sakula | 03703bdbcf4b2978eead21dd70c95fc33ca5a75d8e529a1fe119481709e0c415

General

Target

03703bdbcf4b2978eead21dd70c95fc33ca5a75d8e529a1fe119481709e0c415.exe
Size

58KB
MD5

89f5b2aa9bf7258ed885d54be3ff7309
SHA1

5ed3a98eb79327794611c844370e63d44fde3603
SHA256

03703bdbcf4b2978eead21dd70c95fc33ca5a75d8e529a1fe119481709e0c415
SHA512

98895fa3a2f1ba4c7ea4157260f8354b7f5ce7272549ad5914039f2e96bb4a92e6479dec8958e534f3b43244c5ad0f5736750ec15eb0db0f615cfeea834bee86

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

756 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1288 cmd.exe

pid	process
756	MediaCenter.exe

pid	process
1288	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

03703bdbcf4b2978eead21dd70c95fc33ca5a75d8e529a1fe119481709e0c415.exe

pid	process
1636	03703bdbcf4b2978eead21dd70c95fc33ca5a75d8e529a1fe119481709e0c415.exe
1636	03703bdbcf4b2978eead21dd70c95fc33ca5a75d8e529a1fe119481709e0c415.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

03703bdbcf4b2978eead21dd70c95fc33ca5a75d8e529a1fe119481709e0c415.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	03703bdbcf4b2978eead21dd70c95fc33ca5a75d8e529a1fe119481709e0c415.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1840 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

03703bdbcf4b2978eead21dd70c95fc33ca5a75d8e529a1fe119481709e0c415.exe

description pid process

Token: SeIncBasePriorityPrivilege 1636 03703bdbcf4b2978eead21dd70c95fc33ca5a75d8e529a1fe119481709e0c415.exe

pid	process
1840	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1636	03703bdbcf4b2978eead21dd70c95fc33ca5a75d8e529a1fe119481709e0c415.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

03703bdbcf4b2978eead21dd70c95fc33ca5a75d8e529a1fe119481709e0c415.execmd.exe

description	pid	process	target process
PID 1636 wrote to memory of 756	1636	03703bdbcf4b2978eead21dd70c95fc33ca5a75d8e529a1fe119481709e0c415.exe	MediaCenter.exe
PID 1636 wrote to memory of 756	1636	03703bdbcf4b2978eead21dd70c95fc33ca5a75d8e529a1fe119481709e0c415.exe	MediaCenter.exe
PID 1636 wrote to memory of 756	1636	03703bdbcf4b2978eead21dd70c95fc33ca5a75d8e529a1fe119481709e0c415.exe	MediaCenter.exe
PID 1636 wrote to memory of 756	1636	03703bdbcf4b2978eead21dd70c95fc33ca5a75d8e529a1fe119481709e0c415.exe	MediaCenter.exe
PID 1636 wrote to memory of 1288	1636	03703bdbcf4b2978eead21dd70c95fc33ca5a75d8e529a1fe119481709e0c415.exe	cmd.exe
PID 1636 wrote to memory of 1288	1636	03703bdbcf4b2978eead21dd70c95fc33ca5a75d8e529a1fe119481709e0c415.exe	cmd.exe
PID 1636 wrote to memory of 1288	1636	03703bdbcf4b2978eead21dd70c95fc33ca5a75d8e529a1fe119481709e0c415.exe	cmd.exe
PID 1636 wrote to memory of 1288	1636	03703bdbcf4b2978eead21dd70c95fc33ca5a75d8e529a1fe119481709e0c415.exe	cmd.exe
PID 1288 wrote to memory of 1840	1288	cmd.exe	PING.EXE
PID 1288 wrote to memory of 1840	1288	cmd.exe	PING.EXE
PID 1288 wrote to memory of 1840	1288	cmd.exe	PING.EXE
PID 1288 wrote to memory of 1840	1288	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\03703bdbcf4b2978eead21dd70c95fc33ca5a75d8e529a1fe119481709e0c415.exe
"C:\Users\Admin\AppData\Local\Temp\03703bdbcf4b2978eead21dd70c95fc33ca5a75d8e529a1fe119481709e0c415.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
  C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\03703bdbcf4b2978eead21dd70c95fc33ca5a75d8e529a1fe119481709e0c415.exe"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:1288
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1840

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
9f3c91b9c638dacd7c0c6c8277e829d0

SHA1
e30d86e454100d31f56fa2956b6f0a5c0e1d6719

SHA256
0ee893df7efd4f49b4b3352ae0b388ff3c092ca752b4933c78f097de953b60a6

SHA512
ca9163fcd81c1721440e1c72b5e091672c939bef119885f9fe1678bcce5cc5cc8debce8f58ecbfd9becb7c54f3ac07f5ba2eeda3b5829cb62b05917410bd23ce

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
9f3c91b9c638dacd7c0c6c8277e829d0

SHA1
e30d86e454100d31f56fa2956b6f0a5c0e1d6719

SHA256
0ee893df7efd4f49b4b3352ae0b388ff3c092ca752b4933c78f097de953b60a6

SHA512
ca9163fcd81c1721440e1c72b5e091672c939bef119885f9fe1678bcce5cc5cc8debce8f58ecbfd9becb7c54f3ac07f5ba2eeda3b5829cb62b05917410bd23ce

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
9f3c91b9c638dacd7c0c6c8277e829d0

SHA1
e30d86e454100d31f56fa2956b6f0a5c0e1d6719

SHA256
0ee893df7efd4f49b4b3352ae0b388ff3c092ca752b4933c78f097de953b60a6

SHA512
ca9163fcd81c1721440e1c72b5e091672c939bef119885f9fe1678bcce5cc5cc8debce8f58ecbfd9becb7c54f3ac07f5ba2eeda3b5829cb62b05917410bd23ce

Download Submit
memory/1636-54-0x0000000075531000-0x0000000075533000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads