Analysis
-
max time kernel
147s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-09-2022 06:16
Static task
static1
General
-
Target
d986ef8283fda24f7bc5677e21048a058b85838948ec3b6d17d3ec32d9ba4426.exe
-
Size
375KB
-
MD5
01f50394af09a978e0818b1c12e0cd64
-
SHA1
21162ef465817c3903995300aa370bad481d55a1
-
SHA256
d986ef8283fda24f7bc5677e21048a058b85838948ec3b6d17d3ec32d9ba4426
-
SHA512
bf609ee2ef3948b50128f7a41b577e92c35bb2ccd1c8338294dbda68c325534d3667ee660dbf2c3e85519f3e59229e88ea0a0be751324609a64f0c9455793ea2
-
SSDEEP
6144:ev5zQJVb5p72cHF1ybDFwekh212KhvwIb759QOaBjpaVRPu23E2rJmWjFc94:e4VOiF1WD7kE1dTYOi8V5u23zmWFy4
Malware Config
Signatures
-
Gh0st RAT payload 11 IoCs
Processes:
resource yara_rule behavioral1/memory/3516-136-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/3516-137-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/3516-138-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/3516-139-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/4924-150-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/2416-155-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/2416-156-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/2416-159-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/2416-160-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/3972-177-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/3972-178-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat -
Executes dropped EXE 4 IoCs
Processes:
SQLSerasi.exeSQLSerasi.exeSQLSerasi.exeSQLSerasi.exepid process 4924 SQLSerasi.exe 2416 SQLSerasi.exe 3972 SQLSerasi.exe 3508 SQLSerasi.exe -
Processes:
resource yara_rule behavioral1/memory/3516-133-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/3516-136-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/3516-137-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/3516-138-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/3516-139-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/4924-150-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/2416-152-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/2416-155-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/2416-156-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/2416-159-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/2416-160-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/3972-177-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/3972-178-0x0000000010000000-0x0000000010362000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
d986ef8283fda24f7bc5677e21048a058b85838948ec3b6d17d3ec32d9ba4426.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation d986ef8283fda24f7bc5677e21048a058b85838948ec3b6d17d3ec32d9ba4426.exe -
Drops file in System32 directory 4 IoCs
Processes:
SQLSerasi.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 SQLSerasi.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE SQLSerasi.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies SQLSerasi.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 SQLSerasi.exe -
Drops file in Program Files directory 2 IoCs
Processes:
d986ef8283fda24f7bc5677e21048a058b85838948ec3b6d17d3ec32d9ba4426.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe d986ef8283fda24f7bc5677e21048a058b85838948ec3b6d17d3ec32d9ba4426.exe File created C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe d986ef8283fda24f7bc5677e21048a058b85838948ec3b6d17d3ec32d9ba4426.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1060 2416 WerFault.exe SQLSerasi.exe -
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
SQLSerasi.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 SQLSerasi.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString SQLSerasi.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 SQLSerasi.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString SQLSerasi.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 SQLSerasi.exe -
Modifies data under HKEY_USERS 8 IoCs
Processes:
SQLSerasi.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" SQLSerasi.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" SQLSerasi.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ SQLSerasi.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" SQLSerasi.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" SQLSerasi.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" SQLSerasi.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" SQLSerasi.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix SQLSerasi.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
d986ef8283fda24f7bc5677e21048a058b85838948ec3b6d17d3ec32d9ba4426.exeSQLSerasi.exeSQLSerasi.exeSQLSerasi.exeSQLSerasi.exedescription pid process Token: SeDebugPrivilege 3516 d986ef8283fda24f7bc5677e21048a058b85838948ec3b6d17d3ec32d9ba4426.exe Token: SeDebugPrivilege 4924 SQLSerasi.exe Token: SeDebugPrivilege 2416 SQLSerasi.exe Token: SeDebugPrivilege 2416 SQLSerasi.exe Token: SeDebugPrivilege 2416 SQLSerasi.exe Token: SeDebugPrivilege 3972 SQLSerasi.exe Token: SeDebugPrivilege 3508 SQLSerasi.exe Token: SeDebugPrivilege 3972 SQLSerasi.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
d986ef8283fda24f7bc5677e21048a058b85838948ec3b6d17d3ec32d9ba4426.exeSQLSerasi.exedescription pid process target process PID 3516 wrote to memory of 4924 3516 d986ef8283fda24f7bc5677e21048a058b85838948ec3b6d17d3ec32d9ba4426.exe SQLSerasi.exe PID 3516 wrote to memory of 4924 3516 d986ef8283fda24f7bc5677e21048a058b85838948ec3b6d17d3ec32d9ba4426.exe SQLSerasi.exe PID 3516 wrote to memory of 4924 3516 d986ef8283fda24f7bc5677e21048a058b85838948ec3b6d17d3ec32d9ba4426.exe SQLSerasi.exe PID 2416 wrote to memory of 3972 2416 SQLSerasi.exe SQLSerasi.exe PID 2416 wrote to memory of 3972 2416 SQLSerasi.exe SQLSerasi.exe PID 2416 wrote to memory of 3972 2416 SQLSerasi.exe SQLSerasi.exe PID 2416 wrote to memory of 3508 2416 SQLSerasi.exe SQLSerasi.exe PID 2416 wrote to memory of 3508 2416 SQLSerasi.exe SQLSerasi.exe PID 2416 wrote to memory of 3508 2416 SQLSerasi.exe SQLSerasi.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d986ef8283fda24f7bc5677e21048a058b85838948ec3b6d17d3ec32d9ba4426.exe"C:\Users\Admin\AppData\Local\Temp\d986ef8283fda24f7bc5677e21048a058b85838948ec3b6d17d3ec32d9ba4426.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 5762⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2416 -ip 24161⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exeFilesize
39.4MB
MD510f1046cc9504934ef6d634cdbaaadb3
SHA1ebaf5b0edd75a02497134d17cfd38623b59d5bd1
SHA2566166299a7e4bc1a4f64bc94adde640e906565e0f0c31109942f7aa098fde4f32
SHA512334b949ee72f34b5fb268ee577837894a7e5cc7071ab339037125b7b72f7d6e4db624e9d3a6745eae9d403b97bc93c43368d67762ee04aa492623ce34288ec7d
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exeFilesize
39.4MB
MD510f1046cc9504934ef6d634cdbaaadb3
SHA1ebaf5b0edd75a02497134d17cfd38623b59d5bd1
SHA2566166299a7e4bc1a4f64bc94adde640e906565e0f0c31109942f7aa098fde4f32
SHA512334b949ee72f34b5fb268ee577837894a7e5cc7071ab339037125b7b72f7d6e4db624e9d3a6745eae9d403b97bc93c43368d67762ee04aa492623ce34288ec7d
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exeFilesize
39.4MB
MD510f1046cc9504934ef6d634cdbaaadb3
SHA1ebaf5b0edd75a02497134d17cfd38623b59d5bd1
SHA2566166299a7e4bc1a4f64bc94adde640e906565e0f0c31109942f7aa098fde4f32
SHA512334b949ee72f34b5fb268ee577837894a7e5cc7071ab339037125b7b72f7d6e4db624e9d3a6745eae9d403b97bc93c43368d67762ee04aa492623ce34288ec7d
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exeFilesize
39.4MB
MD510f1046cc9504934ef6d634cdbaaadb3
SHA1ebaf5b0edd75a02497134d17cfd38623b59d5bd1
SHA2566166299a7e4bc1a4f64bc94adde640e906565e0f0c31109942f7aa098fde4f32
SHA512334b949ee72f34b5fb268ee577837894a7e5cc7071ab339037125b7b72f7d6e4db624e9d3a6745eae9d403b97bc93c43368d67762ee04aa492623ce34288ec7d
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exeFilesize
39.4MB
MD510f1046cc9504934ef6d634cdbaaadb3
SHA1ebaf5b0edd75a02497134d17cfd38623b59d5bd1
SHA2566166299a7e4bc1a4f64bc94adde640e906565e0f0c31109942f7aa098fde4f32
SHA512334b949ee72f34b5fb268ee577837894a7e5cc7071ab339037125b7b72f7d6e4db624e9d3a6745eae9d403b97bc93c43368d67762ee04aa492623ce34288ec7d
-
memory/2416-152-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/2416-160-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/2416-157-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/2416-159-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/2416-156-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/2416-155-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/3508-176-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/3508-162-0x0000000000000000-mapping.dmp
-
memory/3516-148-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/3516-133-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/3516-139-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/3516-137-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/3516-138-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/3516-132-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/3516-136-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/3972-161-0x0000000000000000-mapping.dmp
-
memory/3972-175-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/3972-177-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/3972-178-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/4924-149-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/4924-158-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/4924-140-0x0000000000000000-mapping.dmp
-
memory/4924-150-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB