sakula | 2670229271fa85f2b2b16b586a4c73853fcc8e6bebf3e5c909e29eb21e539825

General

Target
2670229271fa85f2b2b16b586a4c73853fcc8e6bebf3e5c909e29eb21e539825.exe
Size 60KB
Sample220323-ljw17agbdk
SHA256 2670229271fa85f2b2b16b586a4c73853fcc8e6bebf3e5c909e29eb21e539825
MD5 51d60455b6e1b9f562564450dc2dd2d3
SHA1 33cb9adfbb9e8b6d753df9389bfa6c081cb1ab33
SHA512 93c3b1d535ca7fdfc017532e327473eba0505252fb871fe962113b9835f6b98f8b587fe55e49493214c27f06013a99874dd20743f9a40050df8db5d4d0b97501
MD5 SHA1 SHA512

Score

10^/10

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Executes dropped EXE 1 IoCs

pid	Process
2112	MediaCenter.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	2670229271fa85f2b2b16b586a4c73853fcc8e6bebf3e5c909e29eb21e539825.exe

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	2670229271fa85f2b2b16b586a4c73853fcc8e6bebf3e5c909e29eb21e539825.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
4372	PING.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1664	2670229271fa85f2b2b16b586a4c73853fcc8e6bebf3e5c909e29eb21e539825.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 2112	1664	2670229271fa85f2b2b16b586a4c73853fcc8e6bebf3e5c909e29eb21e539825.exe	80
PID 1664 wrote to memory of 2112	1664	2670229271fa85f2b2b16b586a4c73853fcc8e6bebf3e5c909e29eb21e539825.exe	80
PID 1664 wrote to memory of 2112	1664	2670229271fa85f2b2b16b586a4c73853fcc8e6bebf3e5c909e29eb21e539825.exe	80
PID 1664 wrote to memory of 4248	1664	2670229271fa85f2b2b16b586a4c73853fcc8e6bebf3e5c909e29eb21e539825.exe	89
PID 1664 wrote to memory of 4248	1664	2670229271fa85f2b2b16b586a4c73853fcc8e6bebf3e5c909e29eb21e539825.exe	89
PID 1664 wrote to memory of 4248	1664	2670229271fa85f2b2b16b586a4c73853fcc8e6bebf3e5c909e29eb21e539825.exe	89
PID 4248 wrote to memory of 4372	4248	cmd.exe	91
PID 4248 wrote to memory of 4372	4248	cmd.exe	91
PID 4248 wrote to memory of 4372	4248	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\2670229271fa85f2b2b16b586a4c73853fcc8e6bebf3e5c909e29eb21e539825.exe
"C:\Users\Admin\AppData\Local\Temp\2670229271fa85f2b2b16b586a4c73853fcc8e6bebf3e5c909e29eb21e539825.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
  C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\2670229271fa85f2b2b16b586a4c73853fcc8e6bebf3e5c909e29eb21e539825.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4248
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:4372