sakula | dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c

General

Target

dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe
Size

77KB
MD5

cce983f04093a936e29dbf1d7078bc53
SHA1

619637bdcb8ed1a59e36e6badd1a189bdb35bc2f
SHA256

dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c
SHA512

2d84b360e7d5c636b5a893de51a2bc49392731660562be5a1117f9924d6e3f872d74af6a279b71fbb4cb4b1430ca02395d5e160a945d125cf1d3fef9b615d0a5

Score

10^/10

sakula persistence rat suricata trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
suricata: ET MALWARE Possible DEEP PANDA C2 Activity
suricata: ET MALWARE Possible DEEP PANDA C2 Activity
suricata
suricata: ET MALWARE Possible Deep Panda - Sakula/Mivast RAT CnC Beacon 5
suricata: ET MALWARE Possible Deep Panda - Sakula/Mivast RAT CnC Beacon 5
suricata
suricata: ET MALWARE Sakula/Mivast C2 Activity
suricata: ET MALWARE Sakula/Mivast C2 Activity
suricata
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

3724 MediaCenter.exe

pid	process
3724	MediaCenter.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	reg.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

3588 reg.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

3604 PING.EXE

pid	process
3588	reg.exe

pid	process
3604	PING.EXE

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.execmd.execmd.execmd.exe

description	pid	process	target process
PID 4116 wrote to memory of 4128	4116	dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe	cmd.exe
PID 4116 wrote to memory of 4128	4116	dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe	cmd.exe
PID 4116 wrote to memory of 4128	4116	dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe	cmd.exe
PID 4116 wrote to memory of 3480	4116	dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe	cmd.exe
PID 4116 wrote to memory of 3480	4116	dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe	cmd.exe
PID 4116 wrote to memory of 3480	4116	dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe	cmd.exe
PID 4116 wrote to memory of 3420	4116	dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe	cmd.exe
PID 4116 wrote to memory of 3420	4116	dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe	cmd.exe
PID 4116 wrote to memory of 3420	4116	dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe	cmd.exe
PID 3420 wrote to memory of 3604	3420	cmd.exe	PING.EXE
PID 3420 wrote to memory of 3604	3420	cmd.exe	PING.EXE
PID 3420 wrote to memory of 3604	3420	cmd.exe	PING.EXE
PID 4128 wrote to memory of 3588	4128	cmd.exe	reg.exe
PID 4128 wrote to memory of 3588	4128	cmd.exe	reg.exe
PID 4128 wrote to memory of 3588	4128	cmd.exe	reg.exe
PID 3480 wrote to memory of 3724	3480	cmd.exe	MediaCenter.exe
PID 3480 wrote to memory of 3724	3480	cmd.exe	MediaCenter.exe
PID 3480 wrote to memory of 3724	3480	cmd.exe	MediaCenter.exe

C:\Users\Admin\AppData\Local\Temp\dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe
"C:\Users\Admin\AppData\Local\Temp\dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4116

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:4128

C:\Windows\SysWOW64\reg.exe
reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"
3⤵
- Adds Run key to start application
- Modifies registry key
PID:3588

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:3420

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:3604

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:3480

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
3⤵
- Executes dropped EXE
PID:3724

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
2994a925eb95c2a8b637387747d9e0de

SHA1
1eb79e670d5d212276423f8a53f7e810b602fe33

SHA256
df2da97b033235940f7da2aae4e0b66ea6712d51dcfc1f8d1d8ba9aee7c0ef23

SHA512
35adad26523cb6995f930a2ed81f9e7eeb797590362969ae4519d212e1e8c9658b2c5fd7855c6504337790c76847a6304742fb39ec9e996a61dc46adee966ef4

Download Submit
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
2994a925eb95c2a8b637387747d9e0de

SHA1
1eb79e670d5d212276423f8a53f7e810b602fe33

SHA256
df2da97b033235940f7da2aae4e0b66ea6712d51dcfc1f8d1d8ba9aee7c0ef23

SHA512
35adad26523cb6995f930a2ed81f9e7eeb797590362969ae4519d212e1e8c9658b2c5fd7855c6504337790c76847a6304742fb39ec9e996a61dc46adee966ef4

Download Submit
memory/4116-114-0x0000000000401000-0x0000000000404000-memory.dmp

Filesize
12KB

Download

Resubmissions

Analysis

Sharing