Analysis
-
max time kernel
143s -
max time network
144s -
platform
windows10-1703_x64 -
resource
win10-20220718-en -
resource tags
arch:x64arch:x86image:win10-20220718-enlocale:en-usos:windows10-1703-x64system -
submitted
06-08-2022 05:52
Static task
static1
General
-
Target
7f91a01ff7e98f0475e6cecf03e7760162ba8979772c171cb21cfb619d457181.exe
-
Size
375KB
-
MD5
bf01905b45b0b61fa62f73b9f3f54324
-
SHA1
3d43b7f4a394621baf814e702110344ea0aa3a11
-
SHA256
7f91a01ff7e98f0475e6cecf03e7760162ba8979772c171cb21cfb619d457181
-
SHA512
9f52b816cb308a019993786b35a562e39342ae2d5b1d4fca2bf11907da1e7ccbbcbfc48d5596149567eaa50ec69fba658258a0551eda2bb105365f2de5d215a1
Malware Config
Signatures
-
Gh0st RAT payload 9 IoCs
Processes:
resource yara_rule behavioral1/memory/1788-172-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/1788-173-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/1788-178-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/4232-255-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/2232-299-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/1900-358-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/1900-359-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/2232-371-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/1900-372-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat -
Executes dropped EXE 3 IoCs
Processes:
SQLSerasi.exeSQLSerasi.exeSQLSerasi.exepid process 4232 SQLSerasi.exe 2232 SQLSerasi.exe 1900 SQLSerasi.exe -
Processes:
resource yara_rule behavioral1/memory/1788-167-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/1788-172-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/1788-173-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/1788-178-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/4232-255-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/2232-299-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/1900-358-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/1900-359-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/2232-371-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/1900-372-0x0000000010000000-0x0000000010362000-memory.dmp upx -
Drops file in System32 directory 5 IoCs
Processes:
SQLSerasi.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat SQLSerasi.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 SQLSerasi.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE SQLSerasi.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies SQLSerasi.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 SQLSerasi.exe -
Drops file in Program Files directory 2 IoCs
Processes:
7f91a01ff7e98f0475e6cecf03e7760162ba8979772c171cb21cfb619d457181.exedescription ioc process File created C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe 7f91a01ff7e98f0475e6cecf03e7760162ba8979772c171cb21cfb619d457181.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe 7f91a01ff7e98f0475e6cecf03e7760162ba8979772c171cb21cfb619d457181.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
SQLSerasi.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString SQLSerasi.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 SQLSerasi.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString SQLSerasi.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 SQLSerasi.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 SQLSerasi.exe -
Modifies data under HKEY_USERS 8 IoCs
Processes:
SQLSerasi.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ SQLSerasi.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" SQLSerasi.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" SQLSerasi.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" SQLSerasi.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" SQLSerasi.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix SQLSerasi.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" SQLSerasi.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" SQLSerasi.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
7f91a01ff7e98f0475e6cecf03e7760162ba8979772c171cb21cfb619d457181.exeSQLSerasi.exeSQLSerasi.exeSQLSerasi.exedescription pid process Token: SeDebugPrivilege 1788 7f91a01ff7e98f0475e6cecf03e7760162ba8979772c171cb21cfb619d457181.exe Token: SeDebugPrivilege 4232 SQLSerasi.exe Token: SeDebugPrivilege 2232 SQLSerasi.exe Token: SeDebugPrivilege 2232 SQLSerasi.exe Token: SeDebugPrivilege 1900 SQLSerasi.exe Token: SeDebugPrivilege 1900 SQLSerasi.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
7f91a01ff7e98f0475e6cecf03e7760162ba8979772c171cb21cfb619d457181.exeSQLSerasi.exedescription pid process target process PID 1788 wrote to memory of 4232 1788 7f91a01ff7e98f0475e6cecf03e7760162ba8979772c171cb21cfb619d457181.exe SQLSerasi.exe PID 1788 wrote to memory of 4232 1788 7f91a01ff7e98f0475e6cecf03e7760162ba8979772c171cb21cfb619d457181.exe SQLSerasi.exe PID 1788 wrote to memory of 4232 1788 7f91a01ff7e98f0475e6cecf03e7760162ba8979772c171cb21cfb619d457181.exe SQLSerasi.exe PID 2232 wrote to memory of 1900 2232 SQLSerasi.exe SQLSerasi.exe PID 2232 wrote to memory of 1900 2232 SQLSerasi.exe SQLSerasi.exe PID 2232 wrote to memory of 1900 2232 SQLSerasi.exe SQLSerasi.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f91a01ff7e98f0475e6cecf03e7760162ba8979772c171cb21cfb619d457181.exe"C:\Users\Admin\AppData\Local\Temp\7f91a01ff7e98f0475e6cecf03e7760162ba8979772c171cb21cfb619d457181.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exeFilesize
39.4MB
MD545bdfbeeb19cff7013e0be78d96dd5f1
SHA14ad8d5c145240eec98fa7c5cf144bb0bf08a9267
SHA25651d78d09af66c5de34a6acffaa9e53408f3175609c2a74e64d9b92f507ebc2e2
SHA5124116195e1a3adc97567673659f780af014064ceb99d6f5a92a7a37429795b70f607a7af89e9f8db75c2377a4b6cf16b41e642795d25b69262b3dd9ee50b09b20
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exeFilesize
39.4MB
MD545bdfbeeb19cff7013e0be78d96dd5f1
SHA14ad8d5c145240eec98fa7c5cf144bb0bf08a9267
SHA25651d78d09af66c5de34a6acffaa9e53408f3175609c2a74e64d9b92f507ebc2e2
SHA5124116195e1a3adc97567673659f780af014064ceb99d6f5a92a7a37429795b70f607a7af89e9f8db75c2377a4b6cf16b41e642795d25b69262b3dd9ee50b09b20
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exeFilesize
39.4MB
MD545bdfbeeb19cff7013e0be78d96dd5f1
SHA14ad8d5c145240eec98fa7c5cf144bb0bf08a9267
SHA25651d78d09af66c5de34a6acffaa9e53408f3175609c2a74e64d9b92f507ebc2e2
SHA5124116195e1a3adc97567673659f780af014064ceb99d6f5a92a7a37429795b70f607a7af89e9f8db75c2377a4b6cf16b41e642795d25b69262b3dd9ee50b09b20
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exeFilesize
39.4MB
MD545bdfbeeb19cff7013e0be78d96dd5f1
SHA14ad8d5c145240eec98fa7c5cf144bb0bf08a9267
SHA25651d78d09af66c5de34a6acffaa9e53408f3175609c2a74e64d9b92f507ebc2e2
SHA5124116195e1a3adc97567673659f780af014064ceb99d6f5a92a7a37429795b70f607a7af89e9f8db75c2377a4b6cf16b41e642795d25b69262b3dd9ee50b09b20
-
memory/1788-153-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1788-189-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/1788-119-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1788-120-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1788-121-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1788-122-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1788-123-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/1788-124-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1788-125-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1788-126-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1788-127-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1788-128-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1788-130-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1788-131-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1788-132-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1788-129-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1788-134-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1788-136-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1788-135-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1788-138-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1788-137-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1788-133-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1788-139-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1788-140-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1788-141-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1788-142-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1788-143-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1788-144-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1788-145-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1788-146-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1788-147-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1788-148-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1788-149-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1788-150-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1788-151-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1788-152-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1788-165-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1788-154-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1788-118-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1788-156-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1788-157-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1788-158-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1788-159-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1788-160-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1788-161-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1788-162-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1788-163-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1788-164-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1788-117-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1788-166-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1788-167-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/1788-172-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/1788-170-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1788-173-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/1788-174-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1788-175-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1788-176-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1788-177-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1788-178-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/1788-179-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1788-180-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1788-181-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1788-182-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1788-183-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1788-155-0x0000000077110000-0x000000007729E000-memory.dmpFilesize
1.6MB
-
memory/1900-302-0x0000000000000000-mapping.dmp
-
memory/1900-344-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/1900-358-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/1900-359-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/1900-372-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/2232-299-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/2232-370-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/2232-371-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/4232-186-0x0000000000000000-mapping.dmp
-
memory/4232-255-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/4232-300-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB