Malware Analysis Report

2025-01-02 02:58

Sample ID 220511-a1j76seeaj
Target 5378189c64d82fdcc1ab31d23f82594d6c0805fa26621d944cd3d7767861064c
SHA256 5378189c64d82fdcc1ab31d23f82594d6c0805fa26621d944cd3d7767861064c
Tags
upx sakula persistence rat trojan suricata
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

5378189c64d82fdcc1ab31d23f82594d6c0805fa26621d944cd3d7767861064c

Threat Level: Known bad

The file 5378189c64d82fdcc1ab31d23f82594d6c0805fa26621d944cd3d7767861064c was found to be: Known bad.

Malicious Activity Summary

upx sakula persistence rat trojan suricata

suricata: ET MALWARE Possible Deep Panda - Sakula/Mivast RAT CnC Beacon 5

suricata: ET MALWARE Sakula/Mivast C2 Activity

Sakula

suricata: ET MALWARE Possible DEEP PANDA C2 Activity

UPX packed file

Executes dropped EXE

Loads dropped DLL

Deletes itself

Adds Run key to start application

Suspicious use of WriteProcessMemory

Modifies registry key

Runs ping.exe

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-05-11 00:40

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-05-11 00:40

Reported

2022-05-11 01:27

Platform

win7-20220414-en

Max time kernel

178s

Max time network

197s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5378189c64d82fdcc1ab31d23f82594d6c0805fa26621d944cd3d7767861064c.exe"

Signatures

Sakula

trojan rat sakula

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" C:\Windows\SysWOW64\reg.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1768 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\5378189c64d82fdcc1ab31d23f82594d6c0805fa26621d944cd3d7767861064c.exe C:\Windows\SysWOW64\cmd.exe
PID 1768 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\5378189c64d82fdcc1ab31d23f82594d6c0805fa26621d944cd3d7767861064c.exe C:\Windows\SysWOW64\cmd.exe
PID 1768 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\5378189c64d82fdcc1ab31d23f82594d6c0805fa26621d944cd3d7767861064c.exe C:\Windows\SysWOW64\cmd.exe
PID 1768 wrote to memory of 1592 N/A C:\Users\Admin\AppData\Local\Temp\5378189c64d82fdcc1ab31d23f82594d6c0805fa26621d944cd3d7767861064c.exe C:\Windows\SysWOW64\cmd.exe
PID 1768 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Temp\5378189c64d82fdcc1ab31d23f82594d6c0805fa26621d944cd3d7767861064c.exe C:\Windows\SysWOW64\cmd.exe
PID 1768 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Temp\5378189c64d82fdcc1ab31d23f82594d6c0805fa26621d944cd3d7767861064c.exe C:\Windows\SysWOW64\cmd.exe
PID 1768 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Temp\5378189c64d82fdcc1ab31d23f82594d6c0805fa26621d944cd3d7767861064c.exe C:\Windows\SysWOW64\cmd.exe
PID 1768 wrote to memory of 1648 N/A C:\Users\Admin\AppData\Local\Temp\5378189c64d82fdcc1ab31d23f82594d6c0805fa26621d944cd3d7767861064c.exe C:\Windows\SysWOW64\cmd.exe
PID 1768 wrote to memory of 972 N/A C:\Users\Admin\AppData\Local\Temp\5378189c64d82fdcc1ab31d23f82594d6c0805fa26621d944cd3d7767861064c.exe C:\Windows\SysWOW64\cmd.exe
PID 1768 wrote to memory of 972 N/A C:\Users\Admin\AppData\Local\Temp\5378189c64d82fdcc1ab31d23f82594d6c0805fa26621d944cd3d7767861064c.exe C:\Windows\SysWOW64\cmd.exe
PID 1768 wrote to memory of 972 N/A C:\Users\Admin\AppData\Local\Temp\5378189c64d82fdcc1ab31d23f82594d6c0805fa26621d944cd3d7767861064c.exe C:\Windows\SysWOW64\cmd.exe
PID 1768 wrote to memory of 972 N/A C:\Users\Admin\AppData\Local\Temp\5378189c64d82fdcc1ab31d23f82594d6c0805fa26621d944cd3d7767861064c.exe C:\Windows\SysWOW64\cmd.exe
PID 1592 wrote to memory of 1324 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1592 wrote to memory of 1324 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1592 wrote to memory of 1324 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1592 wrote to memory of 1324 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 972 wrote to memory of 900 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 972 wrote to memory of 900 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 972 wrote to memory of 900 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 972 wrote to memory of 900 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1648 wrote to memory of 588 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 1648 wrote to memory of 588 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 1648 wrote to memory of 588 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 1648 wrote to memory of 588 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

Processes

C:\Users\Admin\AppData\Local\Temp\5378189c64d82fdcc1ab31d23f82594d6c0805fa26621d944cd3d7767861064c.exe

"C:\Users\Admin\AppData\Local\Temp\5378189c64d82fdcc1ab31d23f82594d6c0805fa26621d944cd3d7767861064c.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1

C:\Windows\SysWOW64\reg.exe

reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\5378189c64d82fdcc1ab31d23f82594d6c0805fa26621d944cd3d7767861064c.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 vpn.premrera.com udp
US 208.91.197.27:443 vpn.premrera.com tcp
US 173.254.226.212:443 tcp
US 173.254.226.212:443 tcp

Files

memory/1768-54-0x0000000076171000-0x0000000076173000-memory.dmp

memory/1768-55-0x0000000000400000-0x000000000040D000-memory.dmp

memory/1592-56-0x0000000000000000-mapping.dmp

memory/900-60-0x0000000000000000-mapping.dmp

memory/1324-59-0x0000000000000000-mapping.dmp

memory/972-58-0x0000000000000000-mapping.dmp

memory/1648-57-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 ade3eec585c8618edd700d2aebfe51cd
SHA1 bd6016228f8a793f90c07fb5c3c11f7cc12363b7
SHA256 ea0d5d4005e8e1f4f2e34ae4c689038683dbc719bc7b05872c4d40ca030d2789
SHA512 25cc8c251a64c44c7b9167764fa4c9da2deda06730f830a0a99e1d7ea2ebe3731c2147f5138cdce5c12d2769b77eaa19002ce90bfc2b71de884e7d791f45b499

memory/588-64-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 ade3eec585c8618edd700d2aebfe51cd
SHA1 bd6016228f8a793f90c07fb5c3c11f7cc12363b7
SHA256 ea0d5d4005e8e1f4f2e34ae4c689038683dbc719bc7b05872c4d40ca030d2789
SHA512 25cc8c251a64c44c7b9167764fa4c9da2deda06730f830a0a99e1d7ea2ebe3731c2147f5138cdce5c12d2769b77eaa19002ce90bfc2b71de884e7d791f45b499

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 ade3eec585c8618edd700d2aebfe51cd
SHA1 bd6016228f8a793f90c07fb5c3c11f7cc12363b7
SHA256 ea0d5d4005e8e1f4f2e34ae4c689038683dbc719bc7b05872c4d40ca030d2789
SHA512 25cc8c251a64c44c7b9167764fa4c9da2deda06730f830a0a99e1d7ea2ebe3731c2147f5138cdce5c12d2769b77eaa19002ce90bfc2b71de884e7d791f45b499

\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 ade3eec585c8618edd700d2aebfe51cd
SHA1 bd6016228f8a793f90c07fb5c3c11f7cc12363b7
SHA256 ea0d5d4005e8e1f4f2e34ae4c689038683dbc719bc7b05872c4d40ca030d2789
SHA512 25cc8c251a64c44c7b9167764fa4c9da2deda06730f830a0a99e1d7ea2ebe3731c2147f5138cdce5c12d2769b77eaa19002ce90bfc2b71de884e7d791f45b499

memory/588-67-0x0000000000400000-0x000000000040D000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-05-11 00:40

Reported

2022-05-11 01:27

Platform

win10v2004-20220414-en

Max time kernel

186s

Max time network

197s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5378189c64d82fdcc1ab31d23f82594d6c0805fa26621d944cd3d7767861064c.exe"

Signatures

Sakula

trojan rat sakula

suricata: ET MALWARE Possible DEEP PANDA C2 Activity

suricata

suricata: ET MALWARE Possible Deep Panda - Sakula/Mivast RAT CnC Beacon 5

suricata

suricata: ET MALWARE Sakula/Mivast C2 Activity

suricata

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MicroMedia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicroMedia\\MediaCenter.exe" C:\Windows\SysWOW64\reg.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2324 wrote to memory of 4820 N/A C:\Users\Admin\AppData\Local\Temp\5378189c64d82fdcc1ab31d23f82594d6c0805fa26621d944cd3d7767861064c.exe C:\Windows\SysWOW64\cmd.exe
PID 2324 wrote to memory of 4820 N/A C:\Users\Admin\AppData\Local\Temp\5378189c64d82fdcc1ab31d23f82594d6c0805fa26621d944cd3d7767861064c.exe C:\Windows\SysWOW64\cmd.exe
PID 2324 wrote to memory of 4820 N/A C:\Users\Admin\AppData\Local\Temp\5378189c64d82fdcc1ab31d23f82594d6c0805fa26621d944cd3d7767861064c.exe C:\Windows\SysWOW64\cmd.exe
PID 2324 wrote to memory of 372 N/A C:\Users\Admin\AppData\Local\Temp\5378189c64d82fdcc1ab31d23f82594d6c0805fa26621d944cd3d7767861064c.exe C:\Windows\SysWOW64\cmd.exe
PID 2324 wrote to memory of 372 N/A C:\Users\Admin\AppData\Local\Temp\5378189c64d82fdcc1ab31d23f82594d6c0805fa26621d944cd3d7767861064c.exe C:\Windows\SysWOW64\cmd.exe
PID 2324 wrote to memory of 372 N/A C:\Users\Admin\AppData\Local\Temp\5378189c64d82fdcc1ab31d23f82594d6c0805fa26621d944cd3d7767861064c.exe C:\Windows\SysWOW64\cmd.exe
PID 2324 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\5378189c64d82fdcc1ab31d23f82594d6c0805fa26621d944cd3d7767861064c.exe C:\Windows\SysWOW64\cmd.exe
PID 2324 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\5378189c64d82fdcc1ab31d23f82594d6c0805fa26621d944cd3d7767861064c.exe C:\Windows\SysWOW64\cmd.exe
PID 2324 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\5378189c64d82fdcc1ab31d23f82594d6c0805fa26621d944cd3d7767861064c.exe C:\Windows\SysWOW64\cmd.exe
PID 2604 wrote to memory of 2104 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2604 wrote to memory of 2104 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2604 wrote to memory of 2104 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 4820 wrote to memory of 4620 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4820 wrote to memory of 4620 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4820 wrote to memory of 4620 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 372 wrote to memory of 4604 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 372 wrote to memory of 4604 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
PID 372 wrote to memory of 4604 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

Processes

C:\Users\Admin\AppData\Local\Temp\5378189c64d82fdcc1ab31d23f82594d6c0805fa26621d944cd3d7767861064c.exe

"C:\Users\Admin\AppData\Local\Temp\5378189c64d82fdcc1ab31d23f82594d6c0805fa26621d944cd3d7767861064c.exe"

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

C:\Windows\SysWOW64\reg.exe

reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c ping 127.0.0.1 & del "C:\Users\Admin\AppData\Local\Temp\5378189c64d82fdcc1ab31d23f82594d6c0805fa26621d944cd3d7767861064c.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v "MicroMedia" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe"

Network

Country Destination Domain Proto
US 52.168.117.170:443 tcp
NL 95.101.78.209:80 tcp
NL 95.101.78.209:80 tcp
FR 2.16.119.157:443 tcp
FR 2.16.119.157:443 tcp
US 185.199.108.133:443 tcp
US 8.8.8.8:53 vpn.premrera.com udp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 185.199.108.133:443 tcp
US 185.199.108.133:443 tcp
US 185.199.108.154:443 tcp
US 185.199.108.154:443 tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 208.91.197.27:443 vpn.premrera.com tcp
US 8.8.8.8:53 storesdk.dsx.mp.microsoft.com udp
FR 2.18.109.224:443 storesdk.dsx.mp.microsoft.com tcp

Files

memory/2324-133-0x0000000000400000-0x000000000040D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 77cc13e7775c7f2f551342d0bf80d4af
SHA1 32d4134db40de9ccfff369f06c428cc81908ba65
SHA256 24832259bdc017e1ed5e1d23b362a1efaa42255f45e521f940c6b85ae1588148
SHA512 24741c90cc11cee638d15fad1d9fbe97e6a2f58efb678ee405c955a4d8b0b99666e1d1eb76032a41508c2e35490904b3863fc0ed3d40e91589c409d0d08f714e

C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe

MD5 77cc13e7775c7f2f551342d0bf80d4af
SHA1 32d4134db40de9ccfff369f06c428cc81908ba65
SHA256 24832259bdc017e1ed5e1d23b362a1efaa42255f45e521f940c6b85ae1588148
SHA512 24741c90cc11cee638d15fad1d9fbe97e6a2f58efb678ee405c955a4d8b0b99666e1d1eb76032a41508c2e35490904b3863fc0ed3d40e91589c409d0d08f714e

memory/4604-136-0x0000000000000000-mapping.dmp

memory/4620-135-0x0000000000000000-mapping.dmp

memory/2104-134-0x0000000000000000-mapping.dmp

memory/2604-132-0x0000000000000000-mapping.dmp

memory/372-131-0x0000000000000000-mapping.dmp

memory/4820-130-0x0000000000000000-mapping.dmp

memory/4604-139-0x0000000000400000-0x000000000040D000-memory.dmp