sakula | 11813e32bd55267ddd0c1aaffbfd2b01e9824d18d711fdad4947aa123bb21e08

General

Target

11813e32bd55267ddd0c1aaffbfd2b01e9824d18d711fdad4947aa123bb21e08.exe
Size

60KB
MD5

ae01b470851756cb51251f41924324ef
SHA1

e0a4cd8523669e2678a877efe3dd380178aed71f
SHA256

11813e32bd55267ddd0c1aaffbfd2b01e9824d18d711fdad4947aa123bb21e08
SHA512

6a322653f9a75ac575a0ae61f15fe8cab4c45b238f9b7ef8a798f33bede8407f872a3bd2ee292e6caf4d9cba759428baa2d60b103fcd70df47f8014b3599c0b6

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula
Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

3312 MediaCenter.exe

pid	process
3312	MediaCenter.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

11813e32bd55267ddd0c1aaffbfd2b01e9824d18d711fdad4947aa123bb21e08.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	11813e32bd55267ddd0c1aaffbfd2b01e9824d18d711fdad4947aa123bb21e08.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

11813e32bd55267ddd0c1aaffbfd2b01e9824d18d711fdad4947aa123bb21e08.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	11813e32bd55267ddd0c1aaffbfd2b01e9824d18d711fdad4947aa123bb21e08.exe

Drops file in Windows directory 3 IoCs

Processes:

svchost.exeTiWorker.exe

description	ioc	process
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat	svchost.exe
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TiWorker.exe
File opened for modification	C:\Windows\WinSxS\pending.xml	TiWorker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

MusNotifyIcon.exe

description	ioc	process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MusNotifyIcon.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MusNotifyIcon.exe

Modifies data under HKEY_USERS 49 IoCs

Processes:

svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "9.520827"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "1.851865"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132892952256502360"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "12.501980"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4092"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4288"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0"	svchost.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2040 PING.EXE

pid	process
2040	PING.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

11813e32bd55267ddd0c1aaffbfd2b01e9824d18d711fdad4947aa123bb21e08.exeTiWorker.exe

description	pid	process
Token: SeIncBasePriorityPrivilege	1004	11813e32bd55267ddd0c1aaffbfd2b01e9824d18d711fdad4947aa123bb21e08.exe
Token: SeSecurityPrivilege	2592	TiWorker.exe
Token: SeRestorePrivilege	2592	TiWorker.exe
Token: SeBackupPrivilege	2592	TiWorker.exe
Token: SeBackupPrivilege	2592	TiWorker.exe
Token: SeRestorePrivilege	2592	TiWorker.exe
Token: SeSecurityPrivilege	2592	TiWorker.exe
Token: SeBackupPrivilege	2592	TiWorker.exe
Token: SeRestorePrivilege	2592	TiWorker.exe
Token: SeSecurityPrivilege	2592	TiWorker.exe
Token: SeBackupPrivilege	2592	TiWorker.exe
Token: SeRestorePrivilege	2592	TiWorker.exe
Token: SeSecurityPrivilege	2592	TiWorker.exe
Token: SeBackupPrivilege	2592	TiWorker.exe
Token: SeRestorePrivilege	2592	TiWorker.exe
Token: SeSecurityPrivilege	2592	TiWorker.exe
Token: SeBackupPrivilege	2592	TiWorker.exe
Token: SeRestorePrivilege	2592	TiWorker.exe
Token: SeSecurityPrivilege	2592	TiWorker.exe
Token: SeBackupPrivilege	2592	TiWorker.exe
Token: SeRestorePrivilege	2592	TiWorker.exe
Token: SeSecurityPrivilege	2592	TiWorker.exe
Token: SeBackupPrivilege	2592	TiWorker.exe
Token: SeRestorePrivilege	2592	TiWorker.exe
Token: SeSecurityPrivilege	2592	TiWorker.exe
Token: SeBackupPrivilege	2592	TiWorker.exe
Token: SeRestorePrivilege	2592	TiWorker.exe
Token: SeSecurityPrivilege	2592	TiWorker.exe
Token: SeBackupPrivilege	2592	TiWorker.exe
Token: SeRestorePrivilege	2592	TiWorker.exe
Token: SeSecurityPrivilege	2592	TiWorker.exe
Token: SeBackupPrivilege	2592	TiWorker.exe
Token: SeRestorePrivilege	2592	TiWorker.exe
Token: SeSecurityPrivilege	2592	TiWorker.exe
Token: SeBackupPrivilege	2592	TiWorker.exe
Token: SeRestorePrivilege	2592	TiWorker.exe
Token: SeSecurityPrivilege	2592	TiWorker.exe
Token: SeBackupPrivilege	2592	TiWorker.exe
Token: SeRestorePrivilege	2592	TiWorker.exe
Token: SeSecurityPrivilege	2592	TiWorker.exe
Token: SeBackupPrivilege	2592	TiWorker.exe
Token: SeRestorePrivilege	2592	TiWorker.exe
Token: SeSecurityPrivilege	2592	TiWorker.exe
Token: SeBackupPrivilege	2592	TiWorker.exe
Token: SeRestorePrivilege	2592	TiWorker.exe
Token: SeSecurityPrivilege	2592	TiWorker.exe
Token: SeBackupPrivilege	2592	TiWorker.exe
Token: SeRestorePrivilege	2592	TiWorker.exe
Token: SeSecurityPrivilege	2592	TiWorker.exe
Token: SeBackupPrivilege	2592	TiWorker.exe
Token: SeRestorePrivilege	2592	TiWorker.exe
Token: SeSecurityPrivilege	2592	TiWorker.exe
Token: SeBackupPrivilege	2592	TiWorker.exe
Token: SeRestorePrivilege	2592	TiWorker.exe
Token: SeSecurityPrivilege	2592	TiWorker.exe
Token: SeBackupPrivilege	2592	TiWorker.exe
Token: SeRestorePrivilege	2592	TiWorker.exe
Token: SeSecurityPrivilege	2592	TiWorker.exe
Token: SeBackupPrivilege	2592	TiWorker.exe
Token: SeRestorePrivilege	2592	TiWorker.exe
Token: SeSecurityPrivilege	2592	TiWorker.exe
Token: SeBackupPrivilege	2592	TiWorker.exe
Token: SeRestorePrivilege	2592	TiWorker.exe
Token: SeSecurityPrivilege	2592	TiWorker.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

11813e32bd55267ddd0c1aaffbfd2b01e9824d18d711fdad4947aa123bb21e08.execmd.exe

description	pid	process	target process
PID 1004 wrote to memory of 3312	1004	11813e32bd55267ddd0c1aaffbfd2b01e9824d18d711fdad4947aa123bb21e08.exe	MediaCenter.exe
PID 1004 wrote to memory of 3312	1004	11813e32bd55267ddd0c1aaffbfd2b01e9824d18d711fdad4947aa123bb21e08.exe	MediaCenter.exe
PID 1004 wrote to memory of 3312	1004	11813e32bd55267ddd0c1aaffbfd2b01e9824d18d711fdad4947aa123bb21e08.exe	MediaCenter.exe
PID 1004 wrote to memory of 2116	1004	11813e32bd55267ddd0c1aaffbfd2b01e9824d18d711fdad4947aa123bb21e08.exe	cmd.exe
PID 1004 wrote to memory of 2116	1004	11813e32bd55267ddd0c1aaffbfd2b01e9824d18d711fdad4947aa123bb21e08.exe	cmd.exe
PID 1004 wrote to memory of 2116	1004	11813e32bd55267ddd0c1aaffbfd2b01e9824d18d711fdad4947aa123bb21e08.exe	cmd.exe
PID 2116 wrote to memory of 2040	2116	cmd.exe	PING.EXE
PID 2116 wrote to memory of 2040	2116	cmd.exe	PING.EXE
PID 2116 wrote to memory of 2040	2116	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\11813e32bd55267ddd0c1aaffbfd2b01e9824d18d711fdad4947aa123bb21e08.exe
"C:\Users\Admin\AppData\Local\Temp\11813e32bd55267ddd0c1aaffbfd2b01e9824d18d711fdad4947aa123bb21e08.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1004

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:3312

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\11813e32bd55267ddd0c1aaffbfd2b01e9824d18d711fdad4947aa123bb21e08.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2116

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:2040

C:\Windows\system32\MusNotifyIcon.exe
%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13
1⤵
- Checks processor information in registry
PID:3772

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2036

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2592

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

Remote System Discovery

1

T1018

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
1964a29c6e724cea7e77bf1243c4972d

SHA1
85e24074d1488af1057c4898fac765ed37e61cb5

SHA256
91744b0d980a00197072aa9640bcb076d18567f59c57ad8bcb11b23f67af25fc

SHA512
b562323f04906a5d96e1d236cc5d0653806d61668696cfcb5b375a9654e12f0ee04b282396d1683542e7f6a723ccab67a41bfb598b7dbbf0ea7eec672e1ad543

Download Submit
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5
1964a29c6e724cea7e77bf1243c4972d

SHA1
85e24074d1488af1057c4898fac765ed37e61cb5

SHA256
91744b0d980a00197072aa9640bcb076d18567f59c57ad8bcb11b23f67af25fc

SHA512
b562323f04906a5d96e1d236cc5d0653806d61668696cfcb5b375a9654e12f0ee04b282396d1683542e7f6a723ccab67a41bfb598b7dbbf0ea7eec672e1ad543

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads