sakula | fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92

General

Target

fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.exe
Size

40KB
MD5

069c1f54a82c6d543fd4363f4277573f
SHA1

3835aec3b01fe1b2e96c5f3db65ca1803a0e2831
SHA256

fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92
SHA512

4444723a40ea49423aee7cc27e6dc00fc978952c2f0c3581b4a2be2902c6d6da33a8a41bc7a5ea281aa2a8c5da0614c80e074ef55f3ec78262e41336d0e190d8

Score

10^/10

sakula persistence rat suricata trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
suricata: ET MALWARE Possible DEEP PANDA C2 Activity
suricata: ET MALWARE Possible DEEP PANDA C2 Activity
suricata
suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 6
suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 6
suricata
suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 7
suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 7
suricata
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1180 MediaCenter.exe

pid	process
1180	MediaCenter.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	reg.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

1656 reg.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1160 PING.EXE

pid	process
1656	reg.exe

pid	process
1160	PING.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.execmd.execmd.exe

description	pid	process	target process
PID 3872 wrote to memory of 3048	3872	fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.exe	cmd.exe
PID 3872 wrote to memory of 3048	3872	fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.exe	cmd.exe
PID 3872 wrote to memory of 3048	3872	fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.exe	cmd.exe
PID 3872 wrote to memory of 1180	3872	fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.exe	MediaCenter.exe
PID 3872 wrote to memory of 1180	3872	fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.exe	MediaCenter.exe
PID 3872 wrote to memory of 1180	3872	fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.exe	MediaCenter.exe
PID 3048 wrote to memory of 1656	3048	cmd.exe	reg.exe
PID 3048 wrote to memory of 1656	3048	cmd.exe	reg.exe
PID 3048 wrote to memory of 1656	3048	cmd.exe	reg.exe
PID 3872 wrote to memory of 2556	3872	fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.exe	cmd.exe
PID 3872 wrote to memory of 2556	3872	fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.exe	cmd.exe
PID 3872 wrote to memory of 2556	3872	fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.exe	cmd.exe
PID 2556 wrote to memory of 1160	2556	cmd.exe	PING.EXE
PID 2556 wrote to memory of 1160	2556	cmd.exe	PING.EXE
PID 2556 wrote to memory of 1160	2556	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.exe
"C:\Users\Admin\AppData\Local\Temp\fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3872

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:3048

C:\Windows\SysWOW64\reg.exe
reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"
3⤵
- Adds Run key to start application
- Modifies registry key
PID:1656

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1180

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2556

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1160

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
8f6c3aa814fbc4c24fcd4b65f0c199db

SHA1
00da63e776df1ed6599b99d7590bfd0a4ab3d323

SHA256
b0ec60dc83c9aec349eac46ff6d23ef8ed2c64658eca11679d6c03a9ebb40023

SHA512
549fa7565730b7dfb3f7293889b1186ce30595f3147603b6b316aba725072bd84e211636cd1706b5fd396a1d6b49c7ab20c1b0bfe9c48dd6f2de72b5ab46896d

Download Submit
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
8f6c3aa814fbc4c24fcd4b65f0c199db

SHA1
00da63e776df1ed6599b99d7590bfd0a4ab3d323

SHA256
b0ec60dc83c9aec349eac46ff6d23ef8ed2c64658eca11679d6c03a9ebb40023

SHA512
549fa7565730b7dfb3f7293889b1186ce30595f3147603b6b316aba725072bd84e211636cd1706b5fd396a1d6b49c7ab20c1b0bfe9c48dd6f2de72b5ab46896d

Download Submit
memory/1160-141-0x0000000000000000-mapping.dmp

Download
memory/1180-136-0x0000000000000000-mapping.dmp

Download
memory/1656-139-0x0000000000000000-mapping.dmp

Download
memory/2556-140-0x0000000000000000-mapping.dmp

Download
memory/3048-135-0x0000000000000000-mapping.dmp

Download
memory/3872-134-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing