sakula | 04456bf047a49a779a2123016232f3b140780cd5607a2f427bca39d57e8fcb23

General

Target

04456bf047a49a779a2123016232f3b140780cd5607a2f427bca39d57e8fcb23.exe
Size

60KB
MD5

acbcbdf083670f1d6be2800984f586dd
SHA1

6182e2a93470fa17e12a842733a8d8bdbd8fecc9
SHA256

04456bf047a49a779a2123016232f3b140780cd5607a2f427bca39d57e8fcb23
SHA512

c557d8f838d792f3c971878d6e98c5bad3403fbadd5cc814b95c2a77581149946a01965d620d9ca126fbc3a622b8b49f05473f338d1a18b9f566c678f71a517b

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1916 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1832 cmd.exe

pid	process
1916	MediaCenter.exe

pid	process
1832	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

04456bf047a49a779a2123016232f3b140780cd5607a2f427bca39d57e8fcb23.exe

pid	process
1480	04456bf047a49a779a2123016232f3b140780cd5607a2f427bca39d57e8fcb23.exe
1480	04456bf047a49a779a2123016232f3b140780cd5607a2f427bca39d57e8fcb23.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

04456bf047a49a779a2123016232f3b140780cd5607a2f427bca39d57e8fcb23.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	04456bf047a49a779a2123016232f3b140780cd5607a2f427bca39d57e8fcb23.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1124 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

04456bf047a49a779a2123016232f3b140780cd5607a2f427bca39d57e8fcb23.exe

description pid process

Token: SeIncBasePriorityPrivilege 1480 04456bf047a49a779a2123016232f3b140780cd5607a2f427bca39d57e8fcb23.exe

pid	process
1124	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1480	04456bf047a49a779a2123016232f3b140780cd5607a2f427bca39d57e8fcb23.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

04456bf047a49a779a2123016232f3b140780cd5607a2f427bca39d57e8fcb23.execmd.exe

description	pid	process	target process
PID 1480 wrote to memory of 1916	1480	04456bf047a49a779a2123016232f3b140780cd5607a2f427bca39d57e8fcb23.exe	MediaCenter.exe
PID 1480 wrote to memory of 1916	1480	04456bf047a49a779a2123016232f3b140780cd5607a2f427bca39d57e8fcb23.exe	MediaCenter.exe
PID 1480 wrote to memory of 1916	1480	04456bf047a49a779a2123016232f3b140780cd5607a2f427bca39d57e8fcb23.exe	MediaCenter.exe
PID 1480 wrote to memory of 1916	1480	04456bf047a49a779a2123016232f3b140780cd5607a2f427bca39d57e8fcb23.exe	MediaCenter.exe
PID 1480 wrote to memory of 1832	1480	04456bf047a49a779a2123016232f3b140780cd5607a2f427bca39d57e8fcb23.exe	cmd.exe
PID 1480 wrote to memory of 1832	1480	04456bf047a49a779a2123016232f3b140780cd5607a2f427bca39d57e8fcb23.exe	cmd.exe
PID 1480 wrote to memory of 1832	1480	04456bf047a49a779a2123016232f3b140780cd5607a2f427bca39d57e8fcb23.exe	cmd.exe
PID 1480 wrote to memory of 1832	1480	04456bf047a49a779a2123016232f3b140780cd5607a2f427bca39d57e8fcb23.exe	cmd.exe
PID 1832 wrote to memory of 1124	1832	cmd.exe	PING.EXE
PID 1832 wrote to memory of 1124	1832	cmd.exe	PING.EXE
PID 1832 wrote to memory of 1124	1832	cmd.exe	PING.EXE
PID 1832 wrote to memory of 1124	1832	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\04456bf047a49a779a2123016232f3b140780cd5607a2f427bca39d57e8fcb23.exe
"C:\Users\Admin\AppData\Local\Temp\04456bf047a49a779a2123016232f3b140780cd5607a2f427bca39d57e8fcb23.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1480

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1916

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\04456bf047a49a779a2123016232f3b140780cd5607a2f427bca39d57e8fcb23.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1832

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1124

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
7aa06b87a58c8f04bf3183200473f965

SHA1
5bb49c03163594e7830a412f2a49eeecc8725ec6

SHA256
e6916e8944efc0f83e12420e8fd4879b2ae5269a35aab87c715dcf311b6ea1db

SHA512
4837f2407a54ceeeb13fd4fe93491843a48f5e7c42cf9f0bdb3556cf6e16cdba684d37563eb287579fd23792d96a75de289e9225cae8b3c9f946a223f8451f2f

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
7aa06b87a58c8f04bf3183200473f965

SHA1
5bb49c03163594e7830a412f2a49eeecc8725ec6

SHA256
e6916e8944efc0f83e12420e8fd4879b2ae5269a35aab87c715dcf311b6ea1db

SHA512
4837f2407a54ceeeb13fd4fe93491843a48f5e7c42cf9f0bdb3556cf6e16cdba684d37563eb287579fd23792d96a75de289e9225cae8b3c9f946a223f8451f2f

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
7aa06b87a58c8f04bf3183200473f965

SHA1
5bb49c03163594e7830a412f2a49eeecc8725ec6

SHA256
e6916e8944efc0f83e12420e8fd4879b2ae5269a35aab87c715dcf311b6ea1db

SHA512
4837f2407a54ceeeb13fd4fe93491843a48f5e7c42cf9f0bdb3556cf6e16cdba684d37563eb287579fd23792d96a75de289e9225cae8b3c9f946a223f8451f2f

Download Submit
memory/1480-54-0x0000000075761000-0x0000000075763000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads