sakula | a834a21c79f7a4ce5bf5c72ffb03fe6a643181ddf3c014b9acfc07ce7c19ce06

Resubmissions

24-02-2022 11:07

220224-m8hersebdq 10

30-09-2021 12:28

210930-pncpwshfh4 8

Analysis

max time kernel
139s
max time network
148s
platform
windows10_x64
resource
win10-20220223-en
submitted
24-02-2022 11:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a834a21c79f7a4ce5bf5c72ffb03fe6a643181ddf3c014b9acfc07ce7c19ce06.exe
Size

191KB
MD5

9f9dc575235aa8fc839e0864624d41bc
SHA1

c1a29e0fa8815af498214495ffa25e80a4bc0cdb
SHA256

a834a21c79f7a4ce5bf5c72ffb03fe6a643181ddf3c014b9acfc07ce7c19ce06
SHA512

7b0decabc89df93aad300e99ebbd7ac1c27e86a47fb68b261014c08182de0b9341261bd597cb646d21c8e25e71279444ceb89ed1d5c14359469905a96331c8ab

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula Payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula

Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

2552 MediaCenter.exe

pid	process
2552	MediaCenter.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

a834a21c79f7a4ce5bf5c72ffb03fe6a643181ddf3c014b9acfc07ce7c19ce06.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	a834a21c79f7a4ce5bf5c72ffb03fe6a643181ddf3c014b9acfc07ce7c19ce06.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2368 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a834a21c79f7a4ce5bf5c72ffb03fe6a643181ddf3c014b9acfc07ce7c19ce06.exe

description pid process

Token: SeIncBasePriorityPrivilege 3660 a834a21c79f7a4ce5bf5c72ffb03fe6a643181ddf3c014b9acfc07ce7c19ce06.exe

pid	process
2368	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	3660	a834a21c79f7a4ce5bf5c72ffb03fe6a643181ddf3c014b9acfc07ce7c19ce06.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

a834a21c79f7a4ce5bf5c72ffb03fe6a643181ddf3c014b9acfc07ce7c19ce06.execmd.exe

description	pid	process	target process
PID 3660 wrote to memory of 2552	3660	a834a21c79f7a4ce5bf5c72ffb03fe6a643181ddf3c014b9acfc07ce7c19ce06.exe	MediaCenter.exe
PID 3660 wrote to memory of 2552	3660	a834a21c79f7a4ce5bf5c72ffb03fe6a643181ddf3c014b9acfc07ce7c19ce06.exe	MediaCenter.exe
PID 3660 wrote to memory of 2552	3660	a834a21c79f7a4ce5bf5c72ffb03fe6a643181ddf3c014b9acfc07ce7c19ce06.exe	MediaCenter.exe
PID 3660 wrote to memory of 1684	3660	a834a21c79f7a4ce5bf5c72ffb03fe6a643181ddf3c014b9acfc07ce7c19ce06.exe	cmd.exe
PID 3660 wrote to memory of 1684	3660	a834a21c79f7a4ce5bf5c72ffb03fe6a643181ddf3c014b9acfc07ce7c19ce06.exe	cmd.exe
PID 3660 wrote to memory of 1684	3660	a834a21c79f7a4ce5bf5c72ffb03fe6a643181ddf3c014b9acfc07ce7c19ce06.exe	cmd.exe
PID 1684 wrote to memory of 2368	1684	cmd.exe	PING.EXE
PID 1684 wrote to memory of 2368	1684	cmd.exe	PING.EXE
PID 1684 wrote to memory of 2368	1684	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\a834a21c79f7a4ce5bf5c72ffb03fe6a643181ddf3c014b9acfc07ce7c19ce06.exe
"C:\Users\Admin\AppData\Local\Temp\a834a21c79f7a4ce5bf5c72ffb03fe6a643181ddf3c014b9acfc07ce7c19ce06.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3660

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:2552

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\a834a21c79f7a4ce5bf5c72ffb03fe6a643181ddf3c014b9acfc07ce7c19ce06.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1684

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:2368

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
d9547fb7b67b879c6203d386bf018717

SHA1
4dc8355d2c632e5a5ad166c313c1ba2a0a539333

SHA256
c7ea191bf51d3dbe4bfc656a45e55dd2b37fbf53a8a9f6b5e3a24fae07c7a470

SHA512
c109b637543767029d0603e56ac80339822ba0b542b4627e23abd78dc6fdde1c68881500c7239377ad30e5e8f917f19876429627cf43e381b8ef91b879d1541f

Download Submit
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
d9547fb7b67b879c6203d386bf018717

SHA1
4dc8355d2c632e5a5ad166c313c1ba2a0a539333

SHA256
c7ea191bf51d3dbe4bfc656a45e55dd2b37fbf53a8a9f6b5e3a24fae07c7a470

SHA512
c109b637543767029d0603e56ac80339822ba0b542b4627e23abd78dc6fdde1c68881500c7239377ad30e5e8f917f19876429627cf43e381b8ef91b879d1541f

Download Submit