sakula | 55e9f10a171e9d676157c5e53df3e7ed31995766bba1f2162b332e33b224f2dc

General

Target
55e9f10a171e9d676157c5e53df3e7ed31995766bba1f2162b332e33b224f2dc.exe
Size 36KB
Sample230809-rtwfasde9w
SHA256 55e9f10a171e9d676157c5e53df3e7ed31995766bba1f2162b332e33b224f2dc
MD5 042c06a52b60145ee089ab26fa108a5e
SHA1 a853e7c421c10b1106e30ab51a06a8a1ece1542a
SHA512 c7d6e369d0705cc90b1b899e748432a5e20ece36c3f539d31f9ed0c750797f219dd9a848a96f5302fcff89d5e2873bb9023ae6ac919ae47ac56812ca605fbe50
SSDEEP 768:TwbYGCv4nuEcJpQK4TQbtKvXwXgA9lJJea+yGCJQqeWnAEv2647DV:TwbYP4nuEApQK4TQbtY2gA9DX+ytBOP
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula payload 4 IoCs

resource	yara_rule
behavioral2/memory/4120-138-0x0000000000400000-0x000000000041A000-memory.dmp	family_sakula
behavioral2/memory/4700-140-0x0000000000400000-0x000000000041A000-memory.dmp	family_sakula
behavioral2/memory/4120-145-0x0000000000400000-0x000000000041A000-memory.dmp	family_sakula
behavioral2/memory/4700-150-0x0000000000400000-0x000000000041A000-memory.dmp	family_sakula

Executes dropped EXE 1 IoCs

pid	Process
4700	MediaCenter.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	55e9f10a171e9d676157c5e53df3e7ed31995766bba1f2162b332e33b224f2dc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2544	PING.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4120	55e9f10a171e9d676157c5e53df3e7ed31995766bba1f2162b332e33b224f2dc.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4120 wrote to memory of 4700	4120	55e9f10a171e9d676157c5e53df3e7ed31995766bba1f2162b332e33b224f2dc.exe	81
PID 4120 wrote to memory of 4700	4120	55e9f10a171e9d676157c5e53df3e7ed31995766bba1f2162b332e33b224f2dc.exe	81
PID 4120 wrote to memory of 4700	4120	55e9f10a171e9d676157c5e53df3e7ed31995766bba1f2162b332e33b224f2dc.exe	81
PID 4120 wrote to memory of 2708	4120	55e9f10a171e9d676157c5e53df3e7ed31995766bba1f2162b332e33b224f2dc.exe	91
PID 4120 wrote to memory of 2708	4120	55e9f10a171e9d676157c5e53df3e7ed31995766bba1f2162b332e33b224f2dc.exe	91
PID 4120 wrote to memory of 2708	4120	55e9f10a171e9d676157c5e53df3e7ed31995766bba1f2162b332e33b224f2dc.exe	91
PID 2708 wrote to memory of 2544	2708	cmd.exe	93
PID 2708 wrote to memory of 2544	2708	cmd.exe	93
PID 2708 wrote to memory of 2544	2708	cmd.exe	93

C:\Users\Admin\AppData\Local\Temp\55e9f10a171e9d676157c5e53df3e7ed31995766bba1f2162b332e33b224f2dc.exe
"C:\Users\Admin\AppData\Local\Temp\55e9f10a171e9d676157c5e53df3e7ed31995766bba1f2162b332e33b224f2dc.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4120
- C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
  C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\55e9f10a171e9d676157c5e53df3e7ed31995766bba1f2162b332e33b224f2dc.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MediaCenter.exe

Path C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Size 36KB
SHA256 499142639d8b73678f723b8421dba6321f347cf1c0b56018d9d3ad2a44e4c06e
MD5 5bc51bb943d77bff3abd94392350eb52
SHA1 2a023be6bd68746473280baadedf20323bac9cf9
SHA512 a30d9c3ec78b6f406ab415cf4fa51ceaa5cfff65f31ae5129d7adf42a4b7bfd85c023ab6ded03c37966c64245da958c508add1e6c4c498fe91d6bf257ebc7b2d
SSDEEP 768:TwbYGCv4nuEcJpQK4TQbtKvXwXgA9lJJea+yGCJQqeWnAEv2647DJ:TwbYP4nuEApQK4TQbtY2gA9DX+ytBOz
MD5 SHA1 SHA512 SSDEEP

Submit Download

MediaCenter.exe

Path C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
Size 36KB
SHA256 499142639d8b73678f723b8421dba6321f347cf1c0b56018d9d3ad2a44e4c06e
MD5 5bc51bb943d77bff3abd94392350eb52
SHA1 2a023be6bd68746473280baadedf20323bac9cf9
SHA512 a30d9c3ec78b6f406ab415cf4fa51ceaa5cfff65f31ae5129d7adf42a4b7bfd85c023ab6ded03c37966c64245da958c508add1e6c4c498fe91d6bf257ebc7b2d
SSDEEP 768:TwbYGCv4nuEcJpQK4TQbtKvXwXgA9lJJea+yGCJQqeWnAEv2647DJ:TwbYP4nuEApQK4TQbtY2gA9DX+ytBOz
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4120-133-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/4120-138-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/4120-145-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/4700-140-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/4700-150-0x0000000000400000-0x000000000041A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads