sakula | 0169e86db28b67c9b44d783c87aa39b8bab2a5d186223b97edd63521e8282007

General

Target

0169e86db28b67c9b44d783c87aa39b8bab2a5d186223b97edd63521e8282007.exe
Size

100KB
MD5

b7b9ff19b2fbb7502b7f12af20635c02
SHA1

b123fc99cd6899b530938aad1603fa4048c6a754
SHA256

0169e86db28b67c9b44d783c87aa39b8bab2a5d186223b97edd63521e8282007
SHA512

b57e02a01bfc061d99ded3e7bf7f6df19e8d39c74fe835349f675707ed456795dff6d10786046bd514a2f9eda3fc4db488b1bc6e946447fa649b4bc9873b55aa

Score

10^/10

sakula persistence rat trojan

Malware Config

Signatures

Sakula
Sakula is a remote access trojan with various capabilities.
trojan rat sakula

Sakula Payload 3 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe	family_sakula
behavioral2/memory/2904-132-0x0000000000400000-0x0000000000420000-memory.dmp	family_sakula

Executes dropped EXE 1 IoCs

Processes:

MediaCenter.exe

pid process

2916 MediaCenter.exe

pid	process
2916	MediaCenter.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

0169e86db28b67c9b44d783c87aa39b8bab2a5d186223b97edd63521e8282007.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	0169e86db28b67c9b44d783c87aa39b8bab2a5d186223b97edd63521e8282007.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

0169e86db28b67c9b44d783c87aa39b8bab2a5d186223b97edd63521e8282007.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe"	0169e86db28b67c9b44d783c87aa39b8bab2a5d186223b97edd63521e8282007.exe

Drops file in Windows directory 3 IoCs

Processes:

svchost.exeTiWorker.exe

description	ioc	process
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat	svchost.exe
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TiWorker.exe
File opened for modification	C:\Windows\WinSxS\pending.xml	TiWorker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

MusNotifyIcon.exe

description	ioc	process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MusNotifyIcon.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MusNotifyIcon.exe

Modifies data under HKEY_USERS 49 IoCs

Processes:

svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "2.155123"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132893199721310100"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4080"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.000000"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4292"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.121852"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0"	svchost.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2164 PING.EXE

pid	process
2164	PING.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

0169e86db28b67c9b44d783c87aa39b8bab2a5d186223b97edd63521e8282007.exeTiWorker.exe

description	pid	process
Token: SeIncBasePriorityPrivilege	2904	0169e86db28b67c9b44d783c87aa39b8bab2a5d186223b97edd63521e8282007.exe
Token: SeSecurityPrivilege	3280	TiWorker.exe
Token: SeRestorePrivilege	3280	TiWorker.exe
Token: SeBackupPrivilege	3280	TiWorker.exe
Token: SeBackupPrivilege	3280	TiWorker.exe
Token: SeRestorePrivilege	3280	TiWorker.exe
Token: SeSecurityPrivilege	3280	TiWorker.exe
Token: SeBackupPrivilege	3280	TiWorker.exe
Token: SeRestorePrivilege	3280	TiWorker.exe
Token: SeSecurityPrivilege	3280	TiWorker.exe
Token: SeBackupPrivilege	3280	TiWorker.exe
Token: SeRestorePrivilege	3280	TiWorker.exe
Token: SeSecurityPrivilege	3280	TiWorker.exe
Token: SeBackupPrivilege	3280	TiWorker.exe
Token: SeRestorePrivilege	3280	TiWorker.exe
Token: SeSecurityPrivilege	3280	TiWorker.exe
Token: SeBackupPrivilege	3280	TiWorker.exe
Token: SeRestorePrivilege	3280	TiWorker.exe
Token: SeSecurityPrivilege	3280	TiWorker.exe
Token: SeBackupPrivilege	3280	TiWorker.exe
Token: SeRestorePrivilege	3280	TiWorker.exe
Token: SeSecurityPrivilege	3280	TiWorker.exe
Token: SeBackupPrivilege	3280	TiWorker.exe
Token: SeRestorePrivilege	3280	TiWorker.exe
Token: SeSecurityPrivilege	3280	TiWorker.exe
Token: SeBackupPrivilege	3280	TiWorker.exe
Token: SeRestorePrivilege	3280	TiWorker.exe
Token: SeSecurityPrivilege	3280	TiWorker.exe
Token: SeBackupPrivilege	3280	TiWorker.exe
Token: SeRestorePrivilege	3280	TiWorker.exe
Token: SeSecurityPrivilege	3280	TiWorker.exe
Token: SeBackupPrivilege	3280	TiWorker.exe
Token: SeRestorePrivilege	3280	TiWorker.exe
Token: SeSecurityPrivilege	3280	TiWorker.exe
Token: SeBackupPrivilege	3280	TiWorker.exe
Token: SeRestorePrivilege	3280	TiWorker.exe
Token: SeSecurityPrivilege	3280	TiWorker.exe
Token: SeBackupPrivilege	3280	TiWorker.exe
Token: SeRestorePrivilege	3280	TiWorker.exe
Token: SeSecurityPrivilege	3280	TiWorker.exe
Token: SeBackupPrivilege	3280	TiWorker.exe
Token: SeRestorePrivilege	3280	TiWorker.exe
Token: SeSecurityPrivilege	3280	TiWorker.exe
Token: SeBackupPrivilege	3280	TiWorker.exe
Token: SeRestorePrivilege	3280	TiWorker.exe
Token: SeSecurityPrivilege	3280	TiWorker.exe
Token: SeBackupPrivilege	3280	TiWorker.exe
Token: SeRestorePrivilege	3280	TiWorker.exe
Token: SeSecurityPrivilege	3280	TiWorker.exe
Token: SeBackupPrivilege	3280	TiWorker.exe
Token: SeRestorePrivilege	3280	TiWorker.exe
Token: SeSecurityPrivilege	3280	TiWorker.exe
Token: SeBackupPrivilege	3280	TiWorker.exe
Token: SeRestorePrivilege	3280	TiWorker.exe
Token: SeSecurityPrivilege	3280	TiWorker.exe
Token: SeBackupPrivilege	3280	TiWorker.exe
Token: SeRestorePrivilege	3280	TiWorker.exe
Token: SeSecurityPrivilege	3280	TiWorker.exe
Token: SeBackupPrivilege	3280	TiWorker.exe
Token: SeRestorePrivilege	3280	TiWorker.exe
Token: SeSecurityPrivilege	3280	TiWorker.exe
Token: SeBackupPrivilege	3280	TiWorker.exe
Token: SeRestorePrivilege	3280	TiWorker.exe
Token: SeSecurityPrivilege	3280	TiWorker.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

0169e86db28b67c9b44d783c87aa39b8bab2a5d186223b97edd63521e8282007.execmd.exe

description	pid	process	target process
PID 2904 wrote to memory of 2916	2904	0169e86db28b67c9b44d783c87aa39b8bab2a5d186223b97edd63521e8282007.exe	MediaCenter.exe
PID 2904 wrote to memory of 2916	2904	0169e86db28b67c9b44d783c87aa39b8bab2a5d186223b97edd63521e8282007.exe	MediaCenter.exe
PID 2904 wrote to memory of 2916	2904	0169e86db28b67c9b44d783c87aa39b8bab2a5d186223b97edd63521e8282007.exe	MediaCenter.exe
PID 2904 wrote to memory of 3708	2904	0169e86db28b67c9b44d783c87aa39b8bab2a5d186223b97edd63521e8282007.exe	cmd.exe
PID 2904 wrote to memory of 3708	2904	0169e86db28b67c9b44d783c87aa39b8bab2a5d186223b97edd63521e8282007.exe	cmd.exe
PID 2904 wrote to memory of 3708	2904	0169e86db28b67c9b44d783c87aa39b8bab2a5d186223b97edd63521e8282007.exe	cmd.exe
PID 3708 wrote to memory of 2164	3708	cmd.exe	PING.EXE
PID 3708 wrote to memory of 2164	3708	cmd.exe	PING.EXE
PID 3708 wrote to memory of 2164	3708	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\0169e86db28b67c9b44d783c87aa39b8bab2a5d186223b97edd63521e8282007.exe
"C:\Users\Admin\AppData\Local\Temp\0169e86db28b67c9b44d783c87aa39b8bab2a5d186223b97edd63521e8282007.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2904

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
2⤵
- Executes dropped EXE
PID:2916

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\0169e86db28b67c9b44d783c87aa39b8bab2a5d186223b97edd63521e8282007.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:3708

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:2164

C:\Windows\system32\MusNotifyIcon.exe
%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13
1⤵
- Checks processor information in registry
PID:2092

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:3600

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3280

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

Remote System Discovery

1

T1018

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
b09185e9829c9f8e2b94e8ba41b7a6dd

SHA1
63448e6efbc12336c0fdfa069354dd777cc34528

SHA256
903b1b4ea22bec3933ccfad5abda0b96fe4ee1780fd536831b25b409273b177d

SHA512
ee6546ac5409fb907f7df12a9768cbc14ccef21475c1917df7d442265fa72afa78632289f5b61cf404cdf4617615ce979742c1379d3bcf39f951c49c9e7c910c

Download Submit
C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
MD5
b09185e9829c9f8e2b94e8ba41b7a6dd

SHA1
63448e6efbc12336c0fdfa069354dd777cc34528

SHA256
903b1b4ea22bec3933ccfad5abda0b96fe4ee1780fd536831b25b409273b177d

SHA512
ee6546ac5409fb907f7df12a9768cbc14ccef21475c1917df7d442265fa72afa78632289f5b61cf404cdf4617615ce979742c1379d3bcf39f951c49c9e7c910c

Download Submit
memory/2904-132-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads