Malware Analysis Report

2025-01-02 02:55

Sample ID 220317-wwdeqaeagk
Target 4f5363c919c970e147753a3b89cb0d216a1053029e48ebfd9037a5d2931fb67a
SHA256 4f5363c919c970e147753a3b89cb0d216a1053029e48ebfd9037a5d2931fb67a
Tags
sakula persistence rat suricata trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

4f5363c919c970e147753a3b89cb0d216a1053029e48ebfd9037a5d2931fb67a

Threat Level: Known bad

The file 4f5363c919c970e147753a3b89cb0d216a1053029e48ebfd9037a5d2931fb67a was found to be: Known bad.

Malicious Activity Summary

sakula persistence rat suricata trojan

suricata: ET MALWARE Possible Deep Panda - Sakula/Mivast RAT CnC Beacon 5

suricata: ET MALWARE Sakula/Mivast C2 Activity

Sakula

suricata: ET MALWARE Possible DEEP PANDA C2 Activity

Executes dropped EXE

Deletes itself

Loads dropped DLL

Adds Run key to start application

Modifies registry key

Runs ping.exe

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-03-17 18:15

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-03-17 18:15

Reported

2022-03-17 18:19

Platform

win7-20220311-en

Max time kernel

4294183s

Max time network

128s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4f5363c919c970e147753a3b89cb0d216a1053029e48ebfd9037a5d2931fb67a.exe"

Signatures

Sakula

trojan rat sakula

suricata: ET MALWARE Possible DEEP PANDA C2 Activity

suricata

suricata: ET MALWARE Possible Deep Panda - Sakula/Mivast RAT CnC Beacon 5

suricata

suricata: ET MALWARE Sakula/Mivast C2 Activity

suricata

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" C:\Windows\SysWOW64\reg.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1336 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\4f5363c919c970e147753a3b89cb0d216a1053029e48ebfd9037a5d2931fb67a.exe C:\Windows\SysWOW64\cmd.exe
PID 1336 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\4f5363c919c970e147753a3b89cb0d216a1053029e48ebfd9037a5d2931fb67a.exe C:\Windows\SysWOW64\cmd.exe
PID 1336 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\4f5363c919c970e147753a3b89cb0d216a1053029e48ebfd9037a5d2931fb67a.exe C:\Windows\SysWOW64\cmd.exe
PID 1336 wrote to memory of 1132 N/A C:\Users\Admin\AppData\Local\Temp\4f5363c919c970e147753a3b89cb0d216a1053029e48ebfd9037a5d2931fb67a.exe C:\Windows\SysWOW64\cmd.exe
PID 1336 wrote to memory of 1496 N/A C:\Users\Admin\AppData\Local\Temp\4f5363c919c970e147753a3b89cb0d216a1053029e48ebfd9037a5d2931fb67a.exe C:\Windows\SysWOW64\cmd.exe
PID 1336 wrote to memory of 1496 N/A C:\Users\Admin\AppData\Local\Temp\4f5363c919c970e147753a3b89cb0d216a1053029e48ebfd9037a5d2931fb67a.exe C:\Windows\SysWOW64\cmd.exe
PID 1336 wrote to memory of 1496 N/A C:\Users\Admin\AppData\Local\Temp\4f5363c919c970e147753a3b89cb0d216a1053029e48ebfd9037a5d2931fb67a.exe C:\Windows\SysWOW64\cmd.exe
PID 1336 wrote to memory of 1496 N/A C:\Users\Admin\AppData\Local\Temp\4f5363c919c970e147753a3b89cb0d216a1053029e48ebfd9037a5d2931fb67a.exe C:\Windows\SysWOW64\cmd.exe
PID 1336 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\4f5363c919c970e147753a3b89cb0d216a1053029e48ebfd9037a5d2931fb67a.exe C:\Windows\SysWOW64\cmd.exe
PID 1336 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\4f5363c919c970e147753a3b89cb0d216a1053029e48ebfd9037a5d2931fb67a.exe C:\Windows\SysWOW64\cmd.exe
PID 1336 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\4f5363c919c970e147753a3b89cb0d216a1053029e48ebfd9037a5d2931fb67a.exe C:\Windows\SysWOW64\cmd.exe
PID 1336 wrote to memory of 560 N/A C:\Users\Admin\AppData\Local\Temp\4f5363c919c970e147753a3b89cb0d216a1053029e48ebfd9037a5d2931fb67a.exe C:\Windows\SysWOW64\cmd.exe
PID 560 wrote to memory of 1532 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 560 wrote to memory of 1532 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 560 wrote to memory of 1532 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 560 wrote to memory of 1532 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1132 wrote to memory of 1444 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1132 wrote to memory of 1444 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1132 wrote to memory of 1444 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1132 wrote to memory of 1444 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1496 wrote to memory of 1428 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 1496 wrote to memory of 1428 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 1496 wrote to memory of 1428 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 1496 wrote to memory of 1428 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

Processes

C:\Users\Admin\AppData\Local\Temp\4f5363c919c970e147753a3b89cb0d216a1053029e48ebfd9037a5d2931fb67a.exe

"C:\Users\Admin\AppData\Local\Temp\4f5363c919c970e147753a3b89cb0d216a1053029e48ebfd9037a5d2931fb67a.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\4f5363c919c970e147753a3b89cb0d216a1053029e48ebfd9037a5d2931fb67a.exe"

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1

C:\Windows\SysWOW64\reg.exe

reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 vpn.premrera.com udp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp

Files

memory/1336-54-0x0000000075561000-0x0000000075563000-memory.dmp

memory/1336-55-0x0000000000400000-0x000000000040C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 f9bcce7bfba23e2fa9c8ad513d49efcc
SHA1 2afd2871b1fb5e73a97d1dfc329881e78133864b
SHA256 e79a3eb617387e8b9379d9ec361abfa598f493c22a60be46f1045b23d5fcd1ac
SHA512 1c44819d832e7ceea38c7c80a2aad60f5a45945fb1708a5af64093ec2d0cc15925a0ed9ce9b2d996fb6e9b60f0f1289c8167815aef89675f7454ebe53a482bee

\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 f9bcce7bfba23e2fa9c8ad513d49efcc
SHA1 2afd2871b1fb5e73a97d1dfc329881e78133864b
SHA256 e79a3eb617387e8b9379d9ec361abfa598f493c22a60be46f1045b23d5fcd1ac
SHA512 1c44819d832e7ceea38c7c80a2aad60f5a45945fb1708a5af64093ec2d0cc15925a0ed9ce9b2d996fb6e9b60f0f1289c8167815aef89675f7454ebe53a482bee

\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 f9bcce7bfba23e2fa9c8ad513d49efcc
SHA1 2afd2871b1fb5e73a97d1dfc329881e78133864b
SHA256 e79a3eb617387e8b9379d9ec361abfa598f493c22a60be46f1045b23d5fcd1ac
SHA512 1c44819d832e7ceea38c7c80a2aad60f5a45945fb1708a5af64093ec2d0cc15925a0ed9ce9b2d996fb6e9b60f0f1289c8167815aef89675f7454ebe53a482bee

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 f9bcce7bfba23e2fa9c8ad513d49efcc
SHA1 2afd2871b1fb5e73a97d1dfc329881e78133864b
SHA256 e79a3eb617387e8b9379d9ec361abfa598f493c22a60be46f1045b23d5fcd1ac
SHA512 1c44819d832e7ceea38c7c80a2aad60f5a45945fb1708a5af64093ec2d0cc15925a0ed9ce9b2d996fb6e9b60f0f1289c8167815aef89675f7454ebe53a482bee

Analysis: behavioral2

Detonation Overview

Submitted

2022-03-17 18:15

Reported

2022-03-17 18:19

Platform

win10v2004-en-20220113

Max time kernel

128s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4f5363c919c970e147753a3b89cb0d216a1053029e48ebfd9037a5d2931fb67a.exe"

Signatures

Sakula

trojan rat sakula

suricata: ET MALWARE Possible DEEP PANDA C2 Activity

suricata

suricata: ET MALWARE Possible Deep Panda - Sakula/Mivast RAT CnC Beacon 5

suricata

suricata: ET MALWARE Sakula/Mivast C2 Activity

suricata

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" C:\Windows\SysWOW64\reg.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2748 wrote to memory of 4856 N/A C:\Users\Admin\AppData\Local\Temp\4f5363c919c970e147753a3b89cb0d216a1053029e48ebfd9037a5d2931fb67a.exe C:\Windows\SysWOW64\cmd.exe
PID 2748 wrote to memory of 4856 N/A C:\Users\Admin\AppData\Local\Temp\4f5363c919c970e147753a3b89cb0d216a1053029e48ebfd9037a5d2931fb67a.exe C:\Windows\SysWOW64\cmd.exe
PID 2748 wrote to memory of 4856 N/A C:\Users\Admin\AppData\Local\Temp\4f5363c919c970e147753a3b89cb0d216a1053029e48ebfd9037a5d2931fb67a.exe C:\Windows\SysWOW64\cmd.exe
PID 2748 wrote to memory of 4752 N/A C:\Users\Admin\AppData\Local\Temp\4f5363c919c970e147753a3b89cb0d216a1053029e48ebfd9037a5d2931fb67a.exe C:\Windows\SysWOW64\cmd.exe
PID 2748 wrote to memory of 4752 N/A C:\Users\Admin\AppData\Local\Temp\4f5363c919c970e147753a3b89cb0d216a1053029e48ebfd9037a5d2931fb67a.exe C:\Windows\SysWOW64\cmd.exe
PID 2748 wrote to memory of 4752 N/A C:\Users\Admin\AppData\Local\Temp\4f5363c919c970e147753a3b89cb0d216a1053029e48ebfd9037a5d2931fb67a.exe C:\Windows\SysWOW64\cmd.exe
PID 2748 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\4f5363c919c970e147753a3b89cb0d216a1053029e48ebfd9037a5d2931fb67a.exe C:\Windows\SysWOW64\cmd.exe
PID 2748 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\4f5363c919c970e147753a3b89cb0d216a1053029e48ebfd9037a5d2931fb67a.exe C:\Windows\SysWOW64\cmd.exe
PID 2748 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\4f5363c919c970e147753a3b89cb0d216a1053029e48ebfd9037a5d2931fb67a.exe C:\Windows\SysWOW64\cmd.exe
PID 5008 wrote to memory of 1136 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 5008 wrote to memory of 1136 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 5008 wrote to memory of 1136 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4856 wrote to memory of 1892 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4856 wrote to memory of 1892 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4856 wrote to memory of 1892 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4752 wrote to memory of 60 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 4752 wrote to memory of 60 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 4752 wrote to memory of 60 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

Processes

C:\Users\Admin\AppData\Local\Temp\4f5363c919c970e147753a3b89cb0d216a1053029e48ebfd9037a5d2931fb67a.exe

"C:\Users\Admin\AppData\Local\Temp\4f5363c919c970e147753a3b89cb0d216a1053029e48ebfd9037a5d2931fb67a.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\4f5363c919c970e147753a3b89cb0d216a1053029e48ebfd9037a5d2931fb67a.exe"

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1

C:\Windows\SysWOW64\reg.exe

reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 vpn.premrera.com udp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 8.8.8.8:53 176.122.125.40.in-addr.arpa udp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp

Files

memory/2748-130-0x0000000000400000-0x000000000040C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 9db7bd92d78e5df872db906642e21725
SHA1 e3005f7ee1a089b18192afc63283eb3a1d1971ab
SHA256 06b4545a2397ad765aa1371740126d9a56803aa055e713c9c4f56a92baf0fc3c
SHA512 f9b2d70b286183f42c9debbce7da24532df2f1af43f5ecec322de4dd851fc48eaa2c474bd5f38440d13268028f6dc8dbc27187dd4e83256ea187634d5cb377d2

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 9db7bd92d78e5df872db906642e21725
SHA1 e3005f7ee1a089b18192afc63283eb3a1d1971ab
SHA256 06b4545a2397ad765aa1371740126d9a56803aa055e713c9c4f56a92baf0fc3c
SHA512 f9b2d70b286183f42c9debbce7da24532df2f1af43f5ecec322de4dd851fc48eaa2c474bd5f38440d13268028f6dc8dbc27187dd4e83256ea187634d5cb377d2

memory/60-133-0x0000000000400000-0x000000000040C000-memory.dmp