Malware Analysis Report

2025-01-02 02:52

Sample ID 220323-lkdw1agbek
Target fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92
SHA256 fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92
Tags
sakula persistence rat suricata trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92

Threat Level: Known bad

The file fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92 was found to be: Known bad.

Malicious Activity Summary

sakula persistence rat suricata trojan

suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 6

suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 7

Sakula

suricata: ET MALWARE Possible DEEP PANDA C2 Activity

Executes dropped EXE

Deletes itself

Loads dropped DLL

Adds Run key to start application

Modifies registry key

Runs ping.exe

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-03-23 09:35

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-03-23 09:35

Reported

2022-03-23 09:42

Platform

win7-20220310-en

Max time kernel

4294201s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.exe"

Signatures

Sakula

trojan rat sakula

suricata: ET MALWARE Possible DEEP PANDA C2 Activity

suricata

suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 6

suricata

suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 7

suricata

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" C:\Windows\SysWOW64\reg.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1452 wrote to memory of 1700 N/A C:\Users\Admin\AppData\Local\Temp\fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.exe C:\Windows\SysWOW64\cmd.exe
PID 1452 wrote to memory of 1700 N/A C:\Users\Admin\AppData\Local\Temp\fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.exe C:\Windows\SysWOW64\cmd.exe
PID 1452 wrote to memory of 1700 N/A C:\Users\Admin\AppData\Local\Temp\fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.exe C:\Windows\SysWOW64\cmd.exe
PID 1452 wrote to memory of 1700 N/A C:\Users\Admin\AppData\Local\Temp\fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.exe C:\Windows\SysWOW64\cmd.exe
PID 1452 wrote to memory of 1296 N/A C:\Users\Admin\AppData\Local\Temp\fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 1452 wrote to memory of 1296 N/A C:\Users\Admin\AppData\Local\Temp\fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 1452 wrote to memory of 1296 N/A C:\Users\Admin\AppData\Local\Temp\fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 1452 wrote to memory of 1296 N/A C:\Users\Admin\AppData\Local\Temp\fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 1700 wrote to memory of 1028 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1700 wrote to memory of 1028 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1700 wrote to memory of 1028 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1700 wrote to memory of 1028 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1452 wrote to memory of 1256 N/A C:\Users\Admin\AppData\Local\Temp\fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.exe C:\Windows\SysWOW64\cmd.exe
PID 1452 wrote to memory of 1256 N/A C:\Users\Admin\AppData\Local\Temp\fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.exe C:\Windows\SysWOW64\cmd.exe
PID 1452 wrote to memory of 1256 N/A C:\Users\Admin\AppData\Local\Temp\fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.exe C:\Windows\SysWOW64\cmd.exe
PID 1452 wrote to memory of 1256 N/A C:\Users\Admin\AppData\Local\Temp\fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.exe C:\Windows\SysWOW64\cmd.exe
PID 1256 wrote to memory of 1668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1256 wrote to memory of 1668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1256 wrote to memory of 1668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1256 wrote to memory of 1668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.exe

"C:\Users\Admin\AppData\Local\Temp\fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Windows\SysWOW64\reg.exe

reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.exe"

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.we11point.com udp
US 204.11.56.48:443 www.we11point.com tcp
US 204.11.56.48:443 www.we11point.com tcp
US 204.11.56.48:443 www.we11point.com tcp
US 204.11.56.48:443 www.we11point.com tcp
US 204.11.56.48:443 www.we11point.com tcp
US 204.11.56.48:443 www.we11point.com tcp
US 204.11.56.48:443 www.we11point.com tcp
US 204.11.56.48:443 www.we11point.com tcp
US 204.11.56.48:443 www.we11point.com tcp

Files

memory/1452-54-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

memory/1452-55-0x0000000000400000-0x000000000040A000-memory.dmp

memory/1700-56-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 f25d83105f98df2e269cf5a5c0d60a95
SHA1 5b9790a7f2eca5da695c215863b491cd9792d457
SHA256 49178a2d9d5ec6d8f71b762b88e42fc1322973eee9bd5b9dd4699b43dc40ecce
SHA512 933e83619fa320b627a76f16cc0ec9293dbcd65a6fbf1fded92e83166576c6569f1f62f709f739bbdfc14cbe4b378d0305503d61cd6c574decbc786dfbc3eb30

memory/1296-59-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 f25d83105f98df2e269cf5a5c0d60a95
SHA1 5b9790a7f2eca5da695c215863b491cd9792d457
SHA256 49178a2d9d5ec6d8f71b762b88e42fc1322973eee9bd5b9dd4699b43dc40ecce
SHA512 933e83619fa320b627a76f16cc0ec9293dbcd65a6fbf1fded92e83166576c6569f1f62f709f739bbdfc14cbe4b378d0305503d61cd6c574decbc786dfbc3eb30

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 f25d83105f98df2e269cf5a5c0d60a95
SHA1 5b9790a7f2eca5da695c215863b491cd9792d457
SHA256 49178a2d9d5ec6d8f71b762b88e42fc1322973eee9bd5b9dd4699b43dc40ecce
SHA512 933e83619fa320b627a76f16cc0ec9293dbcd65a6fbf1fded92e83166576c6569f1f62f709f739bbdfc14cbe4b378d0305503d61cd6c574decbc786dfbc3eb30

memory/1028-62-0x0000000000000000-mapping.dmp

memory/1296-63-0x0000000000400000-0x000000000040A000-memory.dmp

memory/1256-64-0x0000000000000000-mapping.dmp

memory/1668-65-0x0000000000000000-mapping.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-03-23 09:35

Reported

2022-03-23 09:42

Platform

win10v2004-20220310-en

Max time kernel

141s

Max time network

163s

Command Line

"C:\Users\Admin\AppData\Local\Temp\fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.exe"

Signatures

Sakula

trojan rat sakula

suricata: ET MALWARE Possible DEEP PANDA C2 Activity

suricata

suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 6

suricata

suricata: ET MALWARE Sakula/Mivast RAT CnC Beacon 7

suricata

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" C:\Windows\SysWOW64\reg.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3872 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.exe C:\Windows\SysWOW64\cmd.exe
PID 3872 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.exe C:\Windows\SysWOW64\cmd.exe
PID 3872 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.exe C:\Windows\SysWOW64\cmd.exe
PID 3872 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 3872 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 3872 wrote to memory of 1180 N/A C:\Users\Admin\AppData\Local\Temp\fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 3048 wrote to memory of 1656 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3048 wrote to memory of 1656 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3048 wrote to memory of 1656 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3872 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.exe C:\Windows\SysWOW64\cmd.exe
PID 3872 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.exe C:\Windows\SysWOW64\cmd.exe
PID 3872 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.exe C:\Windows\SysWOW64\cmd.exe
PID 2556 wrote to memory of 1160 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2556 wrote to memory of 1160 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2556 wrote to memory of 1160 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.exe

"C:\Users\Admin\AppData\Local\Temp\fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Windows\SysWOW64\reg.exe

reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\fc8a589a472b3c37bf0ce3d266108e7f51dcaa2493e5f250f1af8c3e2c795c92.exe"

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1

Network

Country Destination Domain Proto
US 209.197.3.8:80 tcp
US 93.184.220.29:80 tcp
US 8.8.8.8:53 licensing.mp.microsoft.com udp
US 20.96.63.25:443 licensing.mp.microsoft.com tcp
US 20.189.173.11:443 tcp
NL 104.110.191.140:80 tcp
NL 104.110.191.140:80 tcp
US 8.8.8.8:53 storesdk.dsx.mp.microsoft.com udp
NL 104.80.225.205:443 storesdk.dsx.mp.microsoft.com tcp
US 20.96.63.25:443 licensing.mp.microsoft.com tcp
US 20.96.63.25:443 licensing.mp.microsoft.com tcp
US 20.96.63.25:443 licensing.mp.microsoft.com tcp
US 8.8.8.8:53 www.we11point.com udp
US 204.11.56.48:443 www.we11point.com tcp
US 204.11.56.48:443 www.we11point.com tcp
US 204.11.56.48:443 www.we11point.com tcp
US 204.11.56.48:443 www.we11point.com tcp
US 204.11.56.48:443 www.we11point.com tcp
US 204.11.56.48:443 www.we11point.com tcp
US 204.11.56.48:443 www.we11point.com tcp
US 204.11.56.48:443 www.we11point.com tcp
US 204.11.56.48:443 www.we11point.com tcp

Files

memory/3872-134-0x0000000000400000-0x000000000040A000-memory.dmp

memory/3048-135-0x0000000000000000-mapping.dmp

memory/1180-136-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 8f6c3aa814fbc4c24fcd4b65f0c199db
SHA1 00da63e776df1ed6599b99d7590bfd0a4ab3d323
SHA256 b0ec60dc83c9aec349eac46ff6d23ef8ed2c64658eca11679d6c03a9ebb40023
SHA512 549fa7565730b7dfb3f7293889b1186ce30595f3147603b6b316aba725072bd84e211636cd1706b5fd396a1d6b49c7ab20c1b0bfe9c48dd6f2de72b5ab46896d

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 8f6c3aa814fbc4c24fcd4b65f0c199db
SHA1 00da63e776df1ed6599b99d7590bfd0a4ab3d323
SHA256 b0ec60dc83c9aec349eac46ff6d23ef8ed2c64658eca11679d6c03a9ebb40023
SHA512 549fa7565730b7dfb3f7293889b1186ce30595f3147603b6b316aba725072bd84e211636cd1706b5fd396a1d6b49c7ab20c1b0bfe9c48dd6f2de72b5ab46896d

memory/1656-139-0x0000000000000000-mapping.dmp

memory/2556-140-0x0000000000000000-mapping.dmp

memory/1160-141-0x0000000000000000-mapping.dmp