sakula | fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92

General

Target

fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.exe
Size

40KB
MD5

069c1f54a82c6d543fd4363f4277573f
SHA1

3835aec3b01fe1b2e96c5f3db65ca1803a0e2831
SHA256

fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92
SHA512

4444723a40ea49423aee7cc27e6dc00fc978952c2f0c3581b4a2be2902c6d6da33a8a41bc7a5ea281aa2a8c5da0614c80e074ef55f3ec78262e41336d0e190d8

Score

10^/10

sakula persistence rat suricata trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
suricata: ET MALWARE Possible DEEP PANDA C2 Activity
suricata: ET MALWARE Possible DEEP PANDA C2 Activity
suricata
suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 6
suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 6
suricata
suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 7
suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 7
suricata
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1296 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1256 cmd.exe

pid	process
1296	MediaCenter.exe

pid	process
1256	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.exe

pid	process
1452	fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.exe
1452	fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	reg.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

1028 reg.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1668 PING.EXE

pid	process
1028	reg.exe

pid	process
1668	PING.EXE

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.execmd.execmd.exe

description	pid	process	target process
PID 1452 wrote to memory of 1700	1452	fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.exe	cmd.exe
PID 1452 wrote to memory of 1700	1452	fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.exe	cmd.exe
PID 1452 wrote to memory of 1700	1452	fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.exe	cmd.exe
PID 1452 wrote to memory of 1700	1452	fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.exe	cmd.exe
PID 1452 wrote to memory of 1296	1452	fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.exe	MediaCenter.exe
PID 1452 wrote to memory of 1296	1452	fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.exe	MediaCenter.exe
PID 1452 wrote to memory of 1296	1452	fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.exe	MediaCenter.exe
PID 1452 wrote to memory of 1296	1452	fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.exe	MediaCenter.exe
PID 1700 wrote to memory of 1028	1700	cmd.exe	reg.exe
PID 1700 wrote to memory of 1028	1700	cmd.exe	reg.exe
PID 1700 wrote to memory of 1028	1700	cmd.exe	reg.exe
PID 1700 wrote to memory of 1028	1700	cmd.exe	reg.exe
PID 1452 wrote to memory of 1256	1452	fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.exe	cmd.exe
PID 1452 wrote to memory of 1256	1452	fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.exe	cmd.exe
PID 1452 wrote to memory of 1256	1452	fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.exe	cmd.exe
PID 1452 wrote to memory of 1256	1452	fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.exe	cmd.exe
PID 1256 wrote to memory of 1668	1256	cmd.exe	PING.EXE
PID 1256 wrote to memory of 1668	1256	cmd.exe	PING.EXE
PID 1256 wrote to memory of 1668	1256	cmd.exe	PING.EXE
PID 1256 wrote to memory of 1668	1256	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.exe
"C:\Users\Admin\AppData\Local\Temp\fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1452

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1700

C:\Windows\SysWOW64\reg.exe
reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"
3⤵
- Adds Run key to start application
- Modifies registry key
PID:1028

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1296

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1256

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1668

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
f25d83105f98df2e269cf5a5c0d60a95

SHA1
5b9790a7f2eca5da695c215863b491cd9792d457

SHA256
49178a2d9d5ec6d8f71b762b88e42fc1322973eee9bd5b9dd4699b43dc40ecce

SHA512
933e83619fa320b627a76f16cc0ec9293dbcd65a6fbf1fded92e83166576c6569f1f62f709f739bbdfc14cbe4b378d0305503d61cd6c574decbc786dfbc3eb30

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
f25d83105f98df2e269cf5a5c0d60a95

SHA1
5b9790a7f2eca5da695c215863b491cd9792d457

SHA256
49178a2d9d5ec6d8f71b762b88e42fc1322973eee9bd5b9dd4699b43dc40ecce

SHA512
933e83619fa320b627a76f16cc0ec9293dbcd65a6fbf1fded92e83166576c6569f1f62f709f739bbdfc14cbe4b378d0305503d61cd6c574decbc786dfbc3eb30

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
f25d83105f98df2e269cf5a5c0d60a95

SHA1
5b9790a7f2eca5da695c215863b491cd9792d457

SHA256
49178a2d9d5ec6d8f71b762b88e42fc1322973eee9bd5b9dd4699b43dc40ecce

SHA512
933e83619fa320b627a76f16cc0ec9293dbcd65a6fbf1fded92e83166576c6569f1f62f709f739bbdfc14cbe4b378d0305503d61cd6c574decbc786dfbc3eb30

Download Submit
memory/1028-62-0x0000000000000000-mapping.dmp

Download
memory/1256-64-0x0000000000000000-mapping.dmp

Download
memory/1296-59-0x0000000000000000-mapping.dmp

Download
memory/1296-63-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1452-54-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download
memory/1452-55-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1668-65-0x0000000000000000-mapping.dmp

Download
memory/1700-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads