cd4f28507044.exe
Size

36KB
MD5

dc4b759374a735ae4da1f98c4e412646
SHA1

284822052c6a0cf78b98260f4250ae9674342059
SHA256

0482b21c0db0db94a1b0552a232cc6598d34ec3010c2ddac3ad7cd4f28507044
SHA512

b4e05bc65afaaa25a3d0502425e99074b9f0065ee919636f34bf669003d2fdfe994d1cec76cb7d05c6ee3760097d013774701d17036ed78ad23ac985bfb8e139

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

744 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

440 cmd.exe

pid	process
744	MediaCenter.exe

pid	process
440	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

0482b21c0db0db94a1b0552a232cc6598d34ec3010c2ddac3ad7cd4f28507044.exe

pid	process
1084	0482b21c0db0db94a1b0552a232cc6598d34ec3010c2ddac3ad7cd4f28507044.exe
1084	0482b21c0db0db94a1b0552a232cc6598d34ec3010c2ddac3ad7cd4f28507044.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

0482b21c0db0db94a1b0552a232cc6598d34ec3010c2ddac3ad7cd4f28507044.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	0482b21c0db0db94a1b0552a232cc6598d34ec3010c2ddac3ad7cd4f28507044.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1144 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0482b21c0db0db94a1b0552a232cc6598d34ec3010c2ddac3ad7cd4f28507044.exe

description pid process

Token: SeIncBasePriorityPrivilege 1084 0482b21c0db0db94a1b0552a232cc6598d34ec3010c2ddac3ad7cd4f28507044.exe

pid	process
1144	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1084	0482b21c0db0db94a1b0552a232cc6598d34ec3010c2ddac3ad7cd4f28507044.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

0482b21c0db0db94a1b0552a232cc6598d34ec3010c2ddac3ad7cd4f28507044.execmd.exe

description	pid	process	target process
PID 1084 wrote to memory of 744	1084	0482b21c0db0db94a1b0552a232cc6598d34ec3010c2ddac3ad7cd4f28507044.exe	MediaCenter.exe
PID 1084 wrote to memory of 744	1084	0482b21c0db0db94a1b0552a232cc6598d34ec3010c2ddac3ad7cd4f28507044.exe	MediaCenter.exe
PID 1084 wrote to memory of 744	1084	0482b21c0db0db94a1b0552a232cc6598d34ec3010c2ddac3ad7cd4f28507044.exe	MediaCenter.exe
PID 1084 wrote to memory of 744	1084	0482b21c0db0db94a1b0552a232cc6598d34ec3010c2ddac3ad7cd4f28507044.exe	MediaCenter.exe
PID 1084 wrote to memory of 440	1084	0482b21c0db0db94a1b0552a232cc6598d34ec3010c2ddac3ad7cd4f28507044.exe	cmd.exe
PID 1084 wrote to memory of 440	1084	0482b21c0db0db94a1b0552a232cc6598d34ec3010c2ddac3ad7cd4f28507044.exe	cmd.exe
PID 1084 wrote to memory of 440	1084	0482b21c0db0db94a1b0552a232cc6598d34ec3010c2ddac3ad7cd4f28507044.exe	cmd.exe
PID 1084 wrote to memory of 440	1084	0482b21c0db0db94a1b0552a232cc6598d34ec3010c2ddac3ad7cd4f28507044.exe	cmd.exe
PID 440 wrote to memory of 1144	440	cmd.exe	PING.EXE
PID 440 wrote to memory of 1144	440	cmd.exe	PING.EXE
PID 440 wrote to memory of 1144	440	cmd.exe	PING.EXE
PID 440 wrote to memory of 1144	440	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\0482b21c0db0db94a1b0552a232cc6598d34ec3010c2ddac3ad7cd4f28507044.exe
"C:\Users\Admin\AppData\Local\Temp\0482b21c0db0db94a1b0552a232cc6598d34ec3010c2ddac3ad7cd4f28507044.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1084

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:744

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\0482b21c0db0db94a1b0552a232cc6598d34ec3010c2ddac3ad7cd4f28507044.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:440

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1144

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
6c3238a17a6795a940e48d00fed206d0

SHA1
10825853bcb8f0831d8d7c884a778300670a335c

SHA256
8d1260e7fd17ad7e64f84b6ab35f28d2cda6015be55b86bb56c4ef3a6b91bee6

SHA512
9180e04dc8acfb4547079dfa03fe9a4619dec07edd7832d4716803cf292c0ee6d51faa48411204f72c083c1216abaddb2e0678ef72e610625237572948b0f85b

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
6c3238a17a6795a940e48d00fed206d0

SHA1
10825853bcb8f0831d8d7c884a778300670a335c

SHA256
8d1260e7fd17ad7e64f84b6ab35f28d2cda6015be55b86bb56c4ef3a6b91bee6

SHA512
9180e04dc8acfb4547079dfa03fe9a4619dec07edd7832d4716803cf292c0ee6d51faa48411204f72c083c1216abaddb2e0678ef72e610625237572948b0f85b

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
6c3238a17a6795a940e48d00fed206d0

SHA1
10825853bcb8f0831d8d7c884a778300670a335c

SHA256
8d1260e7fd17ad7e64f84b6ab35f28d2cda6015be55b86bb56c4ef3a6b91bee6

SHA512
9180e04dc8acfb4547079dfa03fe9a4619dec07edd7832d4716803cf292c0ee6d51faa48411204f72c083c1216abaddb2e0678ef72e610625237572948b0f85b

Download Submit
memory/1084-54-0x0000000075341000-0x0000000075343000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads