sakula | 0024573f83caefbe0444b576f8334d964fb5dbd703b71db6a0e35e0f7225e88a

General

Target

0024573f83caefbe0444b576f8334d964fb5dbd703b71db6a0e35e0f7225e88a.exe
Size

60KB
MD5

799680cb66fed5e6e0f4009ed357d1c1
SHA1

a2ec49c978ef84d1fea04be53c9e1d2742c3a75c
SHA256

0024573f83caefbe0444b576f8334d964fb5dbd703b71db6a0e35e0f7225e88a
SHA512

40f818259a919fd9acd8129355f4f098c6c66497e70a0dfeb68403b55df9dc5d6e55dffe700b14e44b8ea81981722b04bae00dae814e015d8d656d56f9d5f530

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1648 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1828 cmd.exe

pid	process
1648	MediaCenter.exe

pid	process
1828	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

0024573f83caefbe0444b576f8334d964fb5dbd703b71db6a0e35e0f7225e88a.exe

pid	process
744	0024573f83caefbe0444b576f8334d964fb5dbd703b71db6a0e35e0f7225e88a.exe
744	0024573f83caefbe0444b576f8334d964fb5dbd703b71db6a0e35e0f7225e88a.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

0024573f83caefbe0444b576f8334d964fb5dbd703b71db6a0e35e0f7225e88a.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	0024573f83caefbe0444b576f8334d964fb5dbd703b71db6a0e35e0f7225e88a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1884 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0024573f83caefbe0444b576f8334d964fb5dbd703b71db6a0e35e0f7225e88a.exe

description pid process

Token: SeIncBasePriorityPrivilege 744 0024573f83caefbe0444b576f8334d964fb5dbd703b71db6a0e35e0f7225e88a.exe

pid	process
1884	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	744	0024573f83caefbe0444b576f8334d964fb5dbd703b71db6a0e35e0f7225e88a.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

0024573f83caefbe0444b576f8334d964fb5dbd703b71db6a0e35e0f7225e88a.execmd.exe

description	pid	process	target process
PID 744 wrote to memory of 1648	744	0024573f83caefbe0444b576f8334d964fb5dbd703b71db6a0e35e0f7225e88a.exe	MediaCenter.exe
PID 744 wrote to memory of 1648	744	0024573f83caefbe0444b576f8334d964fb5dbd703b71db6a0e35e0f7225e88a.exe	MediaCenter.exe
PID 744 wrote to memory of 1648	744	0024573f83caefbe0444b576f8334d964fb5dbd703b71db6a0e35e0f7225e88a.exe	MediaCenter.exe
PID 744 wrote to memory of 1648	744	0024573f83caefbe0444b576f8334d964fb5dbd703b71db6a0e35e0f7225e88a.exe	MediaCenter.exe
PID 744 wrote to memory of 1828	744	0024573f83caefbe0444b576f8334d964fb5dbd703b71db6a0e35e0f7225e88a.exe	cmd.exe
PID 744 wrote to memory of 1828	744	0024573f83caefbe0444b576f8334d964fb5dbd703b71db6a0e35e0f7225e88a.exe	cmd.exe
PID 744 wrote to memory of 1828	744	0024573f83caefbe0444b576f8334d964fb5dbd703b71db6a0e35e0f7225e88a.exe	cmd.exe
PID 744 wrote to memory of 1828	744	0024573f83caefbe0444b576f8334d964fb5dbd703b71db6a0e35e0f7225e88a.exe	cmd.exe
PID 1828 wrote to memory of 1884	1828	cmd.exe	PING.EXE
PID 1828 wrote to memory of 1884	1828	cmd.exe	PING.EXE
PID 1828 wrote to memory of 1884	1828	cmd.exe	PING.EXE
PID 1828 wrote to memory of 1884	1828	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\0024573f83caefbe0444b576f8334d964fb5dbd703b71db6a0e35e0f7225e88a.exe
"C:\Users\Admin\AppData\Local\Temp\0024573f83caefbe0444b576f8334d964fb5dbd703b71db6a0e35e0f7225e88a.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:744
- C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
  C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\0024573f83caefbe0444b576f8334d964fb5dbd703b71db6a0e35e0f7225e88a.exe"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:1828
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1884

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
001e58301d9770e2a203de5c2049dc59

SHA1
e24258df5adb4c761f23a2bb39538ffe6d149fc0

SHA256
f32d27d63e40e28bc96f6f60cc574bae425623f074823cefef9bb134062422ce

SHA512
a2cc8b06ced76f1c8ec95091c9de90f19a66263dcc129d7bded21a139935fcf27bb266d7ccdc7fede82d459010977d8e1ec018dca4dcade7fb710e634af2aabf

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
001e58301d9770e2a203de5c2049dc59

SHA1
e24258df5adb4c761f23a2bb39538ffe6d149fc0

SHA256
f32d27d63e40e28bc96f6f60cc574bae425623f074823cefef9bb134062422ce

SHA512
a2cc8b06ced76f1c8ec95091c9de90f19a66263dcc129d7bded21a139935fcf27bb266d7ccdc7fede82d459010977d8e1ec018dca4dcade7fb710e634af2aabf

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
001e58301d9770e2a203de5c2049dc59

SHA1
e24258df5adb4c761f23a2bb39538ffe6d149fc0

SHA256
f32d27d63e40e28bc96f6f60cc574bae425623f074823cefef9bb134062422ce

SHA512
a2cc8b06ced76f1c8ec95091c9de90f19a66263dcc129d7bded21a139935fcf27bb266d7ccdc7fede82d459010977d8e1ec018dca4dcade7fb710e634af2aabf

Download Submit
memory/744-54-0x0000000075341000-0x0000000075343000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads