sakula | b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e

General

Target

b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe
Size

76KB
MD5

f032614326676138de5a4dc97ddc87e5
SHA1

a55a86bdd0f40b8a8801cacbbc025a8f58a5aeec
SHA256

b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e
SHA512

3fd27b90ebfd2c94369bc432d082baa88c8c53b1aa83fae2e5c03f9e59f53c7520071a79e968abd232e2998c27176a011e038c7900ddea3dba6b97812ef13456

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1356 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

760 cmd.exe
Loads dropped DLL 2 IoCs

Processes:

cmd.exe

pid process

828 cmd.exe
828 cmd.exe

pid	process
1356	MediaCenter.exe

pid	process
760	cmd.exe

pid	process
828	cmd.exe
828	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	reg.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

1412 reg.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1828 PING.EXE

pid	process
1412	reg.exe

pid	process
1828	PING.EXE

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.execmd.execmd.execmd.exe

description	pid	process	target process
PID 1660 wrote to memory of 948	1660	b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe	cmd.exe
PID 1660 wrote to memory of 948	1660	b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe	cmd.exe
PID 1660 wrote to memory of 948	1660	b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe	cmd.exe
PID 1660 wrote to memory of 948	1660	b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe	cmd.exe
PID 1660 wrote to memory of 828	1660	b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe	cmd.exe
PID 1660 wrote to memory of 828	1660	b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe	cmd.exe
PID 1660 wrote to memory of 828	1660	b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe	cmd.exe
PID 1660 wrote to memory of 828	1660	b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe	cmd.exe
PID 1660 wrote to memory of 760	1660	b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe	cmd.exe
PID 1660 wrote to memory of 760	1660	b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe	cmd.exe
PID 1660 wrote to memory of 760	1660	b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe	cmd.exe
PID 1660 wrote to memory of 760	1660	b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe	cmd.exe
PID 828 wrote to memory of 1356	828	cmd.exe	MediaCenter.exe
PID 828 wrote to memory of 1356	828	cmd.exe	MediaCenter.exe
PID 828 wrote to memory of 1356	828	cmd.exe	MediaCenter.exe
PID 828 wrote to memory of 1356	828	cmd.exe	MediaCenter.exe
PID 760 wrote to memory of 1828	760	cmd.exe	PING.EXE
PID 760 wrote to memory of 1828	760	cmd.exe	PING.EXE
PID 760 wrote to memory of 1828	760	cmd.exe	PING.EXE
PID 760 wrote to memory of 1828	760	cmd.exe	PING.EXE
PID 948 wrote to memory of 1412	948	cmd.exe	reg.exe
PID 948 wrote to memory of 1412	948	cmd.exe	reg.exe
PID 948 wrote to memory of 1412	948	cmd.exe	reg.exe
PID 948 wrote to memory of 1412	948	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe
"C:\Users\Admin\AppData\Local\Temp\b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1660

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:948

C:\Windows\SysWOW64\reg.exe
reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"
3⤵
- Adds Run key to start application
- Modifies registry key
PID:1412

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:828

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
3⤵
- Executes dropped EXE
PID:1356

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:760

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1828

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
c2a6679d672e3995ce23d5d0361c854a

SHA1
adc0b8681792cf059e9eb9859a083b77a5651535

SHA256
789892bab25f05525d9ee032b9e6d69499689f996f09ad190d9c10dadb5e9583

SHA512
8efbbd10a8a71d19b3574365b79097ec6c7d138a796559f1c12e8ef5a3b2682fed0a5129141f8ee2ce63213b8593c11864a90e880af07fb8ec39bd0033b4f731

Download Submit
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
c2a6679d672e3995ce23d5d0361c854a

SHA1
adc0b8681792cf059e9eb9859a083b77a5651535

SHA256
789892bab25f05525d9ee032b9e6d69499689f996f09ad190d9c10dadb5e9583

SHA512
8efbbd10a8a71d19b3574365b79097ec6c7d138a796559f1c12e8ef5a3b2682fed0a5129141f8ee2ce63213b8593c11864a90e880af07fb8ec39bd0033b4f731

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
c2a6679d672e3995ce23d5d0361c854a

SHA1
adc0b8681792cf059e9eb9859a083b77a5651535

SHA256
789892bab25f05525d9ee032b9e6d69499689f996f09ad190d9c10dadb5e9583

SHA512
8efbbd10a8a71d19b3574365b79097ec6c7d138a796559f1c12e8ef5a3b2682fed0a5129141f8ee2ce63213b8593c11864a90e880af07fb8ec39bd0033b4f731

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
c2a6679d672e3995ce23d5d0361c854a

SHA1
adc0b8681792cf059e9eb9859a083b77a5651535

SHA256
789892bab25f05525d9ee032b9e6d69499689f996f09ad190d9c10dadb5e9583

SHA512
8efbbd10a8a71d19b3574365b79097ec6c7d138a796559f1c12e8ef5a3b2682fed0a5129141f8ee2ce63213b8593c11864a90e880af07fb8ec39bd0033b4f731

Download Submit
memory/1660-55-0x0000000075F81000-0x0000000075F83000-memory.dmp

Filesize
8KB

Download
memory/1660-56-0x0000000000401000-0x0000000000404000-memory.dmp

Filesize
12KB

Download

Resubmissions

Analysis

Sharing