Analysis
-
max time kernel
146s -
max time network
146s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
23-09-2022 06:09
Static task
static1
General
-
Target
8f075935d72b44a2c4a590373dd44973a019dab1dfbfdb7ef6b1fe7acbe78076.exe
-
Size
375KB
-
MD5
5b125a07f2ac23caeca1fe68f921d0ea
-
SHA1
3df13ce0a388cfaaeb88be51c637049ffe366ef3
-
SHA256
8f075935d72b44a2c4a590373dd44973a019dab1dfbfdb7ef6b1fe7acbe78076
-
SHA512
c94d3093f7c6f92dfd6e10af6f4ef1f78bf71b645a589896398fe9a3164231105ebcaaf50e0e9920fcce6689116b8418ab7319edbf03088ae5482b4946d6726f
-
SSDEEP
6144:cv5zQJVb5p72cHF1ybDFwekh212KhvwIb759QOaBjpaVRPu23E2rJmWjFc94:c4VOiF1WD7kE1dTYOi8V5u23zmWFy4
Malware Config
Signatures
-
Gh0st RAT payload 7 IoCs
Processes:
resource yara_rule behavioral1/memory/2060-174-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/2060-173-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/2060-176-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/4684-263-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/2800-300-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/4912-359-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/2800-370-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat -
Executes dropped EXE 3 IoCs
Processes:
SQLSerasi.exeSQLSerasi.exeSQLSerasi.exepid process 4684 SQLSerasi.exe 2800 SQLSerasi.exe 4912 SQLSerasi.exe -
Processes:
resource yara_rule behavioral1/memory/2060-169-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/2060-174-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/2060-173-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/2060-176-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/4684-263-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/2800-300-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/4912-359-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/2800-370-0x0000000010000000-0x0000000010362000-memory.dmp upx -
Drops file in System32 directory 5 IoCs
Processes:
SQLSerasi.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat SQLSerasi.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 SQLSerasi.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE SQLSerasi.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies SQLSerasi.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 SQLSerasi.exe -
Drops file in Program Files directory 2 IoCs
Processes:
8f075935d72b44a2c4a590373dd44973a019dab1dfbfdb7ef6b1fe7acbe78076.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe 8f075935d72b44a2c4a590373dd44973a019dab1dfbfdb7ef6b1fe7acbe78076.exe File created C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe 8f075935d72b44a2c4a590373dd44973a019dab1dfbfdb7ef6b1fe7acbe78076.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
SQLSerasi.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 SQLSerasi.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 SQLSerasi.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString SQLSerasi.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 SQLSerasi.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString SQLSerasi.exe -
Modifies data under HKEY_USERS 8 IoCs
Processes:
SQLSerasi.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ SQLSerasi.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" SQLSerasi.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" SQLSerasi.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" SQLSerasi.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" SQLSerasi.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix SQLSerasi.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" SQLSerasi.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" SQLSerasi.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
8f075935d72b44a2c4a590373dd44973a019dab1dfbfdb7ef6b1fe7acbe78076.exeSQLSerasi.exeSQLSerasi.exeSQLSerasi.exedescription pid process Token: SeDebugPrivilege 2060 8f075935d72b44a2c4a590373dd44973a019dab1dfbfdb7ef6b1fe7acbe78076.exe Token: SeDebugPrivilege 4684 SQLSerasi.exe Token: SeDebugPrivilege 2800 SQLSerasi.exe Token: SeDebugPrivilege 2800 SQLSerasi.exe Token: SeDebugPrivilege 4912 SQLSerasi.exe Token: SeDebugPrivilege 4912 SQLSerasi.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
8f075935d72b44a2c4a590373dd44973a019dab1dfbfdb7ef6b1fe7acbe78076.exeSQLSerasi.exedescription pid process target process PID 2060 wrote to memory of 4684 2060 8f075935d72b44a2c4a590373dd44973a019dab1dfbfdb7ef6b1fe7acbe78076.exe SQLSerasi.exe PID 2060 wrote to memory of 4684 2060 8f075935d72b44a2c4a590373dd44973a019dab1dfbfdb7ef6b1fe7acbe78076.exe SQLSerasi.exe PID 2060 wrote to memory of 4684 2060 8f075935d72b44a2c4a590373dd44973a019dab1dfbfdb7ef6b1fe7acbe78076.exe SQLSerasi.exe PID 2800 wrote to memory of 4912 2800 SQLSerasi.exe SQLSerasi.exe PID 2800 wrote to memory of 4912 2800 SQLSerasi.exe SQLSerasi.exe PID 2800 wrote to memory of 4912 2800 SQLSerasi.exe SQLSerasi.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f075935d72b44a2c4a590373dd44973a019dab1dfbfdb7ef6b1fe7acbe78076.exe"C:\Users\Admin\AppData\Local\Temp\8f075935d72b44a2c4a590373dd44973a019dab1dfbfdb7ef6b1fe7acbe78076.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exeFilesize
39.4MB
MD5d571a747b822a8f92c2b7a82444deac6
SHA1a7500ea1cb8a0a91599126bb90d9644ba0e92148
SHA256a9c16cd3bd8c81b0d0887b4ca5f5d12cf84e176ab2a04259494f68e20aa264af
SHA5121ff565d84e1c535dda22a30b1057b522c13e4c8c91f4369550a9a0d4f5332145ab1df14c6220854c3b8c1c112add3b76de024a45c249730d6e2185e78b2526e5
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exeFilesize
39.4MB
MD5d571a747b822a8f92c2b7a82444deac6
SHA1a7500ea1cb8a0a91599126bb90d9644ba0e92148
SHA256a9c16cd3bd8c81b0d0887b4ca5f5d12cf84e176ab2a04259494f68e20aa264af
SHA5121ff565d84e1c535dda22a30b1057b522c13e4c8c91f4369550a9a0d4f5332145ab1df14c6220854c3b8c1c112add3b76de024a45c249730d6e2185e78b2526e5
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exeFilesize
39.4MB
MD5d571a747b822a8f92c2b7a82444deac6
SHA1a7500ea1cb8a0a91599126bb90d9644ba0e92148
SHA256a9c16cd3bd8c81b0d0887b4ca5f5d12cf84e176ab2a04259494f68e20aa264af
SHA5121ff565d84e1c535dda22a30b1057b522c13e4c8c91f4369550a9a0d4f5332145ab1df14c6220854c3b8c1c112add3b76de024a45c249730d6e2185e78b2526e5
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exeFilesize
39.4MB
MD5d571a747b822a8f92c2b7a82444deac6
SHA1a7500ea1cb8a0a91599126bb90d9644ba0e92148
SHA256a9c16cd3bd8c81b0d0887b4ca5f5d12cf84e176ab2a04259494f68e20aa264af
SHA5121ff565d84e1c535dda22a30b1057b522c13e4c8c91f4369550a9a0d4f5332145ab1df14c6220854c3b8c1c112add3b76de024a45c249730d6e2185e78b2526e5
-
memory/2060-154-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-176-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/2060-122-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-123-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-124-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-125-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-126-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-127-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-128-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-129-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-132-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-130-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-131-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/2060-133-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-134-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-136-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-135-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-138-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-139-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-140-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-141-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-142-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-143-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-144-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-137-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-145-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-147-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-148-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-149-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-146-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-150-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-151-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-152-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-153-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-120-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-155-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-157-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-156-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-121-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-159-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-160-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-161-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-162-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-163-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-164-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-165-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-166-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-167-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-168-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-169-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/2060-172-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-174-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/2060-173-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/2060-175-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-158-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-177-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-178-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-179-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-180-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-181-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-182-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-183-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-184-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2060-190-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/2060-119-0x0000000077480000-0x000000007760E000-memory.dmpFilesize
1.6MB
-
memory/2800-300-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/2800-369-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/2800-370-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/4684-187-0x0000000000000000-mapping.dmp
-
memory/4684-263-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/4684-302-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/4912-303-0x0000000000000000-mapping.dmp
-
memory/4912-359-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/4912-371-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB