sakula | 0429d9dfc564d193d2e88df942be024f456d2a93e523d2119868b2962f208be0

General

Target

0429d9dfc564d193d2e88df942be024f456d2a93e523d2119868b2962f208be0.exe
Size

60KB
MD5

2271e5e0671156e4f54e1a67dabecb49
SHA1

1786a5e2152d5ca00ed2ef4a4dbe774e0a4d50cd
SHA256

0429d9dfc564d193d2e88df942be024f456d2a93e523d2119868b2962f208be0
SHA512

624ed1eccf3dccce975864715c1ffb33d2a01424dd1d353844a14dd0cd42c18203789a9334981f069f59314ae5b3b3a04a8409a6620bd321adb4d880c3b9655b

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

2716 MediaCenter.exe

pid	process
2716	MediaCenter.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

0429d9dfc564d193d2e88df942be024f456d2a93e523d2119868b2962f208be0.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	0429d9dfc564d193d2e88df942be024f456d2a93e523d2119868b2962f208be0.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

0429d9dfc564d193d2e88df942be024f456d2a93e523d2119868b2962f208be0.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	0429d9dfc564d193d2e88df942be024f456d2a93e523d2119868b2962f208be0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

MusNotifyIcon.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MusNotifyIcon.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MusNotifyIcon.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2304 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0429d9dfc564d193d2e88df942be024f456d2a93e523d2119868b2962f208be0.exe

description pid process

Token: SeIncBasePriorityPrivilege 3900 0429d9dfc564d193d2e88df942be024f456d2a93e523d2119868b2962f208be0.exe

pid	process
2304	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	3900	0429d9dfc564d193d2e88df942be024f456d2a93e523d2119868b2962f208be0.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

0429d9dfc564d193d2e88df942be024f456d2a93e523d2119868b2962f208be0.execmd.exe

description	pid	process	target process
PID 3900 wrote to memory of 2716	3900	0429d9dfc564d193d2e88df942be024f456d2a93e523d2119868b2962f208be0.exe	MediaCenter.exe
PID 3900 wrote to memory of 2716	3900	0429d9dfc564d193d2e88df942be024f456d2a93e523d2119868b2962f208be0.exe	MediaCenter.exe
PID 3900 wrote to memory of 2716	3900	0429d9dfc564d193d2e88df942be024f456d2a93e523d2119868b2962f208be0.exe	MediaCenter.exe
PID 3900 wrote to memory of 3420	3900	0429d9dfc564d193d2e88df942be024f456d2a93e523d2119868b2962f208be0.exe	cmd.exe
PID 3900 wrote to memory of 3420	3900	0429d9dfc564d193d2e88df942be024f456d2a93e523d2119868b2962f208be0.exe	cmd.exe
PID 3900 wrote to memory of 3420	3900	0429d9dfc564d193d2e88df942be024f456d2a93e523d2119868b2962f208be0.exe	cmd.exe
PID 3420 wrote to memory of 2304	3420	cmd.exe	PING.EXE
PID 3420 wrote to memory of 2304	3420	cmd.exe	PING.EXE
PID 3420 wrote to memory of 2304	3420	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\0429d9dfc564d193d2e88df942be024f456d2a93e523d2119868b2962f208be0.exe
"C:\Users\Admin\AppData\Local\Temp\0429d9dfc564d193d2e88df942be024f456d2a93e523d2119868b2962f208be0.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3900

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:2716

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\0429d9dfc564d193d2e88df942be024f456d2a93e523d2119868b2962f208be0.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:3420

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:2304

C:\Windows\system32\MusNotifyIcon.exe
%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13
1⤵
- Checks processor information in registry
PID:1396

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

Remote System Discovery

1

T1018

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
9442b82d7ab96ef242093fdaa92c5d51

SHA1
dc0d9e62fbb1ea7b04dbb086ac2b21677eb1898c

SHA256
30e9be825589eb673229c6635b4acc961245c800e2e541f4c9845c2c0f0caf17

SHA512
23b3a41bb9d5b8fbf38e142d8b2b608790030daa8f4517ed8ac306615483fc1c7b823767ed0a1355f688fae9f06728a17afb6881573315cfd3c7bd5400cb02e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
9442b82d7ab96ef242093fdaa92c5d51

SHA1
dc0d9e62fbb1ea7b04dbb086ac2b21677eb1898c

SHA256
30e9be825589eb673229c6635b4acc961245c800e2e541f4c9845c2c0f0caf17

SHA512
23b3a41bb9d5b8fbf38e142d8b2b608790030daa8f4517ed8ac306615483fc1c7b823767ed0a1355f688fae9f06728a17afb6881573315cfd3c7bd5400cb02e2

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads