sakula | 2b219ee94ccd3dab012a2a6f5b55e4dde7f0e14d4df72caa6bc650c53ca1c0c1

General

Target

2b219ee94ccd3dab012a2a6f5b55e4dde7f0e14d4df72caa6bc650c53ca1c0c1.exe
Size

152KB
MD5

f7472ef3bf3eec34a8503a80c264a71d
SHA1

ce6c4e674052635bc019ef58e6da6873495d67dc
SHA256

2b219ee94ccd3dab012a2a6f5b55e4dde7f0e14d4df72caa6bc650c53ca1c0c1
SHA512

cd9c97347ff5f18a94aeb03a120eff7df189d6f4b5da2d42864b995b5ff2fbc2e121076bcea37c218bbe2323a07dc4f46417d244e2220a590bffed3c353b95e8

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula Payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula

Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

2964 MediaCenter.exe

pid	process
2964	MediaCenter.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2b219ee94ccd3dab012a2a6f5b55e4dde7f0e14d4df72caa6bc650c53ca1c0c1.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	2b219ee94ccd3dab012a2a6f5b55e4dde7f0e14d4df72caa6bc650c53ca1c0c1.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

2b219ee94ccd3dab012a2a6f5b55e4dde7f0e14d4df72caa6bc650c53ca1c0c1.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	2b219ee94ccd3dab012a2a6f5b55e4dde7f0e14d4df72caa6bc650c53ca1c0c1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

4088 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

2b219ee94ccd3dab012a2a6f5b55e4dde7f0e14d4df72caa6bc650c53ca1c0c1.exe

description pid process

Token: SeIncBasePriorityPrivilege 2440 2b219ee94ccd3dab012a2a6f5b55e4dde7f0e14d4df72caa6bc650c53ca1c0c1.exe

pid	process
4088	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	2440	2b219ee94ccd3dab012a2a6f5b55e4dde7f0e14d4df72caa6bc650c53ca1c0c1.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

2b219ee94ccd3dab012a2a6f5b55e4dde7f0e14d4df72caa6bc650c53ca1c0c1.execmd.exe

description	pid	process	target process
PID 2440 wrote to memory of 2964	2440	2b219ee94ccd3dab012a2a6f5b55e4dde7f0e14d4df72caa6bc650c53ca1c0c1.exe	MediaCenter.exe
PID 2440 wrote to memory of 2964	2440	2b219ee94ccd3dab012a2a6f5b55e4dde7f0e14d4df72caa6bc650c53ca1c0c1.exe	MediaCenter.exe
PID 2440 wrote to memory of 2964	2440	2b219ee94ccd3dab012a2a6f5b55e4dde7f0e14d4df72caa6bc650c53ca1c0c1.exe	MediaCenter.exe
PID 2440 wrote to memory of 2104	2440	2b219ee94ccd3dab012a2a6f5b55e4dde7f0e14d4df72caa6bc650c53ca1c0c1.exe	cmd.exe
PID 2440 wrote to memory of 2104	2440	2b219ee94ccd3dab012a2a6f5b55e4dde7f0e14d4df72caa6bc650c53ca1c0c1.exe	cmd.exe
PID 2440 wrote to memory of 2104	2440	2b219ee94ccd3dab012a2a6f5b55e4dde7f0e14d4df72caa6bc650c53ca1c0c1.exe	cmd.exe
PID 2104 wrote to memory of 4088	2104	cmd.exe	PING.EXE
PID 2104 wrote to memory of 4088	2104	cmd.exe	PING.EXE
PID 2104 wrote to memory of 4088	2104	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\2b219ee94ccd3dab012a2a6f5b55e4dde7f0e14d4df72caa6bc650c53ca1c0c1.exe
"C:\Users\Admin\AppData\Local\Temp\2b219ee94ccd3dab012a2a6f5b55e4dde7f0e14d4df72caa6bc650c53ca1c0c1.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2440

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:2964

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\2b219ee94ccd3dab012a2a6f5b55e4dde7f0e14d4df72caa6bc650c53ca1c0c1.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2104

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:4088

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
55d72d996f223f643f0bf427be37bc11

SHA1
8973ac29c299b3649e626a5d15a55c74f7005d07

SHA256
041cf75bf51a81be9e6c3e95d4c285108ecadcfefa528613f7e8c4783e78883f

SHA512
3671e7ee86192b5b0cb6443af52c8dc68603439838a0b709b93b27b747a583015c7be78c724d6ef1d3b4dc80a042fe29813936433c088cf6ccc8a687e0e71428

Download Submit
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
55d72d996f223f643f0bf427be37bc11

SHA1
8973ac29c299b3649e626a5d15a55c74f7005d07

SHA256
041cf75bf51a81be9e6c3e95d4c285108ecadcfefa528613f7e8c4783e78883f

SHA512
3671e7ee86192b5b0cb6443af52c8dc68603439838a0b709b93b27b747a583015c7be78c724d6ef1d3b4dc80a042fe29813936433c088cf6ccc8a687e0e71428

Download Submit
memory/2104-133-0x0000000000000000-mapping.dmp

Download
memory/2964-130-0x0000000000000000-mapping.dmp

Download
memory/4088-134-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads