sakula | 2772c05ccb98243d81ffda3e7355aa4542b536267897bfcbc05fe74aea1efd69

General

Target

2772c05ccb98243d81ffda3e7355aa4542b536267897bfcbc05fe74aea1efd69.exe
Size

29KB
MD5

024520b4edebd33be477effbb6bf2cd9
SHA1

1f334ce297995bfe213821b3f50ed67d35e1c543
SHA256

2772c05ccb98243d81ffda3e7355aa4542b536267897bfcbc05fe74aea1efd69
SHA512

279b492720a12ac276e399a339d581ed8889d22afd054eacd604da6b271725ee6d7ac41342fd03940ea28a9aabb7bc90c927b7d067bccabf72c429c8ffe74880

Score

10^/10

sakula persistence rat suricata trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
suricata: ET MALWARE Possible DEEP PANDA C2 Activity
suricata: ET MALWARE Possible DEEP PANDA C2 Activity
suricata
suricata: ET MALWARE Possible Deep Panda - Sakula/Mivast RAT CnC Beacon 5
suricata: ET MALWARE Possible Deep Panda - Sakula/Mivast RAT CnC Beacon 5
suricata
suricata: ET MALWARE Sakula/Mivast C2 Activity
suricata: ET MALWARE Sakula/Mivast C2 Activity
suricata
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1536 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

888 cmd.exe
Loads dropped DLL 2 IoCs

Processes:

cmd.exe

pid process

1276 cmd.exe
1276 cmd.exe

pid	process
1536	MediaCenter.exe

pid	process
888	cmd.exe

pid	process
1276	cmd.exe
1276	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	reg.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

1764 reg.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

892 PING.EXE

pid	process
1764	reg.exe

pid	process
892	PING.EXE

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

2772c05ccb98243d81ffda3e7355aa4542b536267897bfcbc05fe74aea1efd69.execmd.execmd.execmd.exe

description	pid	process	target process
PID 2008 wrote to memory of 1204	2008	2772c05ccb98243d81ffda3e7355aa4542b536267897bfcbc05fe74aea1efd69.exe	cmd.exe
PID 2008 wrote to memory of 1204	2008	2772c05ccb98243d81ffda3e7355aa4542b536267897bfcbc05fe74aea1efd69.exe	cmd.exe
PID 2008 wrote to memory of 1204	2008	2772c05ccb98243d81ffda3e7355aa4542b536267897bfcbc05fe74aea1efd69.exe	cmd.exe
PID 2008 wrote to memory of 1204	2008	2772c05ccb98243d81ffda3e7355aa4542b536267897bfcbc05fe74aea1efd69.exe	cmd.exe
PID 2008 wrote to memory of 1276	2008	2772c05ccb98243d81ffda3e7355aa4542b536267897bfcbc05fe74aea1efd69.exe	cmd.exe
PID 2008 wrote to memory of 1276	2008	2772c05ccb98243d81ffda3e7355aa4542b536267897bfcbc05fe74aea1efd69.exe	cmd.exe
PID 2008 wrote to memory of 1276	2008	2772c05ccb98243d81ffda3e7355aa4542b536267897bfcbc05fe74aea1efd69.exe	cmd.exe
PID 2008 wrote to memory of 1276	2008	2772c05ccb98243d81ffda3e7355aa4542b536267897bfcbc05fe74aea1efd69.exe	cmd.exe
PID 2008 wrote to memory of 888	2008	2772c05ccb98243d81ffda3e7355aa4542b536267897bfcbc05fe74aea1efd69.exe	cmd.exe
PID 2008 wrote to memory of 888	2008	2772c05ccb98243d81ffda3e7355aa4542b536267897bfcbc05fe74aea1efd69.exe	cmd.exe
PID 2008 wrote to memory of 888	2008	2772c05ccb98243d81ffda3e7355aa4542b536267897bfcbc05fe74aea1efd69.exe	cmd.exe
PID 2008 wrote to memory of 888	2008	2772c05ccb98243d81ffda3e7355aa4542b536267897bfcbc05fe74aea1efd69.exe	cmd.exe
PID 1276 wrote to memory of 1536	1276	cmd.exe	MediaCenter.exe
PID 1276 wrote to memory of 1536	1276	cmd.exe	MediaCenter.exe
PID 1276 wrote to memory of 1536	1276	cmd.exe	MediaCenter.exe
PID 1276 wrote to memory of 1536	1276	cmd.exe	MediaCenter.exe
PID 888 wrote to memory of 892	888	cmd.exe	PING.EXE
PID 888 wrote to memory of 892	888	cmd.exe	PING.EXE
PID 888 wrote to memory of 892	888	cmd.exe	PING.EXE
PID 888 wrote to memory of 892	888	cmd.exe	PING.EXE
PID 1204 wrote to memory of 1764	1204	cmd.exe	reg.exe
PID 1204 wrote to memory of 1764	1204	cmd.exe	reg.exe
PID 1204 wrote to memory of 1764	1204	cmd.exe	reg.exe
PID 1204 wrote to memory of 1764	1204	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\2772c05ccb98243d81ffda3e7355aa4542b536267897bfcbc05fe74aea1efd69.exe
"C:\Users\Admin\AppData\Local\Temp\2772c05ccb98243d81ffda3e7355aa4542b536267897bfcbc05fe74aea1efd69.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2008

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1204

C:\Windows\SysWOW64\reg.exe
reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"
3⤵
- Adds Run key to start application
- Modifies registry key
PID:1764

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1276

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
3⤵
- Executes dropped EXE
PID:1536

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\2772c05ccb98243d81ffda3e7355aa4542b536267897bfcbc05fe74aea1efd69.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:888

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:892

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Filesize
29KB

MD5
9b4092909dcf9216308002ee9a9a4b6e

SHA1
2f7b9fa34a4f8064ec8de8b8887121cb521f0fcf

SHA256
f210208fd46166c9bdec04809e86dd9204970df8c4d9e3127fa55052cc1b4951

SHA512
612fdb53e652fba0229f6e0a0b6d9d1b481dbc37003b35b03ad3226d99def41b2f1e85613b7a9c73f73dbbbb513582407529173029df89cf3637a55dd48a24a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Filesize
29KB

MD5
9b4092909dcf9216308002ee9a9a4b6e

SHA1
2f7b9fa34a4f8064ec8de8b8887121cb521f0fcf

SHA256
f210208fd46166c9bdec04809e86dd9204970df8c4d9e3127fa55052cc1b4951

SHA512
612fdb53e652fba0229f6e0a0b6d9d1b481dbc37003b35b03ad3226d99def41b2f1e85613b7a9c73f73dbbbb513582407529173029df89cf3637a55dd48a24a5

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Filesize
29KB

MD5
9b4092909dcf9216308002ee9a9a4b6e

SHA1
2f7b9fa34a4f8064ec8de8b8887121cb521f0fcf

SHA256
f210208fd46166c9bdec04809e86dd9204970df8c4d9e3127fa55052cc1b4951

SHA512
612fdb53e652fba0229f6e0a0b6d9d1b481dbc37003b35b03ad3226d99def41b2f1e85613b7a9c73f73dbbbb513582407529173029df89cf3637a55dd48a24a5

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Filesize
29KB

MD5
9b4092909dcf9216308002ee9a9a4b6e

SHA1
2f7b9fa34a4f8064ec8de8b8887121cb521f0fcf

SHA256
f210208fd46166c9bdec04809e86dd9204970df8c4d9e3127fa55052cc1b4951

SHA512
612fdb53e652fba0229f6e0a0b6d9d1b481dbc37003b35b03ad3226d99def41b2f1e85613b7a9c73f73dbbbb513582407529173029df89cf3637a55dd48a24a5

Download Submit
memory/888-58-0x0000000000000000-mapping.dmp

Download
memory/892-63-0x0000000000000000-mapping.dmp

Download
memory/1204-56-0x0000000000000000-mapping.dmp

Download
memory/1276-57-0x0000000000000000-mapping.dmp

Download
memory/1536-62-0x0000000000000000-mapping.dmp

Download
memory/1536-67-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1764-66-0x0000000000000000-mapping.dmp

Download
memory/2008-54-0x00000000754A1000-0x00000000754A3000-memory.dmp

Filesize
8KB

Download
memory/2008-55-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing