sakula | e1b632fc81503bdf94df0a27a3bb6059d097927a440a2dfde290ae3e454c2253

General

Target

59471bac048afbc08d7a95e4f1fa48dd_JC.exe
Size

36KB
MD5

59471bac048afbc08d7a95e4f1fa48dd
SHA1

e03d17ae480f4076760a44c9e87216a71d8b8eb7
SHA256

e1b632fc81503bdf94df0a27a3bb6059d097927a440a2dfde290ae3e454c2253
SHA512

3f85e07493a132dd61e08219d1f79b7895ffda889c8a87e7097260c70cae363d00ffea56d429c69946e317449566c4b1d2d8ecb9908ed825b7f2d806d9fd7c82
SSDEEP

768:TwbYGCv4nuEcJpQK4TQbtKvXwXgA9lJJea+yGCJQqeWnAEv2647Dp:TwbYP4nuEApQK4TQbtY2gA9DX+ytBOf

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4688-5-0x0000000000400000-0x000000000041A000-memory.dmp	family_sakula
behavioral2/memory/4484-7-0x0000000000400000-0x000000000041A000-memory.dmp	family_sakula
behavioral2/memory/4688-12-0x0000000000400000-0x000000000041A000-memory.dmp	family_sakula
behavioral2/memory/4484-17-0x0000000000400000-0x000000000041A000-memory.dmp	family_sakula

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

59471bac048afbc08d7a95e4f1fa48dd_JC.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation	59471bac048afbc08d7a95e4f1fa48dd_JC.exe

Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

4484 MediaCenter.exe

pid	process
4484	MediaCenter.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

59471bac048afbc08d7a95e4f1fa48dd_JC.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	59471bac048afbc08d7a95e4f1fa48dd_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

3380 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

59471bac048afbc08d7a95e4f1fa48dd_JC.exe

description pid process

Token: SeIncBasePriorityPrivilege 4688 59471bac048afbc08d7a95e4f1fa48dd_JC.exe

pid	process
3380	PING.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	4688	59471bac048afbc08d7a95e4f1fa48dd_JC.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

59471bac048afbc08d7a95e4f1fa48dd_JC.execmd.exe

description	pid	process	target process
PID 4688 wrote to memory of 4484	4688	59471bac048afbc08d7a95e4f1fa48dd_JC.exe	MediaCenter.exe
PID 4688 wrote to memory of 4484	4688	59471bac048afbc08d7a95e4f1fa48dd_JC.exe	MediaCenter.exe
PID 4688 wrote to memory of 4484	4688	59471bac048afbc08d7a95e4f1fa48dd_JC.exe	MediaCenter.exe
PID 4688 wrote to memory of 4652	4688	59471bac048afbc08d7a95e4f1fa48dd_JC.exe	cmd.exe
PID 4688 wrote to memory of 4652	4688	59471bac048afbc08d7a95e4f1fa48dd_JC.exe	cmd.exe
PID 4688 wrote to memory of 4652	4688	59471bac048afbc08d7a95e4f1fa48dd_JC.exe	cmd.exe
PID 4652 wrote to memory of 3380	4652	cmd.exe	PING.EXE
PID 4652 wrote to memory of 3380	4652	cmd.exe	PING.EXE
PID 4652 wrote to memory of 3380	4652	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\59471bac048afbc08d7a95e4f1fa48dd_JC.exe
"C:\Users\Admin\AppData\Local\Temp\59471bac048afbc08d7a95e4f1fa48dd_JC.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4688

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:4484

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\59471bac048afbc08d7a95e4f1fa48dd_JC.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:4652

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:3380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

Filesize
36KB

MD5
409cbd02b3e55c5d6e01be97f7c9b8bb

SHA1
966a1310161fea5af849d06a9367bc6ba9549a9e

SHA256
ca1c47008d1e24433e442ca02e5dd5f31c82cff7347b4a008a408b518bf4e4be

SHA512
10e2aed7c496e7e126cdd99abd9eff3b5a3f2c35dc4a12450e3d2a7e64b66c5d914f59c8bd638a0bb72a0ec3822110356d38d5222dc9695d45360309d52f1fe0

Download Submit
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

Filesize
36KB

MD5
409cbd02b3e55c5d6e01be97f7c9b8bb

SHA1
966a1310161fea5af849d06a9367bc6ba9549a9e

SHA256
ca1c47008d1e24433e442ca02e5dd5f31c82cff7347b4a008a408b518bf4e4be

SHA512
10e2aed7c496e7e126cdd99abd9eff3b5a3f2c35dc4a12450e3d2a7e64b66c5d914f59c8bd638a0bb72a0ec3822110356d38d5222dc9695d45360309d52f1fe0

Download Submit
memory/4484-7-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/4484-17-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/4688-0-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/4688-5-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/4688-12-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads