Malware Analysis Report

2025-01-02 02:54

Sample ID 220222-pt2afaaabn
Target dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c
SHA256 dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c
Tags
sakula persistence rat suricata trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c

Threat Level: Known bad

The file dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c was found to be: Known bad.

Malicious Activity Summary

sakula persistence rat suricata trojan

suricata: ET MALWARE Possible Deep Panda - Sakula/Mivast RAT CnC Beacon 5

Sakula

suricata: ET MALWARE Sakula/Mivast C2 Activity

suricata: ET MALWARE Possible DEEP PANDA C2 Activity

Executes dropped EXE

Deletes itself

Loads dropped DLL

Adds Run key to start application

Drops file in Windows directory

Checks processor information in registry

Suspicious use of WriteProcessMemory

Modifies registry key

Runs ping.exe

Modifies data under HKEY_USERS

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-02-22 12:38

Signatures

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2022-02-22 12:38

Reported

2022-02-22 12:42

Platform

win10-en-20211208

Max time kernel

246s

Max time network

254s

Command Line

"C:\Users\Admin\AppData\Local\Temp\dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe"

Signatures

Sakula

trojan rat sakula

suricata: ET MALWARE Possible DEEP PANDA C2 Activity

suricata

suricata: ET MALWARE Possible Deep Panda - Sakula/Mivast RAT CnC Beacon 5

suricata

suricata: ET MALWARE Sakula/Mivast C2 Activity

suricata

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" C:\Windows\SysWOW64\reg.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4116 wrote to memory of 4128 N/A C:\Users\Admin\AppData\Local\Temp\dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe C:\Windows\SysWOW64\cmd.exe
PID 4116 wrote to memory of 4128 N/A C:\Users\Admin\AppData\Local\Temp\dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe C:\Windows\SysWOW64\cmd.exe
PID 4116 wrote to memory of 4128 N/A C:\Users\Admin\AppData\Local\Temp\dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe C:\Windows\SysWOW64\cmd.exe
PID 4116 wrote to memory of 3480 N/A C:\Users\Admin\AppData\Local\Temp\dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe C:\Windows\SysWOW64\cmd.exe
PID 4116 wrote to memory of 3480 N/A C:\Users\Admin\AppData\Local\Temp\dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe C:\Windows\SysWOW64\cmd.exe
PID 4116 wrote to memory of 3480 N/A C:\Users\Admin\AppData\Local\Temp\dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe C:\Windows\SysWOW64\cmd.exe
PID 4116 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe C:\Windows\SysWOW64\cmd.exe
PID 4116 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe C:\Windows\SysWOW64\cmd.exe
PID 4116 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe C:\Windows\SysWOW64\cmd.exe
PID 3420 wrote to memory of 3604 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 3420 wrote to memory of 3604 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 3420 wrote to memory of 3604 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4128 wrote to memory of 3588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4128 wrote to memory of 3588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4128 wrote to memory of 3588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3480 wrote to memory of 3724 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 3480 wrote to memory of 3724 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 3480 wrote to memory of 3724 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

Processes

C:\Users\Admin\AppData\Local\Temp\dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe

"C:\Users\Admin\AppData\Local\Temp\dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Windows\SysWOW64\reg.exe

reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 vpn.premrera.com udp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp

Files

memory/4116-114-0x0000000000401000-0x0000000000404000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 2994a925eb95c2a8b637387747d9e0de
SHA1 1eb79e670d5d212276423f8a53f7e810b602fe33
SHA256 df2da97b033235940f7da2aae4e0b66ea6712d51dcfc1f8d1d8ba9aee7c0ef23
SHA512 35adad26523cb6995f930a2ed81f9e7eeb797590362969ae4519d212e1e8c9658b2c5fd7855c6504337790c76847a6304742fb39ec9e996a61dc46adee966ef4

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 2994a925eb95c2a8b637387747d9e0de
SHA1 1eb79e670d5d212276423f8a53f7e810b602fe33
SHA256 df2da97b033235940f7da2aae4e0b66ea6712d51dcfc1f8d1d8ba9aee7c0ef23
SHA512 35adad26523cb6995f930a2ed81f9e7eeb797590362969ae4519d212e1e8c9658b2c5fd7855c6504337790c76847a6304742fb39ec9e996a61dc46adee966ef4

Analysis: behavioral3

Detonation Overview

Submitted

2022-02-22 12:38

Reported

2022-02-22 12:43

Platform

win10v2004-en-20220112

Max time kernel

287s

Max time network

301s

Command Line

"C:\Users\Admin\AppData\Local\Temp\dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe"

Signatures

Sakula

trojan rat sakula

suricata: ET MALWARE Possible DEEP PANDA C2 Activity

suricata

suricata: ET MALWARE Possible Deep Panda - Sakula/Mivast RAT CnC Beacon 5

suricata

suricata: ET MALWARE Sakula/Mivast C2 Activity

suricata

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" C:\Windows\SysWOW64\reg.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat C:\Windows\System32\svchost.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\MusNotifyIcon.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\MusNotifyIcon.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4320" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0" C:\Windows\System32\svchost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.009722" C:\Windows\System32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "3996" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" C:\Windows\System32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" C:\Windows\System32\svchost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "5.833420" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4076" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" C:\Windows\System32\svchost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo" C:\Windows\System32\svchost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132901835623774984" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" C:\Windows\System32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" C:\Windows\System32\svchost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.060655" C:\Windows\System32\svchost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "5.000442" C:\Windows\System32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4312" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" C:\Windows\System32\svchost.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2636 wrote to memory of 3832 N/A C:\Users\Admin\AppData\Local\Temp\dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe C:\Windows\SysWOW64\cmd.exe
PID 2636 wrote to memory of 3832 N/A C:\Users\Admin\AppData\Local\Temp\dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe C:\Windows\SysWOW64\cmd.exe
PID 2636 wrote to memory of 3832 N/A C:\Users\Admin\AppData\Local\Temp\dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe C:\Windows\SysWOW64\cmd.exe
PID 2636 wrote to memory of 3240 N/A C:\Users\Admin\AppData\Local\Temp\dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe C:\Windows\SysWOW64\cmd.exe
PID 2636 wrote to memory of 3240 N/A C:\Users\Admin\AppData\Local\Temp\dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe C:\Windows\SysWOW64\cmd.exe
PID 2636 wrote to memory of 3240 N/A C:\Users\Admin\AppData\Local\Temp\dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe C:\Windows\SysWOW64\cmd.exe
PID 2636 wrote to memory of 3104 N/A C:\Users\Admin\AppData\Local\Temp\dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe C:\Windows\SysWOW64\cmd.exe
PID 2636 wrote to memory of 3104 N/A C:\Users\Admin\AppData\Local\Temp\dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe C:\Windows\SysWOW64\cmd.exe
PID 2636 wrote to memory of 3104 N/A C:\Users\Admin\AppData\Local\Temp\dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe C:\Windows\SysWOW64\cmd.exe
PID 3240 wrote to memory of 640 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 3240 wrote to memory of 640 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 3240 wrote to memory of 640 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 3832 wrote to memory of 1288 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3832 wrote to memory of 1288 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3832 wrote to memory of 1288 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3104 wrote to memory of 1576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 3104 wrote to memory of 1576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 3104 wrote to memory of 1576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe

"C:\Users\Admin\AppData\Local\Temp\dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe"

C:\Windows\system32\MusNotifyIcon.exe

%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe"

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1

C:\Windows\SysWOW64\reg.exe

reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k wusvcs -p

Network

Country Destination Domain Proto
US 93.184.220.29:80 tcp
US 93.184.220.29:80 tcp
NL 92.123.77.43:80 tcp
US 93.184.221.240:80 tcp
US 8.8.8.8:53 geo.prod.do.dsp.mp.microsoft.com udp
US 52.184.213.187:443 geo.prod.do.dsp.mp.microsoft.com tcp
US 8.8.8.8:53 kv801.prod.do.dsp.mp.microsoft.com udp
NL 184.29.205.60:443 kv801.prod.do.dsp.mp.microsoft.com tcp
US 8.8.8.8:53 cp801.prod.do.dsp.mp.microsoft.com udp
NL 184.29.205.60:443 cp801.prod.do.dsp.mp.microsoft.com tcp
NL 184.29.205.60:443 cp801.prod.do.dsp.mp.microsoft.com tcp
US 8.8.8.8:53 cp801.prod.do.dsp.mp.microsoft.com udp
NL 184.29.205.60:443 cp801.prod.do.dsp.mp.microsoft.com tcp
US 8.8.8.8:53 vpn.premrera.com udp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 8.8.8.8:53 cp801.prod.do.dsp.mp.microsoft.com udp
NL 184.29.205.60:443 cp801.prod.do.dsp.mp.microsoft.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 104.18.21.226:80 tcp
US 104.18.20.226:80 tcp
US 104.18.21.226:80 tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp

Files

memory/2636-130-0x0000000000401000-0x0000000000404000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 f50ac5fdc669e8b356dfb57955fd816f
SHA1 7aaa0c83df840bde615e42dc040ae63aa8de3b6d
SHA256 a803971c56133086a9c36f94a5732e586c2beea572096a0e5f7df97fa9dbb40a
SHA512 a06d7257193347c42711b617fdcbae7f1ae8eecd3c64ad7b10043a1482bee2337e6a2243fbd38fec70c6e82a30e4d035fc003b63f734770308ef812667b26706

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 f50ac5fdc669e8b356dfb57955fd816f
SHA1 7aaa0c83df840bde615e42dc040ae63aa8de3b6d
SHA256 a803971c56133086a9c36f94a5732e586c2beea572096a0e5f7df97fa9dbb40a
SHA512 a06d7257193347c42711b617fdcbae7f1ae8eecd3c64ad7b10043a1482bee2337e6a2243fbd38fec70c6e82a30e4d035fc003b63f734770308ef812667b26706

Analysis: behavioral1

Detonation Overview

Submitted

2022-02-22 12:38

Reported

2022-02-22 12:43

Platform

win7-en-20211208

Max time kernel

280s

Max time network

300s

Command Line

"C:\Users\Admin\AppData\Local\Temp\dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe"

Signatures

Sakula

trojan rat sakula

suricata: ET MALWARE Possible DEEP PANDA C2 Activity

suricata

suricata: ET MALWARE Possible Deep Panda - Sakula/Mivast RAT CnC Beacon 5

suricata

suricata: ET MALWARE Sakula/Mivast C2 Activity

suricata

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" C:\Windows\SysWOW64\reg.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 320 wrote to memory of 592 N/A C:\Users\Admin\AppData\Local\Temp\dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe C:\Windows\SysWOW64\cmd.exe
PID 320 wrote to memory of 592 N/A C:\Users\Admin\AppData\Local\Temp\dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe C:\Windows\SysWOW64\cmd.exe
PID 320 wrote to memory of 592 N/A C:\Users\Admin\AppData\Local\Temp\dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe C:\Windows\SysWOW64\cmd.exe
PID 320 wrote to memory of 592 N/A C:\Users\Admin\AppData\Local\Temp\dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe C:\Windows\SysWOW64\cmd.exe
PID 320 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe C:\Windows\SysWOW64\cmd.exe
PID 320 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe C:\Windows\SysWOW64\cmd.exe
PID 320 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe C:\Windows\SysWOW64\cmd.exe
PID 320 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe C:\Windows\SysWOW64\cmd.exe
PID 320 wrote to memory of 1484 N/A C:\Users\Admin\AppData\Local\Temp\dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe C:\Windows\SysWOW64\cmd.exe
PID 320 wrote to memory of 1484 N/A C:\Users\Admin\AppData\Local\Temp\dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe C:\Windows\SysWOW64\cmd.exe
PID 320 wrote to memory of 1484 N/A C:\Users\Admin\AppData\Local\Temp\dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe C:\Windows\SysWOW64\cmd.exe
PID 320 wrote to memory of 1484 N/A C:\Users\Admin\AppData\Local\Temp\dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe C:\Windows\SysWOW64\cmd.exe
PID 268 wrote to memory of 1676 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 268 wrote to memory of 1676 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 268 wrote to memory of 1676 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 268 wrote to memory of 1676 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 592 wrote to memory of 984 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 592 wrote to memory of 984 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 592 wrote to memory of 984 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 592 wrote to memory of 984 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1484 wrote to memory of 696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1484 wrote to memory of 696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1484 wrote to memory of 696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1484 wrote to memory of 696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe

"C:\Users\Admin\AppData\Local\Temp\dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\dfff15bafd692a0fdaba1112db5e45bf833beded493f1f97f4264b175ade1a1c.exe"

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Windows\SysWOW64\reg.exe

reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1

Network

Country Destination Domain Proto
US 8.8.8.8:53 vpn.premrera.com udp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp

Files

memory/320-55-0x0000000076071000-0x0000000076073000-memory.dmp

memory/320-56-0x0000000000401000-0x0000000000404000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 996f1b11e8771dc3451b0fde0a9dbb46
SHA1 3d094e93e49634d12de150f4df3f5281c8acc6c9
SHA256 665ceede4f86e3c748e061fd17db83202266ae6c485cdfb25bfa47f0d0b71221
SHA512 62dd3349fe9e5da6c5e3a6bf1c011347890bf8eb40ec29da4a58273c280d1d228126971630c24755073c7cdfde5517ee1e361aff8bf7753fceb5149abe7a33fe

\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 996f1b11e8771dc3451b0fde0a9dbb46
SHA1 3d094e93e49634d12de150f4df3f5281c8acc6c9
SHA256 665ceede4f86e3c748e061fd17db83202266ae6c485cdfb25bfa47f0d0b71221
SHA512 62dd3349fe9e5da6c5e3a6bf1c011347890bf8eb40ec29da4a58273c280d1d228126971630c24755073c7cdfde5517ee1e361aff8bf7753fceb5149abe7a33fe

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 996f1b11e8771dc3451b0fde0a9dbb46
SHA1 3d094e93e49634d12de150f4df3f5281c8acc6c9
SHA256 665ceede4f86e3c748e061fd17db83202266ae6c485cdfb25bfa47f0d0b71221
SHA512 62dd3349fe9e5da6c5e3a6bf1c011347890bf8eb40ec29da4a58273c280d1d228126971630c24755073c7cdfde5517ee1e361aff8bf7753fceb5149abe7a33fe

\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 996f1b11e8771dc3451b0fde0a9dbb46
SHA1 3d094e93e49634d12de150f4df3f5281c8acc6c9
SHA256 665ceede4f86e3c748e061fd17db83202266ae6c485cdfb25bfa47f0d0b71221
SHA512 62dd3349fe9e5da6c5e3a6bf1c011347890bf8eb40ec29da4a58273c280d1d228126971630c24755073c7cdfde5517ee1e361aff8bf7753fceb5149abe7a33fe