sakula | 438f9ed2b694491948810fa0d58203501535c5648b96ae6bc2870f2c83d02553

General

Target
438f9ed2b694491948810fa0d58203501535c5648b96ae6bc2870f2c83d02553.exe
Size 42KB
Sample220707-2fdnfaeffj
SHA256 438f9ed2b694491948810fa0d58203501535c5648b96ae6bc2870f2c83d02553
MD5 2f2a05582e1b8b5a71811c9c68fe3eec
SHA1 22e1cedd966a64615fc76a0a5a3653c058766b80
SHA512 2c22e32b72e76770227452a928f5579dbc799e0260bd8f51f983e16a64f950bb4259cdbd491533bcf94d2cadc95421322e009684dcc60fed148c2ff2195ef07f
MD5 SHA1 SHA512

Score

10^/10

sakula persistence rat suricata trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
suricata: ET MALWARE Possible DEEP PANDA C2 Activity
suricata: ET MALWARE Possible DEEP PANDA C2 Activity
suricata
suricata: ET MALWARE Possible Deep Panda - Sakula/Mivast RAT CnC Beacon 5
suricata: ET MALWARE Possible Deep Panda - Sakula/Mivast RAT CnC Beacon 5
suricata
suricata: ET MALWARE Sakula/Mivast C2 Activity
suricata: ET MALWARE Sakula/Mivast C2 Activity
suricata

Executes dropped EXE 1 IoCs

pid	Process
4264	MediaCenter.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	reg.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
5080	reg.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3320	PING.EXE

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4256 wrote to memory of 4244	4256	438f9ed2b694491948810fa0d58203501535c5648b96ae6bc2870f2c83d02553.exe	85
PID 4256 wrote to memory of 4244	4256	438f9ed2b694491948810fa0d58203501535c5648b96ae6bc2870f2c83d02553.exe	85
PID 4256 wrote to memory of 4244	4256	438f9ed2b694491948810fa0d58203501535c5648b96ae6bc2870f2c83d02553.exe	85
PID 4256 wrote to memory of 4216	4256	438f9ed2b694491948810fa0d58203501535c5648b96ae6bc2870f2c83d02553.exe	86
PID 4256 wrote to memory of 4216	4256	438f9ed2b694491948810fa0d58203501535c5648b96ae6bc2870f2c83d02553.exe	86
PID 4256 wrote to memory of 4216	4256	438f9ed2b694491948810fa0d58203501535c5648b96ae6bc2870f2c83d02553.exe	86
PID 4256 wrote to memory of 4208	4256	438f9ed2b694491948810fa0d58203501535c5648b96ae6bc2870f2c83d02553.exe	89
PID 4256 wrote to memory of 4208	4256	438f9ed2b694491948810fa0d58203501535c5648b96ae6bc2870f2c83d02553.exe	89
PID 4256 wrote to memory of 4208	4256	438f9ed2b694491948810fa0d58203501535c5648b96ae6bc2870f2c83d02553.exe	89
PID 4244 wrote to memory of 5080	4244	cmd.exe	91
PID 4244 wrote to memory of 5080	4244	cmd.exe	91
PID 4244 wrote to memory of 5080	4244	cmd.exe	91
PID 4208 wrote to memory of 3320	4208	cmd.exe	93
PID 4208 wrote to memory of 3320	4208	cmd.exe	93
PID 4208 wrote to memory of 3320	4208	cmd.exe	93
PID 4216 wrote to memory of 4264	4216	cmd.exe	92
PID 4216 wrote to memory of 4264	4216	cmd.exe	92
PID 4216 wrote to memory of 4264	4216	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\438f9ed2b694491948810fa0d58203501535c5648b96ae6bc2870f2c83d02553.exe
"C:\Users\Admin\AppData\Local\Temp\438f9ed2b694491948810fa0d58203501535c5648b96ae6bc2870f2c83d02553.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4244
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:5080
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4216
- - C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
    C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
    3⤵
    - Executes dropped EXE
    PID:4264
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\438f9ed2b694491948810fa0d58203501535c5648b96ae6bc2870f2c83d02553.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4208
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:3320

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MediaCenter.exe

Path C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Size 42KB
SHA256 8cdd24bc06be10709dc04342b5746789735cc2a9d51989683446afba28d7fef1
MD5 5ea51deba882201767343626743a64b3
SHA1 a860528cac8b557bc865b12123ea8990764fb134
SHA512 c45e1290594a6a7e433d93a2c5357b79f99552e2671b8d6a83e3b692b1bcea5bf5211a2b4237e6eb9cd2f50fb1c5aaccee3376684289645996f36ccce5b68a43
SSDEEP 384:xAnyhSksAVndb4G3w2NMsG9OqvhyY3Q6oVxYLCY3WqPxYwyf4o/m7raLdAeM9:bhSksandb4GgyMsp4hyYtoVxYGm1ZAO
MD5 SHA1 SHA512 SSDEEP

Submit Download

MediaCenter.exe

Path C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Size 42KB
SHA256 8cdd24bc06be10709dc04342b5746789735cc2a9d51989683446afba28d7fef1
MD5 5ea51deba882201767343626743a64b3
SHA1 a860528cac8b557bc865b12123ea8990764fb134
SHA512 c45e1290594a6a7e433d93a2c5357b79f99552e2671b8d6a83e3b692b1bcea5bf5211a2b4237e6eb9cd2f50fb1c5aaccee3376684289645996f36ccce5b68a43
SSDEEP 384:xAnyhSksAVndb4G3w2NMsG9OqvhyY3Q6oVxYLCY3WqPxYwyf4o/m7raLdAeM9:bhSksandb4GgyMsp4hyYtoVxYGm1ZAO
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4256-130-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/4256-134-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/4264-140-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/4264-141-0x0000000000400000-0x000000000040B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads