sakula | 0169e86db28b67c9b44d783c87aa39b8bab2a5d186223b97edd63521e8282007

General

Target

0169e86db28b67c9b44d783c87aa39b8bab2a5d186223b97edd63521e8282007.exe
Size

100KB
MD5

b7b9ff19b2fbb7502b7f12af20635c02
SHA1

b123fc99cd6899b530938aad1603fa4048c6a754
SHA256

0169e86db28b67c9b44d783c87aa39b8bab2a5d186223b97edd63521e8282007
SHA512

b57e02a01bfc061d99ded3e7bf7f6df19e8d39c74fe835349f675707ed456795dff6d10786046bd514a2f9eda3fc4db488b1bc6e946447fa649b4bc9873b55aa

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula Payload 4 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
behavioral1/memory/1672-59-0x0000000000400000-0x0000000000420000-memory.dmp	family_sakula
behavioral1/memory/956-60-0x0000000000400000-0x0000000000420000-memory.dmp	family_sakula

Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

956 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1640 cmd.exe
Loads dropped DLL 1 IoCs

Processes:

0169e86db28b67c9b44d783c87aa39b8bab2a5d186223b97edd63521e8282007.exe

pid process

1672 0169e86db28b67c9b44d783c87aa39b8bab2a5d186223b97edd63521e8282007.exe

pid	process
956	MediaCenter.exe

pid	process
1640	cmd.exe

pid	process
1672	0169e86db28b67c9b44d783c87aa39b8bab2a5d186223b97edd63521e8282007.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

0169e86db28b67c9b44d783c87aa39b8bab2a5d186223b97edd63521e8282007.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	0169e86db28b67c9b44d783c87aa39b8bab2a5d186223b97edd63521e8282007.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1212 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0169e86db28b67c9b44d783c87aa39b8bab2a5d186223b97edd63521e8282007.exe

description pid process

Token: SeIncBasePriorityPrivilege 1672 0169e86db28b67c9b44d783c87aa39b8bab2a5d186223b97edd63521e8282007.exe

pid	process
1212	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1672	0169e86db28b67c9b44d783c87aa39b8bab2a5d186223b97edd63521e8282007.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

0169e86db28b67c9b44d783c87aa39b8bab2a5d186223b97edd63521e8282007.execmd.exe

description	pid	process	target process
PID 1672 wrote to memory of 956	1672	0169e86db28b67c9b44d783c87aa39b8bab2a5d186223b97edd63521e8282007.exe	MediaCenter.exe
PID 1672 wrote to memory of 956	1672	0169e86db28b67c9b44d783c87aa39b8bab2a5d186223b97edd63521e8282007.exe	MediaCenter.exe
PID 1672 wrote to memory of 956	1672	0169e86db28b67c9b44d783c87aa39b8bab2a5d186223b97edd63521e8282007.exe	MediaCenter.exe
PID 1672 wrote to memory of 956	1672	0169e86db28b67c9b44d783c87aa39b8bab2a5d186223b97edd63521e8282007.exe	MediaCenter.exe
PID 1672 wrote to memory of 1640	1672	0169e86db28b67c9b44d783c87aa39b8bab2a5d186223b97edd63521e8282007.exe	cmd.exe
PID 1672 wrote to memory of 1640	1672	0169e86db28b67c9b44d783c87aa39b8bab2a5d186223b97edd63521e8282007.exe	cmd.exe
PID 1672 wrote to memory of 1640	1672	0169e86db28b67c9b44d783c87aa39b8bab2a5d186223b97edd63521e8282007.exe	cmd.exe
PID 1672 wrote to memory of 1640	1672	0169e86db28b67c9b44d783c87aa39b8bab2a5d186223b97edd63521e8282007.exe	cmd.exe
PID 1640 wrote to memory of 1212	1640	cmd.exe	PING.EXE
PID 1640 wrote to memory of 1212	1640	cmd.exe	PING.EXE
PID 1640 wrote to memory of 1212	1640	cmd.exe	PING.EXE
PID 1640 wrote to memory of 1212	1640	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\0169e86db28b67c9b44d783c87aa39b8bab2a5d186223b97edd63521e8282007.exe
"C:\Users\Admin\AppData\Local\Temp\0169e86db28b67c9b44d783c87aa39b8bab2a5d186223b97edd63521e8282007.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1672

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:956

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\0169e86db28b67c9b44d783c87aa39b8bab2a5d186223b97edd63521e8282007.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1640

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1212

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
d5aca6bf45456db37691ce1e80d74004

SHA1
3fd92133f1c3f11e713231fb0a9374ca5a3ab7a7

SHA256
d39db592259a37a48d0620cba450ccf6f716bccdbc973c011f695dc2ab5954cd

SHA512
ef8fd0db5acf1a2997f3cd597a4686ebb530f51f1f2764e6188ecf90be0450f7f50b34caa9de53c9a0b6e3849a7f9d02cd4e0fa3b390a4d60d5abf8100e2cba9

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
d5aca6bf45456db37691ce1e80d74004

SHA1
3fd92133f1c3f11e713231fb0a9374ca5a3ab7a7

SHA256
d39db592259a37a48d0620cba450ccf6f716bccdbc973c011f695dc2ab5954cd

SHA512
ef8fd0db5acf1a2997f3cd597a4686ebb530f51f1f2764e6188ecf90be0450f7f50b34caa9de53c9a0b6e3849a7f9d02cd4e0fa3b390a4d60d5abf8100e2cba9

Download Submit
memory/956-60-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1672-55-0x0000000075321000-0x0000000075323000-memory.dmp

Filesize
8KB

Download
memory/1672-59-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads