Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows10-1703_x64 -
resource
win10-20220718-en -
resource tags
arch:x64arch:x86image:win10-20220718-enlocale:en-usos:windows10-1703-x64system -
submitted
06-08-2022 06:46
Static task
static1
General
-
Target
1b123b275fb37846ba0d083dce02d4c407d87b30aa105f1c27b556bbae0a4491.exe
-
Size
375KB
-
MD5
da256f1d62cfe2aed428e42b9bc71192
-
SHA1
90455fdc445a4f2b97b1aca31d6a5329838d8df2
-
SHA256
1b123b275fb37846ba0d083dce02d4c407d87b30aa105f1c27b556bbae0a4491
-
SHA512
1f509907452e39cae2895f31b24513e762b7d741aac36bf955ab624f6d9f2a8d31ce6b3658e05eed2fce9238a99fd37785265a1d3e3bb7f8b2ea5732d8485d06
Malware Config
Signatures
-
Gh0st RAT payload 8 IoCs
Processes:
resource yara_rule behavioral1/memory/1316-171-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/1316-172-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/1316-175-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/2028-257-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/188-296-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/188-314-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/3768-357-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/3768-360-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat -
Executes dropped EXE 3 IoCs
Processes:
SQLSerasi.exeSQLSerasi.exeSQLSerasi.exepid process 2028 SQLSerasi.exe 188 SQLSerasi.exe 3768 SQLSerasi.exe -
Processes:
resource yara_rule behavioral1/memory/1316-167-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/1316-171-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/1316-172-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/1316-175-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/2028-257-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/188-296-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/188-314-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/3768-357-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/3768-360-0x0000000010000000-0x0000000010362000-memory.dmp upx -
Drops file in System32 directory 5 IoCs
Processes:
SQLSerasi.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 SQLSerasi.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE SQLSerasi.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies SQLSerasi.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 SQLSerasi.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat SQLSerasi.exe -
Drops file in Program Files directory 2 IoCs
Processes:
1b123b275fb37846ba0d083dce02d4c407d87b30aa105f1c27b556bbae0a4491.exedescription ioc process File created C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe 1b123b275fb37846ba0d083dce02d4c407d87b30aa105f1c27b556bbae0a4491.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe 1b123b275fb37846ba0d083dce02d4c407d87b30aa105f1c27b556bbae0a4491.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
SQLSerasi.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 SQLSerasi.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString SQLSerasi.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 SQLSerasi.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString SQLSerasi.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 SQLSerasi.exe -
Modifies data under HKEY_USERS 8 IoCs
Processes:
SQLSerasi.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" SQLSerasi.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" SQLSerasi.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix SQLSerasi.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" SQLSerasi.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" SQLSerasi.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ SQLSerasi.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" SQLSerasi.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" SQLSerasi.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
1b123b275fb37846ba0d083dce02d4c407d87b30aa105f1c27b556bbae0a4491.exeSQLSerasi.exeSQLSerasi.exeSQLSerasi.exedescription pid process Token: SeDebugPrivilege 1316 1b123b275fb37846ba0d083dce02d4c407d87b30aa105f1c27b556bbae0a4491.exe Token: SeDebugPrivilege 2028 SQLSerasi.exe Token: SeDebugPrivilege 188 SQLSerasi.exe Token: SeDebugPrivilege 188 SQLSerasi.exe Token: SeDebugPrivilege 3768 SQLSerasi.exe Token: SeDebugPrivilege 3768 SQLSerasi.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
1b123b275fb37846ba0d083dce02d4c407d87b30aa105f1c27b556bbae0a4491.exeSQLSerasi.exedescription pid process target process PID 1316 wrote to memory of 2028 1316 1b123b275fb37846ba0d083dce02d4c407d87b30aa105f1c27b556bbae0a4491.exe SQLSerasi.exe PID 1316 wrote to memory of 2028 1316 1b123b275fb37846ba0d083dce02d4c407d87b30aa105f1c27b556bbae0a4491.exe SQLSerasi.exe PID 1316 wrote to memory of 2028 1316 1b123b275fb37846ba0d083dce02d4c407d87b30aa105f1c27b556bbae0a4491.exe SQLSerasi.exe PID 188 wrote to memory of 3768 188 SQLSerasi.exe SQLSerasi.exe PID 188 wrote to memory of 3768 188 SQLSerasi.exe SQLSerasi.exe PID 188 wrote to memory of 3768 188 SQLSerasi.exe SQLSerasi.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1b123b275fb37846ba0d083dce02d4c407d87b30aa105f1c27b556bbae0a4491.exe"C:\Users\Admin\AppData\Local\Temp\1b123b275fb37846ba0d083dce02d4c407d87b30aa105f1c27b556bbae0a4491.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exeFilesize
39.4MB
MD58d1c5f2a16658215990b11baf446daeb
SHA1b26a3b4e833b29f7142dddd4196c276ce166a3e9
SHA2562b7fb24bebcb67ce89eb3ac945c8448062c0a5e74791d87247744877e046a6b1
SHA5127ecf6308e355b6adeacea3515260632551ef15911eae96e7a8af3e9a0f5b0805d3c881f313a618901eda7526797172f4edf6e2483fcc60aa216f17f529643be4
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exeFilesize
39.4MB
MD58d1c5f2a16658215990b11baf446daeb
SHA1b26a3b4e833b29f7142dddd4196c276ce166a3e9
SHA2562b7fb24bebcb67ce89eb3ac945c8448062c0a5e74791d87247744877e046a6b1
SHA5127ecf6308e355b6adeacea3515260632551ef15911eae96e7a8af3e9a0f5b0805d3c881f313a618901eda7526797172f4edf6e2483fcc60aa216f17f529643be4
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exeFilesize
39.4MB
MD58d1c5f2a16658215990b11baf446daeb
SHA1b26a3b4e833b29f7142dddd4196c276ce166a3e9
SHA2562b7fb24bebcb67ce89eb3ac945c8448062c0a5e74791d87247744877e046a6b1
SHA5127ecf6308e355b6adeacea3515260632551ef15911eae96e7a8af3e9a0f5b0805d3c881f313a618901eda7526797172f4edf6e2483fcc60aa216f17f529643be4
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exeFilesize
39.4MB
MD58d1c5f2a16658215990b11baf446daeb
SHA1b26a3b4e833b29f7142dddd4196c276ce166a3e9
SHA2562b7fb24bebcb67ce89eb3ac945c8448062c0a5e74791d87247744877e046a6b1
SHA5127ecf6308e355b6adeacea3515260632551ef15911eae96e7a8af3e9a0f5b0805d3c881f313a618901eda7526797172f4edf6e2483fcc60aa216f17f529643be4
-
memory/188-296-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/188-369-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/188-314-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/1316-150-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/1316-124-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/1316-121-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/1316-123-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/1316-153-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/1316-154-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/1316-125-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/1316-126-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/1316-127-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/1316-128-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/1316-129-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/1316-130-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/1316-131-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/1316-132-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/1316-133-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/1316-134-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/1316-135-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/1316-136-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/1316-137-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/1316-138-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/1316-140-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/1316-139-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/1316-141-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/1316-142-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/1316-144-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/1316-143-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/1316-145-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/1316-146-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/1316-147-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/1316-148-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/1316-149-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/1316-119-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/1316-151-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/1316-152-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/1316-155-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/1316-120-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/1316-122-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/1316-156-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/1316-157-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/1316-159-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/1316-158-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/1316-160-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/1316-161-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/1316-162-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/1316-163-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/1316-164-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/1316-165-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/1316-166-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/1316-167-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/1316-170-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/1316-171-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/1316-172-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/1316-173-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/1316-174-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/1316-175-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/1316-176-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/1316-177-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/1316-178-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/1316-179-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/1316-180-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/1316-181-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/1316-182-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/1316-189-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/1316-117-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/1316-118-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/2028-299-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/2028-257-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/2028-185-0x0000000000000000-mapping.dmp
-
memory/3768-301-0x0000000000000000-mapping.dmp
-
memory/3768-357-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/3768-360-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/3768-370-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB