sakula | 4f28b81037b0e81591f472fbb68c2874e6bab354fe0bf2572d013ae9ff9a3769

General

Target

4f28b81037b0e81591f472fbb68c2874e6bab354fe0bf2572d013ae9ff9a3769.exe
Size

88KB
MD5

95798d3fa38084bc973dc4ea09c06455
SHA1

e820f73f713eb38d853b5b2da3a9c153c36750a5
SHA256

4f28b81037b0e81591f472fbb68c2874e6bab354fe0bf2572d013ae9ff9a3769
SHA512

78c378db1aaeb8b80ac54462f9e3b1f660e70c7cd587f04ff7c1ab5378f413bf1268674524931dcad55ebd32405621cc8f0a69a3480bbbdaf54d977c20634258
SSDEEP

1536:Boaj1hJL1S9t0MIeboal8bCKxo7h0RP0jwHVz30rtroyPTEz7:y0hpgz6xGhTjwHN30BEybE3

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula payload 3 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula

Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

1948 MediaCenter.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

996 cmd.exe

pid	process
1948	MediaCenter.exe

pid	process
996	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

4f28b81037b0e81591f472fbb68c2874e6bab354fe0bf2572d013ae9ff9a3769.exe

pid	process
1880	4f28b81037b0e81591f472fbb68c2874e6bab354fe0bf2572d013ae9ff9a3769.exe
1880	4f28b81037b0e81591f472fbb68c2874e6bab354fe0bf2572d013ae9ff9a3769.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

4f28b81037b0e81591f472fbb68c2874e6bab354fe0bf2572d013ae9ff9a3769.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	4f28b81037b0e81591f472fbb68c2874e6bab354fe0bf2572d013ae9ff9a3769.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1056 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

4f28b81037b0e81591f472fbb68c2874e6bab354fe0bf2572d013ae9ff9a3769.exe

description pid process

Token: SeIncBasePriorityPrivilege 1880 4f28b81037b0e81591f472fbb68c2874e6bab354fe0bf2572d013ae9ff9a3769.exe

pid	process
1056	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	1880	4f28b81037b0e81591f472fbb68c2874e6bab354fe0bf2572d013ae9ff9a3769.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

4f28b81037b0e81591f472fbb68c2874e6bab354fe0bf2572d013ae9ff9a3769.execmd.exe

description	pid	process	target process
PID 1880 wrote to memory of 1948	1880	4f28b81037b0e81591f472fbb68c2874e6bab354fe0bf2572d013ae9ff9a3769.exe	MediaCenter.exe
PID 1880 wrote to memory of 1948	1880	4f28b81037b0e81591f472fbb68c2874e6bab354fe0bf2572d013ae9ff9a3769.exe	MediaCenter.exe
PID 1880 wrote to memory of 1948	1880	4f28b81037b0e81591f472fbb68c2874e6bab354fe0bf2572d013ae9ff9a3769.exe	MediaCenter.exe
PID 1880 wrote to memory of 1948	1880	4f28b81037b0e81591f472fbb68c2874e6bab354fe0bf2572d013ae9ff9a3769.exe	MediaCenter.exe
PID 1880 wrote to memory of 996	1880	4f28b81037b0e81591f472fbb68c2874e6bab354fe0bf2572d013ae9ff9a3769.exe	cmd.exe
PID 1880 wrote to memory of 996	1880	4f28b81037b0e81591f472fbb68c2874e6bab354fe0bf2572d013ae9ff9a3769.exe	cmd.exe
PID 1880 wrote to memory of 996	1880	4f28b81037b0e81591f472fbb68c2874e6bab354fe0bf2572d013ae9ff9a3769.exe	cmd.exe
PID 1880 wrote to memory of 996	1880	4f28b81037b0e81591f472fbb68c2874e6bab354fe0bf2572d013ae9ff9a3769.exe	cmd.exe
PID 996 wrote to memory of 1056	996	cmd.exe	PING.EXE
PID 996 wrote to memory of 1056	996	cmd.exe	PING.EXE
PID 996 wrote to memory of 1056	996	cmd.exe	PING.EXE
PID 996 wrote to memory of 1056	996	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\4f28b81037b0e81591f472fbb68c2874e6bab354fe0bf2572d013ae9ff9a3769.exe
"C:\Users\Admin\AppData\Local\Temp\4f28b81037b0e81591f472fbb68c2874e6bab354fe0bf2572d013ae9ff9a3769.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1880

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:1948

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\4f28b81037b0e81591f472fbb68c2874e6bab354fe0bf2572d013ae9ff9a3769.exe"
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:996

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1056

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Filesize
88KB

MD5
093edb3847d3a60e691c5e75c475310e

SHA1
91f69cf74ee673a9e6114321221027824205e1b7

SHA256
165820600f19e887fb83504a7048bca631840af29847a5438eb291506f95266e

SHA512
b3c66af7fec9600b0514c5d478b7fb46c899ddd57ff665822473f95701ae1ad6b99b03faef487c1f40dc6eec06ebc110af282878c5d5e3497dd53bdda7904063

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Filesize
88KB

MD5
093edb3847d3a60e691c5e75c475310e

SHA1
91f69cf74ee673a9e6114321221027824205e1b7

SHA256
165820600f19e887fb83504a7048bca631840af29847a5438eb291506f95266e

SHA512
b3c66af7fec9600b0514c5d478b7fb46c899ddd57ff665822473f95701ae1ad6b99b03faef487c1f40dc6eec06ebc110af282878c5d5e3497dd53bdda7904063

Download Submit
\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Filesize
88KB

MD5
093edb3847d3a60e691c5e75c475310e

SHA1
91f69cf74ee673a9e6114321221027824205e1b7

SHA256
165820600f19e887fb83504a7048bca631840af29847a5438eb291506f95266e

SHA512
b3c66af7fec9600b0514c5d478b7fb46c899ddd57ff665822473f95701ae1ad6b99b03faef487c1f40dc6eec06ebc110af282878c5d5e3497dd53bdda7904063

Download Submit
memory/996-60-0x0000000000000000-mapping.dmp

Download
memory/1056-61-0x0000000000000000-mapping.dmp

Download
memory/1880-54-0x0000000075D71000-0x0000000075D73000-memory.dmp

Filesize
8KB

Download
memory/1948-57-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads