Malware Analysis Report

2025-01-02 02:55

Sample ID 220228-tbwpfseeh4
Target b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e
SHA256 b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e
Tags
sakula persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e

Threat Level: Known bad

The file b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e was found to be: Known bad.

Malicious Activity Summary

sakula persistence rat trojan

Sakula

Executes dropped EXE

Deletes itself

Loads dropped DLL

Adds Run key to start application

Modifies registry key

Runs ping.exe

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-02-28 15:53

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-02-28 15:53

Reported

2022-02-28 15:58

Platform

win7-en-20211208

Max time kernel

285s

Max time network

288s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe"

Signatures

Sakula

trojan rat sakula

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" C:\Windows\SysWOW64\reg.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1660 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe C:\Windows\SysWOW64\cmd.exe
PID 1660 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe C:\Windows\SysWOW64\cmd.exe
PID 1660 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe C:\Windows\SysWOW64\cmd.exe
PID 1660 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe C:\Windows\SysWOW64\cmd.exe
PID 1660 wrote to memory of 828 N/A C:\Users\Admin\AppData\Local\Temp\b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe C:\Windows\SysWOW64\cmd.exe
PID 1660 wrote to memory of 828 N/A C:\Users\Admin\AppData\Local\Temp\b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe C:\Windows\SysWOW64\cmd.exe
PID 1660 wrote to memory of 828 N/A C:\Users\Admin\AppData\Local\Temp\b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe C:\Windows\SysWOW64\cmd.exe
PID 1660 wrote to memory of 828 N/A C:\Users\Admin\AppData\Local\Temp\b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe C:\Windows\SysWOW64\cmd.exe
PID 1660 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe C:\Windows\SysWOW64\cmd.exe
PID 1660 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe C:\Windows\SysWOW64\cmd.exe
PID 1660 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe C:\Windows\SysWOW64\cmd.exe
PID 1660 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe C:\Windows\SysWOW64\cmd.exe
PID 828 wrote to memory of 1356 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 828 wrote to memory of 1356 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 828 wrote to memory of 1356 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 828 wrote to memory of 1356 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 760 wrote to memory of 1828 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 760 wrote to memory of 1828 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 760 wrote to memory of 1828 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 760 wrote to memory of 1828 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 948 wrote to memory of 1412 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 948 wrote to memory of 1412 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 948 wrote to memory of 1412 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 948 wrote to memory of 1412 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe

"C:\Users\Admin\AppData\Local\Temp\b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe"

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Windows\SysWOW64\reg.exe

reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1

Network

Country Destination Domain Proto
US 8.8.8.8:53 vpn.premrera.com udp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp

Files

memory/1660-55-0x0000000075F81000-0x0000000075F83000-memory.dmp

memory/1660-56-0x0000000000401000-0x0000000000404000-memory.dmp

\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 c2a6679d672e3995ce23d5d0361c854a
SHA1 adc0b8681792cf059e9eb9859a083b77a5651535
SHA256 789892bab25f05525d9ee032b9e6d69499689f996f09ad190d9c10dadb5e9583
SHA512 8efbbd10a8a71d19b3574365b79097ec6c7d138a796559f1c12e8ef5a3b2682fed0a5129141f8ee2ce63213b8593c11864a90e880af07fb8ec39bd0033b4f731

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 c2a6679d672e3995ce23d5d0361c854a
SHA1 adc0b8681792cf059e9eb9859a083b77a5651535
SHA256 789892bab25f05525d9ee032b9e6d69499689f996f09ad190d9c10dadb5e9583
SHA512 8efbbd10a8a71d19b3574365b79097ec6c7d138a796559f1c12e8ef5a3b2682fed0a5129141f8ee2ce63213b8593c11864a90e880af07fb8ec39bd0033b4f731

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 c2a6679d672e3995ce23d5d0361c854a
SHA1 adc0b8681792cf059e9eb9859a083b77a5651535
SHA256 789892bab25f05525d9ee032b9e6d69499689f996f09ad190d9c10dadb5e9583
SHA512 8efbbd10a8a71d19b3574365b79097ec6c7d138a796559f1c12e8ef5a3b2682fed0a5129141f8ee2ce63213b8593c11864a90e880af07fb8ec39bd0033b4f731

\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 c2a6679d672e3995ce23d5d0361c854a
SHA1 adc0b8681792cf059e9eb9859a083b77a5651535
SHA256 789892bab25f05525d9ee032b9e6d69499689f996f09ad190d9c10dadb5e9583
SHA512 8efbbd10a8a71d19b3574365b79097ec6c7d138a796559f1c12e8ef5a3b2682fed0a5129141f8ee2ce63213b8593c11864a90e880af07fb8ec39bd0033b4f731

Analysis: behavioral2

Detonation Overview

Submitted

2022-02-28 15:53

Reported

2022-02-28 15:58

Platform

win10-en-20211208

Max time kernel

281s

Max time network

284s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe"

Signatures

Sakula

trojan rat sakula

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" C:\Windows\SysWOW64\reg.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3540 wrote to memory of 3296 N/A C:\Users\Admin\AppData\Local\Temp\b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe C:\Windows\SysWOW64\cmd.exe
PID 3540 wrote to memory of 3296 N/A C:\Users\Admin\AppData\Local\Temp\b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe C:\Windows\SysWOW64\cmd.exe
PID 3540 wrote to memory of 3296 N/A C:\Users\Admin\AppData\Local\Temp\b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe C:\Windows\SysWOW64\cmd.exe
PID 3540 wrote to memory of 3592 N/A C:\Users\Admin\AppData\Local\Temp\b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe C:\Windows\SysWOW64\cmd.exe
PID 3540 wrote to memory of 3592 N/A C:\Users\Admin\AppData\Local\Temp\b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe C:\Windows\SysWOW64\cmd.exe
PID 3540 wrote to memory of 3592 N/A C:\Users\Admin\AppData\Local\Temp\b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe C:\Windows\SysWOW64\cmd.exe
PID 3540 wrote to memory of 4088 N/A C:\Users\Admin\AppData\Local\Temp\b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe C:\Windows\SysWOW64\cmd.exe
PID 3540 wrote to memory of 4088 N/A C:\Users\Admin\AppData\Local\Temp\b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe C:\Windows\SysWOW64\cmd.exe
PID 3540 wrote to memory of 4088 N/A C:\Users\Admin\AppData\Local\Temp\b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe C:\Windows\SysWOW64\cmd.exe
PID 3592 wrote to memory of 1992 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 3592 wrote to memory of 1992 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 3592 wrote to memory of 1992 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 4088 wrote to memory of 2744 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4088 wrote to memory of 2744 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4088 wrote to memory of 2744 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 3296 wrote to memory of 3052 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3296 wrote to memory of 3052 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3296 wrote to memory of 3052 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe

"C:\Users\Admin\AppData\Local\Temp\b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe"

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1

C:\Windows\SysWOW64\reg.exe

reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 vpn.premrera.com udp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp

Files

memory/3540-115-0x0000000000401000-0x0000000000404000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 16f86f85565789cc412fd969568f6b3f
SHA1 b93351735aeda1aa18925679a153cb407293f0bf
SHA256 8323c5af48eeee648561b8d4f45d4a93750ec0784215dbaef1c52571f758f72d
SHA512 e3b2fbd01506a2226a8a43cd20cb02474bb4cab900235a2223c0188ba39b7a208b804b2bd77f10af7fad5d0d5a00a94b92350a445004d15beb6ffaefcfb7848a

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 16f86f85565789cc412fd969568f6b3f
SHA1 b93351735aeda1aa18925679a153cb407293f0bf
SHA256 8323c5af48eeee648561b8d4f45d4a93750ec0784215dbaef1c52571f758f72d
SHA512 e3b2fbd01506a2226a8a43cd20cb02474bb4cab900235a2223c0188ba39b7a208b804b2bd77f10af7fad5d0d5a00a94b92350a445004d15beb6ffaefcfb7848a

Analysis: behavioral3

Detonation Overview

Submitted

2022-02-28 15:53

Reported

2022-02-28 15:58

Platform

win10v2004-en-20220113

Max time kernel

241s

Max time network

273s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe"

Signatures

Sakula

trojan rat sakula

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" C:\Windows\SysWOW64\reg.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3320 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Local\Temp\b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe C:\Windows\SysWOW64\cmd.exe
PID 3320 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Local\Temp\b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe C:\Windows\SysWOW64\cmd.exe
PID 3320 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Local\Temp\b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe C:\Windows\SysWOW64\cmd.exe
PID 3320 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe C:\Windows\SysWOW64\cmd.exe
PID 3320 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe C:\Windows\SysWOW64\cmd.exe
PID 3320 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe C:\Windows\SysWOW64\cmd.exe
PID 3320 wrote to memory of 1400 N/A C:\Users\Admin\AppData\Local\Temp\b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe C:\Windows\SysWOW64\cmd.exe
PID 3320 wrote to memory of 1400 N/A C:\Users\Admin\AppData\Local\Temp\b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe C:\Windows\SysWOW64\cmd.exe
PID 3320 wrote to memory of 1400 N/A C:\Users\Admin\AppData\Local\Temp\b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe C:\Windows\SysWOW64\cmd.exe
PID 1400 wrote to memory of 2764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1400 wrote to memory of 2764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1400 wrote to memory of 2764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1248 wrote to memory of 2336 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1248 wrote to memory of 2336 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1248 wrote to memory of 2336 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1352 wrote to memory of 2604 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 1352 wrote to memory of 2604 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 1352 wrote to memory of 2604 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe

"C:\Users\Admin\AppData\Local\Temp\b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\b0144b6b820bbd7e84f82b2cbc63dfe25b858dd39f70e52efca66f5d5104046e.exe"

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1

C:\Windows\SysWOW64\reg.exe

reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 vpn.premrera.com udp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 13.107.4.50:80 tcp
US 13.107.4.50:80 tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 173.254.226.212:443 tcp

Files

memory/3320-130-0x0000000000401000-0x0000000000404000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 348cab12013d0bb99563504ccfe6f2c4
SHA1 90858489641a388d19d27cdbd4c89d83e89cf7c1
SHA256 fdd8e6b083d810cdafc02070008c1b9c990bc99a860b8756dd3867766181a79f
SHA512 de922692a294a10639976fd91565e99b58ab2db25651f0ea23944209028b33c46381f9a95b3199e78893c81ed554b4495d2baa514d9c97d6d9d33f06f0e75726

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 348cab12013d0bb99563504ccfe6f2c4
SHA1 90858489641a388d19d27cdbd4c89d83e89cf7c1
SHA256 fdd8e6b083d810cdafc02070008c1b9c990bc99a860b8756dd3867766181a79f
SHA512 de922692a294a10639976fd91565e99b58ab2db25651f0ea23944209028b33c46381f9a95b3199e78893c81ed554b4495d2baa514d9c97d6d9d33f06f0e75726