Analysis
-
max time kernel
149s -
max time network
140s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
23-09-2022 06:05
Static task
static1
General
-
Target
8f3f143e28eead11527fb7ec4571e526ee8a722683b2a7680b42b8c740e3fdec.exe
-
Size
375KB
-
MD5
2fe539abe7a94f228c035732e9f94fa2
-
SHA1
2a6e2db0c7b5796fef32591d0b124f9ac82c76bd
-
SHA256
8f3f143e28eead11527fb7ec4571e526ee8a722683b2a7680b42b8c740e3fdec
-
SHA512
8ec31ffec79072ed9ff3952f9172e8bb7cef37b0521d0319308731b0ffac5ea46bc765d5cafb80a873390ec87a79fa09a86fb549ce633e9d303025f7bdca9e65
-
SSDEEP
6144:ov5zQJVb5p72cHF1ybDFwekh212KhvwIb759QOaBjpaVRPu23E2rJmWjFc94:o4VOiF1WD7kE1dTYOi8V5u23zmWFy4
Malware Config
Signatures
-
Gh0st RAT payload 9 IoCs
Processes:
resource yara_rule behavioral1/memory/2492-174-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/2492-175-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/2492-177-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/2492-179-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/932-283-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/4288-303-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/4516-362-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/4516-364-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/4288-373-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat -
Executes dropped EXE 3 IoCs
Processes:
SQLSerasi.exeSQLSerasi.exeSQLSerasi.exepid process 932 SQLSerasi.exe 4288 SQLSerasi.exe 4516 SQLSerasi.exe -
Processes:
resource yara_rule behavioral1/memory/2492-170-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/2492-174-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/2492-175-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/2492-177-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/2492-179-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/932-283-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/4288-303-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/4516-362-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/4516-364-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/4288-373-0x0000000010000000-0x0000000010362000-memory.dmp upx -
Drops file in System32 directory 5 IoCs
Processes:
SQLSerasi.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 SQLSerasi.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat SQLSerasi.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 SQLSerasi.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE SQLSerasi.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies SQLSerasi.exe -
Drops file in Program Files directory 2 IoCs
Processes:
8f3f143e28eead11527fb7ec4571e526ee8a722683b2a7680b42b8c740e3fdec.exedescription ioc process File created C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe 8f3f143e28eead11527fb7ec4571e526ee8a722683b2a7680b42b8c740e3fdec.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe 8f3f143e28eead11527fb7ec4571e526ee8a722683b2a7680b42b8c740e3fdec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
SQLSerasi.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 SQLSerasi.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString SQLSerasi.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 SQLSerasi.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString SQLSerasi.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 SQLSerasi.exe -
Modifies data under HKEY_USERS 8 IoCs
Processes:
SQLSerasi.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix SQLSerasi.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" SQLSerasi.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" SQLSerasi.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ SQLSerasi.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" SQLSerasi.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" SQLSerasi.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" SQLSerasi.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" SQLSerasi.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
8f3f143e28eead11527fb7ec4571e526ee8a722683b2a7680b42b8c740e3fdec.exeSQLSerasi.exeSQLSerasi.exeSQLSerasi.exedescription pid process Token: SeDebugPrivilege 2492 8f3f143e28eead11527fb7ec4571e526ee8a722683b2a7680b42b8c740e3fdec.exe Token: SeDebugPrivilege 932 SQLSerasi.exe Token: SeDebugPrivilege 4288 SQLSerasi.exe Token: SeDebugPrivilege 4288 SQLSerasi.exe Token: SeDebugPrivilege 4516 SQLSerasi.exe Token: SeDebugPrivilege 4516 SQLSerasi.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
8f3f143e28eead11527fb7ec4571e526ee8a722683b2a7680b42b8c740e3fdec.exeSQLSerasi.exedescription pid process target process PID 2492 wrote to memory of 932 2492 8f3f143e28eead11527fb7ec4571e526ee8a722683b2a7680b42b8c740e3fdec.exe SQLSerasi.exe PID 2492 wrote to memory of 932 2492 8f3f143e28eead11527fb7ec4571e526ee8a722683b2a7680b42b8c740e3fdec.exe SQLSerasi.exe PID 2492 wrote to memory of 932 2492 8f3f143e28eead11527fb7ec4571e526ee8a722683b2a7680b42b8c740e3fdec.exe SQLSerasi.exe PID 4288 wrote to memory of 4516 4288 SQLSerasi.exe SQLSerasi.exe PID 4288 wrote to memory of 4516 4288 SQLSerasi.exe SQLSerasi.exe PID 4288 wrote to memory of 4516 4288 SQLSerasi.exe SQLSerasi.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f3f143e28eead11527fb7ec4571e526ee8a722683b2a7680b42b8c740e3fdec.exe"C:\Users\Admin\AppData\Local\Temp\8f3f143e28eead11527fb7ec4571e526ee8a722683b2a7680b42b8c740e3fdec.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exeFilesize
39.4MB
MD55e9fd2a0eaa18cdb9656f4e64b804577
SHA119f1ebc5cbcac6ff33f6e744798eb525a49e796b
SHA2569572b28f1d792f2f599c5cb38ee7947fbfb4b3ee1e36f3b53d51f26220225673
SHA5129a49bcb5317fad463be6caa643966469e07e3e02b40210d6f8b59453d2dc075aadf866efb01bc8c8f50dd64f2d1803b1e0bf63e449eacc2846dfc68104611d8a
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exeFilesize
39.4MB
MD55e9fd2a0eaa18cdb9656f4e64b804577
SHA119f1ebc5cbcac6ff33f6e744798eb525a49e796b
SHA2569572b28f1d792f2f599c5cb38ee7947fbfb4b3ee1e36f3b53d51f26220225673
SHA5129a49bcb5317fad463be6caa643966469e07e3e02b40210d6f8b59453d2dc075aadf866efb01bc8c8f50dd64f2d1803b1e0bf63e449eacc2846dfc68104611d8a
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exeFilesize
39.4MB
MD55e9fd2a0eaa18cdb9656f4e64b804577
SHA119f1ebc5cbcac6ff33f6e744798eb525a49e796b
SHA2569572b28f1d792f2f599c5cb38ee7947fbfb4b3ee1e36f3b53d51f26220225673
SHA5129a49bcb5317fad463be6caa643966469e07e3e02b40210d6f8b59453d2dc075aadf866efb01bc8c8f50dd64f2d1803b1e0bf63e449eacc2846dfc68104611d8a
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exeFilesize
39.4MB
MD55e9fd2a0eaa18cdb9656f4e64b804577
SHA119f1ebc5cbcac6ff33f6e744798eb525a49e796b
SHA2569572b28f1d792f2f599c5cb38ee7947fbfb4b3ee1e36f3b53d51f26220225673
SHA5129a49bcb5317fad463be6caa643966469e07e3e02b40210d6f8b59453d2dc075aadf866efb01bc8c8f50dd64f2d1803b1e0bf63e449eacc2846dfc68104611d8a
-
memory/932-189-0x0000000000000000-mapping.dmp
-
memory/932-283-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/932-305-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/2492-155-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-164-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-124-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-126-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/2492-125-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-158-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-128-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-129-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-130-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-131-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-132-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-133-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-134-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-135-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-136-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-137-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-138-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-140-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-139-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-141-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-142-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-143-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-144-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-145-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-146-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-147-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-148-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-149-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-150-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-151-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-152-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-153-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-154-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-122-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-156-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-157-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-127-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-159-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-123-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-161-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-162-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-160-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-163-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-165-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-166-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-167-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-168-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-169-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-170-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/2492-173-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-174-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/2492-175-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/2492-177-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/2492-176-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-178-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-179-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/2492-180-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-181-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-182-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-183-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-184-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-185-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-186-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-193-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/2492-120-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/2492-121-0x0000000077D90000-0x0000000077F1E000-memory.dmpFilesize
1.6MB
-
memory/4288-303-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/4288-286-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/4288-373-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/4516-306-0x0000000000000000-mapping.dmp
-
memory/4516-362-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/4516-364-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/4516-374-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB