Analysis
-
max time kernel
144s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
06-08-2022 06:28
Static task
static1
General
-
Target
153948dc95a042a29c2f5314aac8460107f6c57e74f4c4344fc2cf9cc9da07b3.exe
-
Size
375KB
-
MD5
6775433aada04da42f2dcacb863bff9a
-
SHA1
289bf6f2c50685d6153bbc762aad32571600d86a
-
SHA256
153948dc95a042a29c2f5314aac8460107f6c57e74f4c4344fc2cf9cc9da07b3
-
SHA512
465fa8c27df4dea1ed972adc89fe4c0b4d17d4969023ee88b0d4a12df15e0c9240c45f9afa9a8b714ac44432f623572a7329cace68a8688a09bb6ccd857d6741
Malware Config
Signatures
-
Gh0st RAT payload 11 IoCs
Processes:
resource yara_rule behavioral1/memory/4296-135-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/4296-134-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/4296-136-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/552-151-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/8-150-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/552-153-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/552-155-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/2648-173-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/5072-174-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/552-176-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/5072-177-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat -
Executes dropped EXE 4 IoCs
Processes:
SQLSerasi.exeSQLSerasi.exeSQLSerasi.exeSQLSerasi.exepid process 8 SQLSerasi.exe 552 SQLSerasi.exe 2648 SQLSerasi.exe 5072 SQLSerasi.exe -
Processes:
resource yara_rule behavioral1/memory/4296-130-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/4296-135-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/4296-134-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/4296-136-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/552-147-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/552-151-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/8-150-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/552-153-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/552-155-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/2648-173-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/5072-174-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/552-176-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/5072-177-0x0000000010000000-0x0000000010362000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
153948dc95a042a29c2f5314aac8460107f6c57e74f4c4344fc2cf9cc9da07b3.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Control Panel\International\Geo\Nation 153948dc95a042a29c2f5314aac8460107f6c57e74f4c4344fc2cf9cc9da07b3.exe -
Drops file in System32 directory 4 IoCs
Processes:
SQLSerasi.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 SQLSerasi.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 SQLSerasi.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE SQLSerasi.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies SQLSerasi.exe -
Drops file in Program Files directory 2 IoCs
Processes:
153948dc95a042a29c2f5314aac8460107f6c57e74f4c4344fc2cf9cc9da07b3.exedescription ioc process File created C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe 153948dc95a042a29c2f5314aac8460107f6c57e74f4c4344fc2cf9cc9da07b3.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe 153948dc95a042a29c2f5314aac8460107f6c57e74f4c4344fc2cf9cc9da07b3.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 5056 552 WerFault.exe SQLSerasi.exe -
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
SQLSerasi.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 SQLSerasi.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString SQLSerasi.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 SQLSerasi.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString SQLSerasi.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 SQLSerasi.exe -
Modifies data under HKEY_USERS 8 IoCs
Processes:
SQLSerasi.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" SQLSerasi.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" SQLSerasi.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" SQLSerasi.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" SQLSerasi.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix SQLSerasi.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" SQLSerasi.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" SQLSerasi.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ SQLSerasi.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
153948dc95a042a29c2f5314aac8460107f6c57e74f4c4344fc2cf9cc9da07b3.exeSQLSerasi.exeSQLSerasi.exeSQLSerasi.exeSQLSerasi.exedescription pid process Token: SeDebugPrivilege 4296 153948dc95a042a29c2f5314aac8460107f6c57e74f4c4344fc2cf9cc9da07b3.exe Token: SeDebugPrivilege 8 SQLSerasi.exe Token: SeDebugPrivilege 552 SQLSerasi.exe Token: SeDebugPrivilege 552 SQLSerasi.exe Token: SeDebugPrivilege 552 SQLSerasi.exe Token: SeDebugPrivilege 5072 SQLSerasi.exe Token: SeDebugPrivilege 2648 SQLSerasi.exe Token: SeDebugPrivilege 5072 SQLSerasi.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
153948dc95a042a29c2f5314aac8460107f6c57e74f4c4344fc2cf9cc9da07b3.exeSQLSerasi.exedescription pid process target process PID 4296 wrote to memory of 8 4296 153948dc95a042a29c2f5314aac8460107f6c57e74f4c4344fc2cf9cc9da07b3.exe SQLSerasi.exe PID 4296 wrote to memory of 8 4296 153948dc95a042a29c2f5314aac8460107f6c57e74f4c4344fc2cf9cc9da07b3.exe SQLSerasi.exe PID 4296 wrote to memory of 8 4296 153948dc95a042a29c2f5314aac8460107f6c57e74f4c4344fc2cf9cc9da07b3.exe SQLSerasi.exe PID 552 wrote to memory of 2648 552 SQLSerasi.exe SQLSerasi.exe PID 552 wrote to memory of 2648 552 SQLSerasi.exe SQLSerasi.exe PID 552 wrote to memory of 2648 552 SQLSerasi.exe SQLSerasi.exe PID 552 wrote to memory of 5072 552 SQLSerasi.exe SQLSerasi.exe PID 552 wrote to memory of 5072 552 SQLSerasi.exe SQLSerasi.exe PID 552 wrote to memory of 5072 552 SQLSerasi.exe SQLSerasi.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\153948dc95a042a29c2f5314aac8460107f6c57e74f4c4344fc2cf9cc9da07b3.exe"C:\Users\Admin\AppData\Local\Temp\153948dc95a042a29c2f5314aac8460107f6c57e74f4c4344fc2cf9cc9da07b3.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 552 -s 6442⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 552 -ip 5521⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exeFilesize
39.4MB
MD542ee1b4662d2dd3838c863e349ec8bbb
SHA11b796d638cb5bc2c81023ad99ab2259407d86c8a
SHA256ab1a7aea73560515f410d0bea90ff98107cf0551ec2d865a6d5ac22684acf2e5
SHA5122b17bc4377904e807c55a7acca59b2f57b6804c1b6f352233971333a6361262f7c18592bda372d121fa46ac355ba52b03e6ee3057ee48f86b941875dc29b68ef
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exeFilesize
39.4MB
MD542ee1b4662d2dd3838c863e349ec8bbb
SHA11b796d638cb5bc2c81023ad99ab2259407d86c8a
SHA256ab1a7aea73560515f410d0bea90ff98107cf0551ec2d865a6d5ac22684acf2e5
SHA5122b17bc4377904e807c55a7acca59b2f57b6804c1b6f352233971333a6361262f7c18592bda372d121fa46ac355ba52b03e6ee3057ee48f86b941875dc29b68ef
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exeFilesize
39.4MB
MD542ee1b4662d2dd3838c863e349ec8bbb
SHA11b796d638cb5bc2c81023ad99ab2259407d86c8a
SHA256ab1a7aea73560515f410d0bea90ff98107cf0551ec2d865a6d5ac22684acf2e5
SHA5122b17bc4377904e807c55a7acca59b2f57b6804c1b6f352233971333a6361262f7c18592bda372d121fa46ac355ba52b03e6ee3057ee48f86b941875dc29b68ef
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exeFilesize
39.4MB
MD542ee1b4662d2dd3838c863e349ec8bbb
SHA11b796d638cb5bc2c81023ad99ab2259407d86c8a
SHA256ab1a7aea73560515f410d0bea90ff98107cf0551ec2d865a6d5ac22684acf2e5
SHA5122b17bc4377904e807c55a7acca59b2f57b6804c1b6f352233971333a6361262f7c18592bda372d121fa46ac355ba52b03e6ee3057ee48f86b941875dc29b68ef
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exeFilesize
39.4MB
MD542ee1b4662d2dd3838c863e349ec8bbb
SHA11b796d638cb5bc2c81023ad99ab2259407d86c8a
SHA256ab1a7aea73560515f410d0bea90ff98107cf0551ec2d865a6d5ac22684acf2e5
SHA5122b17bc4377904e807c55a7acca59b2f57b6804c1b6f352233971333a6361262f7c18592bda372d121fa46ac355ba52b03e6ee3057ee48f86b941875dc29b68ef
-
memory/8-150-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/8-137-0x0000000000000000-mapping.dmp
-
memory/8-156-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/8-154-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/552-155-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/552-152-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/552-151-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/552-176-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/552-147-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/552-153-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/2648-157-0x0000000000000000-mapping.dmp
-
memory/2648-175-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/2648-171-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/2648-173-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/4296-135-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/4296-140-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/4296-130-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/4296-134-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/4296-131-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/4296-136-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/5072-172-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/5072-174-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/5072-158-0x0000000000000000-mapping.dmp
-
memory/5072-177-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB