sakula | 00040ad890146e8845022657aade087f11a3c49326cf1ef5475f1ffe919c9213

General

Target

00040ad890146e8845022657aade087f11a3c49326cf1ef5475f1ffe919c9213.exe
Size

60KB
MD5

8ae24c8a2147f2355d97f7b4c4f2b664
SHA1

c394bef7e960d40d692ebebad03ac76a8da177dc
SHA256

00040ad890146e8845022657aade087f11a3c49326cf1ef5475f1ffe919c9213
SHA512

7ffa67ad320ab0d904534a746782013ae51277415730db94a6599346d8dcd42d6894364df0ed85929194664f621c40d5c9966695b7131d4b05dc4ae42c963382

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1328 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1672 cmd.exe

pid	process
1328	MediaCenter.exe

pid	process
1672	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

00040ad890146e8845022657aade087f11a3c49326cf1ef5475f1ffe919c9213.exe

pid	process
1308	00040ad890146e8845022657aade087f11a3c49326cf1ef5475f1ffe919c9213.exe
1308	00040ad890146e8845022657aade087f11a3c49326cf1ef5475f1ffe919c9213.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

00040ad890146e8845022657aade087f11a3c49326cf1ef5475f1ffe919c9213.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	00040ad890146e8845022657aade087f11a3c49326cf1ef5475f1ffe919c9213.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1120 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

00040ad890146e8845022657aade087f11a3c49326cf1ef5475f1ffe919c9213.exe

description pid process

Token: SeIncBasePriorityPrivilege 1308 00040ad890146e8845022657aade087f11a3c49326cf1ef5475f1ffe919c9213.exe

pid	process
1120	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1308	00040ad890146e8845022657aade087f11a3c49326cf1ef5475f1ffe919c9213.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

00040ad890146e8845022657aade087f11a3c49326cf1ef5475f1ffe919c9213.execmd.exe

description	pid	process	target process
PID 1308 wrote to memory of 1328	1308	00040ad890146e8845022657aade087f11a3c49326cf1ef5475f1ffe919c9213.exe	MediaCenter.exe
PID 1308 wrote to memory of 1328	1308	00040ad890146e8845022657aade087f11a3c49326cf1ef5475f1ffe919c9213.exe	MediaCenter.exe
PID 1308 wrote to memory of 1328	1308	00040ad890146e8845022657aade087f11a3c49326cf1ef5475f1ffe919c9213.exe	MediaCenter.exe
PID 1308 wrote to memory of 1328	1308	00040ad890146e8845022657aade087f11a3c49326cf1ef5475f1ffe919c9213.exe	MediaCenter.exe
PID 1308 wrote to memory of 1672	1308	00040ad890146e8845022657aade087f11a3c49326cf1ef5475f1ffe919c9213.exe	cmd.exe
PID 1308 wrote to memory of 1672	1308	00040ad890146e8845022657aade087f11a3c49326cf1ef5475f1ffe919c9213.exe	cmd.exe
PID 1308 wrote to memory of 1672	1308	00040ad890146e8845022657aade087f11a3c49326cf1ef5475f1ffe919c9213.exe	cmd.exe
PID 1308 wrote to memory of 1672	1308	00040ad890146e8845022657aade087f11a3c49326cf1ef5475f1ffe919c9213.exe	cmd.exe
PID 1672 wrote to memory of 1120	1672	cmd.exe	PING.EXE
PID 1672 wrote to memory of 1120	1672	cmd.exe	PING.EXE
PID 1672 wrote to memory of 1120	1672	cmd.exe	PING.EXE
PID 1672 wrote to memory of 1120	1672	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\00040ad890146e8845022657aade087f11a3c49326cf1ef5475f1ffe919c9213.exe
"C:\Users\Admin\AppData\Local\Temp\00040ad890146e8845022657aade087f11a3c49326cf1ef5475f1ffe919c9213.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1308

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1328

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\00040ad890146e8845022657aade087f11a3c49326cf1ef5475f1ffe919c9213.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1672

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1120

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
acd8406433a44782615c312c426dec39

SHA1
90a02e7e15b90abdb2134db5514ba06e4231dde1

SHA256
44709138a2f68980baf8a0f6ad8cd960bfb1944685a482c5145b0e392d25310c

SHA512
2d1c871f126de996dd4c05c7e3147b14c168a06d925ab78d3ad170e91163b4b2e015edc7d2e6473177a0b754bb6dd42a7012d941e12e5005d6c8c8d44caef8e6

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
acd8406433a44782615c312c426dec39

SHA1
90a02e7e15b90abdb2134db5514ba06e4231dde1

SHA256
44709138a2f68980baf8a0f6ad8cd960bfb1944685a482c5145b0e392d25310c

SHA512
2d1c871f126de996dd4c05c7e3147b14c168a06d925ab78d3ad170e91163b4b2e015edc7d2e6473177a0b754bb6dd42a7012d941e12e5005d6c8c8d44caef8e6

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
acd8406433a44782615c312c426dec39

SHA1
90a02e7e15b90abdb2134db5514ba06e4231dde1

SHA256
44709138a2f68980baf8a0f6ad8cd960bfb1944685a482c5145b0e392d25310c

SHA512
2d1c871f126de996dd4c05c7e3147b14c168a06d925ab78d3ad170e91163b4b2e015edc7d2e6473177a0b754bb6dd42a7012d941e12e5005d6c8c8d44caef8e6

Download Submit
memory/1308-54-0x0000000076451000-0x0000000076453000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads