sakula | 80674a5bf3e9e2005bbae5d5e1ff0071b00ee6a2436c282cb94ff3ce56a9d906

General

Target

80674a5bf3e9e2005bbae5d5e1ff0071b00ee6a2436c282cb94ff3ce56a9d906.exe
Size

324KB
MD5

0f3705fef1ba5a9cf4e8c77def7baec9
SHA1

614c5b3ac3f03f8566d7815f4e143826b1d4d402
SHA256

80674a5bf3e9e2005bbae5d5e1ff0071b00ee6a2436c282cb94ff3ce56a9d906
SHA512

48206e4978ef1083f40e28d66c069f1f14ad2d36fbb9abe464eff2bd25cbc643dc406601afa4bb88aa07dd92e390c95a2cedcec31d0cb6a0bc2ca24ce081e64e

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula Payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula

Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

3844 MediaCenter.exe

pid	process
3844	MediaCenter.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

80674a5bf3e9e2005bbae5d5e1ff0071b00ee6a2436c282cb94ff3ce56a9d906.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	80674a5bf3e9e2005bbae5d5e1ff0071b00ee6a2436c282cb94ff3ce56a9d906.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

80674a5bf3e9e2005bbae5d5e1ff0071b00ee6a2436c282cb94ff3ce56a9d906.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	80674a5bf3e9e2005bbae5d5e1ff0071b00ee6a2436c282cb94ff3ce56a9d906.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

4164 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

80674a5bf3e9e2005bbae5d5e1ff0071b00ee6a2436c282cb94ff3ce56a9d906.exe

description pid process

Token: SeIncBasePriorityPrivilege 1164 80674a5bf3e9e2005bbae5d5e1ff0071b00ee6a2436c282cb94ff3ce56a9d906.exe

pid	process
4164	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1164	80674a5bf3e9e2005bbae5d5e1ff0071b00ee6a2436c282cb94ff3ce56a9d906.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

80674a5bf3e9e2005bbae5d5e1ff0071b00ee6a2436c282cb94ff3ce56a9d906.execmd.exe

description	pid	process	target process
PID 1164 wrote to memory of 3844	1164	80674a5bf3e9e2005bbae5d5e1ff0071b00ee6a2436c282cb94ff3ce56a9d906.exe	MediaCenter.exe
PID 1164 wrote to memory of 3844	1164	80674a5bf3e9e2005bbae5d5e1ff0071b00ee6a2436c282cb94ff3ce56a9d906.exe	MediaCenter.exe
PID 1164 wrote to memory of 3844	1164	80674a5bf3e9e2005bbae5d5e1ff0071b00ee6a2436c282cb94ff3ce56a9d906.exe	MediaCenter.exe
PID 1164 wrote to memory of 4296	1164	80674a5bf3e9e2005bbae5d5e1ff0071b00ee6a2436c282cb94ff3ce56a9d906.exe	cmd.exe
PID 1164 wrote to memory of 4296	1164	80674a5bf3e9e2005bbae5d5e1ff0071b00ee6a2436c282cb94ff3ce56a9d906.exe	cmd.exe
PID 1164 wrote to memory of 4296	1164	80674a5bf3e9e2005bbae5d5e1ff0071b00ee6a2436c282cb94ff3ce56a9d906.exe	cmd.exe
PID 4296 wrote to memory of 4164	4296	cmd.exe	PING.EXE
PID 4296 wrote to memory of 4164	4296	cmd.exe	PING.EXE
PID 4296 wrote to memory of 4164	4296	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\80674a5bf3e9e2005bbae5d5e1ff0071b00ee6a2436c282cb94ff3ce56a9d906.exe
"C:\Users\Admin\AppData\Local\Temp\80674a5bf3e9e2005bbae5d5e1ff0071b00ee6a2436c282cb94ff3ce56a9d906.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1164

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:3844

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\80674a5bf3e9e2005bbae5d5e1ff0071b00ee6a2436c282cb94ff3ce56a9d906.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:4296

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:4164

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Filesize
324KB

MD5
991267725d054100133f85ebddcf4182

SHA1
e544ea7f66f1c5c27398b0de2dceec8ebeee3ac5

SHA256
1b524800e7719924443865422e4771da51f10754136d35de61028f4fdc14fe90

SHA512
ec2e0eafa6234ea278b02f34abe6e3b19e8e163a84327874cace226d8ed8742a94b5b7ed4bbf0cc3a84d5a9dd00867193d6778c0e34003643a36e6e14dc4b824

Download Submit
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Filesize
324KB

MD5
991267725d054100133f85ebddcf4182

SHA1
e544ea7f66f1c5c27398b0de2dceec8ebeee3ac5

SHA256
1b524800e7719924443865422e4771da51f10754136d35de61028f4fdc14fe90

SHA512
ec2e0eafa6234ea278b02f34abe6e3b19e8e163a84327874cace226d8ed8742a94b5b7ed4bbf0cc3a84d5a9dd00867193d6778c0e34003643a36e6e14dc4b824

Download Submit
memory/3844-130-0x0000000000000000-mapping.dmp

Download
memory/4164-134-0x0000000000000000-mapping.dmp

Download
memory/4296-133-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads