Analysis
-
max time kernel
145s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
06-08-2022 06:07
Static task
static1
General
-
Target
7e446910eb4487094a244ea4299e733897dff1eabe6cbf1bd3952b73bdadedc0.exe
-
Size
375KB
-
MD5
d25703874ff5b46f76ce906d5d3f7b80
-
SHA1
6c0dbe6fdfd175ec93c460627e4029bb4277b871
-
SHA256
7e446910eb4487094a244ea4299e733897dff1eabe6cbf1bd3952b73bdadedc0
-
SHA512
c1abdbb580a231908a46e46a4e41612561aaad1b4d6b354b006d3011beba8867e6c5d45a28dae8db73d4ff87ddcda65e612ef0d8abdc4b09bc97a835cfffe79f
Malware Config
Signatures
-
Gh0st RAT payload 11 IoCs
Processes:
resource yara_rule behavioral1/memory/4272-134-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/4272-135-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/4272-136-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/4352-145-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/4352-148-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/4288-153-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/4288-154-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/4288-156-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/5104-174-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/2680-175-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/4288-177-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat -
Executes dropped EXE 4 IoCs
Processes:
SQLSerasi.exeSQLSerasi.exeSQLSerasi.exeSQLSerasi.exepid process 4352 SQLSerasi.exe 4288 SQLSerasi.exe 5104 SQLSerasi.exe 2680 SQLSerasi.exe -
Processes:
resource yara_rule behavioral1/memory/4272-131-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/4272-134-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/4272-135-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/4272-136-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/4352-145-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/4352-148-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/4288-150-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/4288-153-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/4288-154-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/4288-156-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/5104-174-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/2680-175-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/4288-177-0x0000000010000000-0x0000000010362000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
7e446910eb4487094a244ea4299e733897dff1eabe6cbf1bd3952b73bdadedc0.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation 7e446910eb4487094a244ea4299e733897dff1eabe6cbf1bd3952b73bdadedc0.exe -
Drops file in System32 directory 4 IoCs
Processes:
SQLSerasi.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 SQLSerasi.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 SQLSerasi.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE SQLSerasi.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies SQLSerasi.exe -
Drops file in Program Files directory 2 IoCs
Processes:
7e446910eb4487094a244ea4299e733897dff1eabe6cbf1bd3952b73bdadedc0.exedescription ioc process File created C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe 7e446910eb4487094a244ea4299e733897dff1eabe6cbf1bd3952b73bdadedc0.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe 7e446910eb4487094a244ea4299e733897dff1eabe6cbf1bd3952b73bdadedc0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4792 4288 WerFault.exe SQLSerasi.exe -
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
SQLSerasi.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 SQLSerasi.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString SQLSerasi.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 SQLSerasi.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString SQLSerasi.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 SQLSerasi.exe -
Modifies data under HKEY_USERS 8 IoCs
Processes:
SQLSerasi.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ SQLSerasi.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" SQLSerasi.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" SQLSerasi.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" SQLSerasi.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" SQLSerasi.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix SQLSerasi.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" SQLSerasi.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" SQLSerasi.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
7e446910eb4487094a244ea4299e733897dff1eabe6cbf1bd3952b73bdadedc0.exeSQLSerasi.exeSQLSerasi.exeSQLSerasi.exeSQLSerasi.exedescription pid process Token: SeDebugPrivilege 4272 7e446910eb4487094a244ea4299e733897dff1eabe6cbf1bd3952b73bdadedc0.exe Token: SeDebugPrivilege 4352 SQLSerasi.exe Token: SeDebugPrivilege 4288 SQLSerasi.exe Token: SeDebugPrivilege 4288 SQLSerasi.exe Token: SeDebugPrivilege 4288 SQLSerasi.exe Token: SeDebugPrivilege 5104 SQLSerasi.exe Token: SeDebugPrivilege 2680 SQLSerasi.exe Token: SeDebugPrivilege 5104 SQLSerasi.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
7e446910eb4487094a244ea4299e733897dff1eabe6cbf1bd3952b73bdadedc0.exeSQLSerasi.exedescription pid process target process PID 4272 wrote to memory of 4352 4272 7e446910eb4487094a244ea4299e733897dff1eabe6cbf1bd3952b73bdadedc0.exe SQLSerasi.exe PID 4272 wrote to memory of 4352 4272 7e446910eb4487094a244ea4299e733897dff1eabe6cbf1bd3952b73bdadedc0.exe SQLSerasi.exe PID 4272 wrote to memory of 4352 4272 7e446910eb4487094a244ea4299e733897dff1eabe6cbf1bd3952b73bdadedc0.exe SQLSerasi.exe PID 4288 wrote to memory of 5104 4288 SQLSerasi.exe SQLSerasi.exe PID 4288 wrote to memory of 5104 4288 SQLSerasi.exe SQLSerasi.exe PID 4288 wrote to memory of 5104 4288 SQLSerasi.exe SQLSerasi.exe PID 4288 wrote to memory of 2680 4288 SQLSerasi.exe SQLSerasi.exe PID 4288 wrote to memory of 2680 4288 SQLSerasi.exe SQLSerasi.exe PID 4288 wrote to memory of 2680 4288 SQLSerasi.exe SQLSerasi.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e446910eb4487094a244ea4299e733897dff1eabe6cbf1bd3952b73bdadedc0.exe"C:\Users\Admin\AppData\Local\Temp\7e446910eb4487094a244ea4299e733897dff1eabe6cbf1bd3952b73bdadedc0.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4288 -s 6722⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4288 -ip 42881⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exeFilesize
39.4MB
MD5bf11edcbf1f54c6c68522c4fc64cdcc3
SHA1d34719404aa1b3add19cf85b206b04fc5cbe7ff4
SHA25667634b016be5942e3f2298c27ec0ef8bbd37f666b084b5ce7fd0d0c614ac128a
SHA512426f4fcb46902d7d6fefa3b6824ceefd78ed7d43e83810e8792ad2fa38e3cc2bba62f619d1793a56dbbe7d72b0067faddd0743a8981fe692e8fd32f834c64f18
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exeFilesize
39.4MB
MD5bf11edcbf1f54c6c68522c4fc64cdcc3
SHA1d34719404aa1b3add19cf85b206b04fc5cbe7ff4
SHA25667634b016be5942e3f2298c27ec0ef8bbd37f666b084b5ce7fd0d0c614ac128a
SHA512426f4fcb46902d7d6fefa3b6824ceefd78ed7d43e83810e8792ad2fa38e3cc2bba62f619d1793a56dbbe7d72b0067faddd0743a8981fe692e8fd32f834c64f18
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exeFilesize
39.4MB
MD5bf11edcbf1f54c6c68522c4fc64cdcc3
SHA1d34719404aa1b3add19cf85b206b04fc5cbe7ff4
SHA25667634b016be5942e3f2298c27ec0ef8bbd37f666b084b5ce7fd0d0c614ac128a
SHA512426f4fcb46902d7d6fefa3b6824ceefd78ed7d43e83810e8792ad2fa38e3cc2bba62f619d1793a56dbbe7d72b0067faddd0743a8981fe692e8fd32f834c64f18
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exeFilesize
39.4MB
MD5bf11edcbf1f54c6c68522c4fc64cdcc3
SHA1d34719404aa1b3add19cf85b206b04fc5cbe7ff4
SHA25667634b016be5942e3f2298c27ec0ef8bbd37f666b084b5ce7fd0d0c614ac128a
SHA512426f4fcb46902d7d6fefa3b6824ceefd78ed7d43e83810e8792ad2fa38e3cc2bba62f619d1793a56dbbe7d72b0067faddd0743a8981fe692e8fd32f834c64f18
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exeFilesize
39.4MB
MD5bf11edcbf1f54c6c68522c4fc64cdcc3
SHA1d34719404aa1b3add19cf85b206b04fc5cbe7ff4
SHA25667634b016be5942e3f2298c27ec0ef8bbd37f666b084b5ce7fd0d0c614ac128a
SHA512426f4fcb46902d7d6fefa3b6824ceefd78ed7d43e83810e8792ad2fa38e3cc2bba62f619d1793a56dbbe7d72b0067faddd0743a8981fe692e8fd32f834c64f18
-
memory/2680-160-0x0000000000000000-mapping.dmp
-
memory/2680-176-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/2680-175-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/2680-173-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/4272-134-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/4272-136-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/4272-140-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/4272-135-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/4272-131-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/4272-130-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/4288-155-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/4288-150-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/4288-177-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/4288-153-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/4288-156-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/4288-154-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/4352-137-0x0000000000000000-mapping.dmp
-
memory/4352-148-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/4352-147-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/4352-145-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/4352-157-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/5104-158-0x0000000000000000-mapping.dmp
-
memory/5104-172-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/5104-174-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB