Analysis
-
max time kernel
151s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220722-en -
resource tags
arch:x64arch:x86image:win10v2004-20220722-enlocale:en-usos:windows10-2004-x64system -
submitted
06-08-2022 02:28
Static task
static1
General
-
Target
e7184319f8bcc00d6e9f17542b917c537d6e21e0f068c367d360c44afd7f817e.exe
-
Size
375KB
-
MD5
94e5d015983b0f92d45fe3e42b285607
-
SHA1
5ae548731a6310c2b7d7243b699d12109d4bb5ca
-
SHA256
e7184319f8bcc00d6e9f17542b917c537d6e21e0f068c367d360c44afd7f817e
-
SHA512
cff6d560a86df3aa565c46e2ff6937d3039c8f82af7689d2db9b0c31e254ef523aed4c437ed06900c0381d68b2fd9eb9cda7e5e4696c2b6b5f40702449fcb800
Malware Config
Signatures
-
Gh0st RAT payload 9 IoCs
Processes:
resource yara_rule behavioral1/memory/4772-136-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/4772-137-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/4772-138-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/4912-152-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/1820-156-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/1820-157-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/1820-159-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/1820-161-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/3224-177-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat -
Executes dropped EXE 4 IoCs
Processes:
SQLSerasi.exeSQLSerasi.exeSQLSerasi.exeSQLSerasi.exepid process 4912 SQLSerasi.exe 1820 SQLSerasi.exe 3224 SQLSerasi.exe 2456 SQLSerasi.exe -
Processes:
resource yara_rule behavioral1/memory/4772-133-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/4772-136-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/4772-137-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/4772-138-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/4912-152-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/1820-151-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/1820-156-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/1820-157-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/1820-159-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/1820-161-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/3224-177-0x0000000010000000-0x0000000010362000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
e7184319f8bcc00d6e9f17542b917c537d6e21e0f068c367d360c44afd7f817e.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\Control Panel\International\Geo\Nation e7184319f8bcc00d6e9f17542b917c537d6e21e0f068c367d360c44afd7f817e.exe -
Drops file in System32 directory 4 IoCs
Processes:
SQLSerasi.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 SQLSerasi.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE SQLSerasi.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies SQLSerasi.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 SQLSerasi.exe -
Drops file in Program Files directory 2 IoCs
Processes:
e7184319f8bcc00d6e9f17542b917c537d6e21e0f068c367d360c44afd7f817e.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe e7184319f8bcc00d6e9f17542b917c537d6e21e0f068c367d360c44afd7f817e.exe File created C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe e7184319f8bcc00d6e9f17542b917c537d6e21e0f068c367d360c44afd7f817e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3332 1820 WerFault.exe SQLSerasi.exe -
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
SQLSerasi.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 SQLSerasi.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString SQLSerasi.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 SQLSerasi.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString SQLSerasi.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 SQLSerasi.exe -
Modifies data under HKEY_USERS 8 IoCs
Processes:
SQLSerasi.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" SQLSerasi.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" SQLSerasi.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix SQLSerasi.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" SQLSerasi.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" SQLSerasi.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ SQLSerasi.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" SQLSerasi.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" SQLSerasi.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
e7184319f8bcc00d6e9f17542b917c537d6e21e0f068c367d360c44afd7f817e.exeSQLSerasi.exeSQLSerasi.exeSQLSerasi.exeSQLSerasi.exedescription pid process Token: SeDebugPrivilege 4772 e7184319f8bcc00d6e9f17542b917c537d6e21e0f068c367d360c44afd7f817e.exe Token: SeDebugPrivilege 4912 SQLSerasi.exe Token: SeDebugPrivilege 1820 SQLSerasi.exe Token: SeDebugPrivilege 1820 SQLSerasi.exe Token: SeDebugPrivilege 1820 SQLSerasi.exe Token: SeDebugPrivilege 3224 SQLSerasi.exe Token: SeDebugPrivilege 2456 SQLSerasi.exe Token: SeDebugPrivilege 3224 SQLSerasi.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
e7184319f8bcc00d6e9f17542b917c537d6e21e0f068c367d360c44afd7f817e.exeSQLSerasi.exedescription pid process target process PID 4772 wrote to memory of 4912 4772 e7184319f8bcc00d6e9f17542b917c537d6e21e0f068c367d360c44afd7f817e.exe SQLSerasi.exe PID 4772 wrote to memory of 4912 4772 e7184319f8bcc00d6e9f17542b917c537d6e21e0f068c367d360c44afd7f817e.exe SQLSerasi.exe PID 4772 wrote to memory of 4912 4772 e7184319f8bcc00d6e9f17542b917c537d6e21e0f068c367d360c44afd7f817e.exe SQLSerasi.exe PID 1820 wrote to memory of 3224 1820 SQLSerasi.exe SQLSerasi.exe PID 1820 wrote to memory of 3224 1820 SQLSerasi.exe SQLSerasi.exe PID 1820 wrote to memory of 3224 1820 SQLSerasi.exe SQLSerasi.exe PID 1820 wrote to memory of 2456 1820 SQLSerasi.exe SQLSerasi.exe PID 1820 wrote to memory of 2456 1820 SQLSerasi.exe SQLSerasi.exe PID 1820 wrote to memory of 2456 1820 SQLSerasi.exe SQLSerasi.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e7184319f8bcc00d6e9f17542b917c537d6e21e0f068c367d360c44afd7f817e.exe"C:\Users\Admin\AppData\Local\Temp\e7184319f8bcc00d6e9f17542b917c537d6e21e0f068c367d360c44afd7f817e.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 6362⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1820 -ip 18201⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exeFilesize
39.4MB
MD5c76a08483da34968a980f61c4ed213b2
SHA131c6a8bb95c024b52f3c8d62a61450741275d947
SHA256a3826acb079a1ba1b1117d8d0036f2d91b630ef2a7aabd39149510b700901b20
SHA512cb017094bd75a1ae72a40f3b84dc9fc2da093243d79d2c3b0a2975dc128a81d5a34b931b35c6699b415974e46be9c3e2b5f05f35d1c0c16fc333dde7e76366fe
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exeFilesize
39.4MB
MD5c76a08483da34968a980f61c4ed213b2
SHA131c6a8bb95c024b52f3c8d62a61450741275d947
SHA256a3826acb079a1ba1b1117d8d0036f2d91b630ef2a7aabd39149510b700901b20
SHA512cb017094bd75a1ae72a40f3b84dc9fc2da093243d79d2c3b0a2975dc128a81d5a34b931b35c6699b415974e46be9c3e2b5f05f35d1c0c16fc333dde7e76366fe
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exeFilesize
39.4MB
MD5c76a08483da34968a980f61c4ed213b2
SHA131c6a8bb95c024b52f3c8d62a61450741275d947
SHA256a3826acb079a1ba1b1117d8d0036f2d91b630ef2a7aabd39149510b700901b20
SHA512cb017094bd75a1ae72a40f3b84dc9fc2da093243d79d2c3b0a2975dc128a81d5a34b931b35c6699b415974e46be9c3e2b5f05f35d1c0c16fc333dde7e76366fe
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exeFilesize
39.4MB
MD5c76a08483da34968a980f61c4ed213b2
SHA131c6a8bb95c024b52f3c8d62a61450741275d947
SHA256a3826acb079a1ba1b1117d8d0036f2d91b630ef2a7aabd39149510b700901b20
SHA512cb017094bd75a1ae72a40f3b84dc9fc2da093243d79d2c3b0a2975dc128a81d5a34b931b35c6699b415974e46be9c3e2b5f05f35d1c0c16fc333dde7e76366fe
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exeFilesize
39.4MB
MD5c76a08483da34968a980f61c4ed213b2
SHA131c6a8bb95c024b52f3c8d62a61450741275d947
SHA256a3826acb079a1ba1b1117d8d0036f2d91b630ef2a7aabd39149510b700901b20
SHA512cb017094bd75a1ae72a40f3b84dc9fc2da093243d79d2c3b0a2975dc128a81d5a34b931b35c6699b415974e46be9c3e2b5f05f35d1c0c16fc333dde7e76366fe
-
memory/1820-154-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/1820-151-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/1820-161-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/1820-159-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/1820-157-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/1820-156-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/2456-163-0x0000000000000000-mapping.dmp
-
memory/2456-178-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/2456-176-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/2456-179-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/2456-180-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/3224-160-0x0000000000000000-mapping.dmp
-
memory/3224-177-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/3224-175-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/4772-144-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/4772-138-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/4772-132-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/4772-139-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/4772-136-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/4772-133-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/4772-137-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/4912-152-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/4912-158-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/4912-140-0x0000000000000000-mapping.dmp
-
memory/4912-147-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB