Analysis
-
max time kernel
131s -
max time network
142s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
23-09-2022 06:56
Static task
static1
General
-
Target
e53e578bc6ff61d0c2e37d80faef870679e95d6c7b7fe9dfda5f8fec1d139873.exe
-
Size
375KB
-
MD5
f8820219618f07b59345897fed776e9c
-
SHA1
f7b9564f71d0e6ced133cc7ac188fcf6c6030a5e
-
SHA256
e53e578bc6ff61d0c2e37d80faef870679e95d6c7b7fe9dfda5f8fec1d139873
-
SHA512
6a822a331a789e5a1719154a4ed1e5bd917b7c8205d2913e3ab0e173efb4b99a9d186bb1127b816f98cc4f1dbf240207b02c55a3818fcabf239d2081ecdf98f5
-
SSDEEP
6144:0v5zQJVb5p72cHF1ybDFwekh212KhvwIb759QOaBjpaVRPu23E2rJmWjFc94:04VOiF1WD7kE1dTYOi8V5u23zmWFy4
Malware Config
Signatures
-
Gh0st RAT payload 9 IoCs
Processes:
resource yara_rule behavioral1/memory/4192-173-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/4192-175-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/4192-176-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/4192-178-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/4588-259-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/840-303-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/840-304-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/4268-363-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/840-374-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat -
Executes dropped EXE 3 IoCs
Processes:
SQLSerasi.exeSQLSerasi.exeSQLSerasi.exepid process 4588 SQLSerasi.exe 840 SQLSerasi.exe 4268 SQLSerasi.exe -
Processes:
resource yara_rule behavioral1/memory/4192-170-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/4192-173-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/4192-175-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/4192-176-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/4192-178-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/4588-259-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/840-303-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/840-304-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/4268-363-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/840-374-0x0000000010000000-0x0000000010362000-memory.dmp upx -
Drops file in System32 directory 5 IoCs
Processes:
SQLSerasi.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat SQLSerasi.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 SQLSerasi.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE SQLSerasi.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies SQLSerasi.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 SQLSerasi.exe -
Drops file in Program Files directory 2 IoCs
Processes:
e53e578bc6ff61d0c2e37d80faef870679e95d6c7b7fe9dfda5f8fec1d139873.exedescription ioc process File created C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe e53e578bc6ff61d0c2e37d80faef870679e95d6c7b7fe9dfda5f8fec1d139873.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe e53e578bc6ff61d0c2e37d80faef870679e95d6c7b7fe9dfda5f8fec1d139873.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
SQLSerasi.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString SQLSerasi.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 SQLSerasi.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 SQLSerasi.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString SQLSerasi.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 SQLSerasi.exe -
Modifies data under HKEY_USERS 8 IoCs
Processes:
SQLSerasi.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" SQLSerasi.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" SQLSerasi.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ SQLSerasi.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" SQLSerasi.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" SQLSerasi.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" SQLSerasi.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" SQLSerasi.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix SQLSerasi.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
e53e578bc6ff61d0c2e37d80faef870679e95d6c7b7fe9dfda5f8fec1d139873.exeSQLSerasi.exeSQLSerasi.exeSQLSerasi.exedescription pid process Token: SeDebugPrivilege 4192 e53e578bc6ff61d0c2e37d80faef870679e95d6c7b7fe9dfda5f8fec1d139873.exe Token: SeDebugPrivilege 4588 SQLSerasi.exe Token: SeDebugPrivilege 840 SQLSerasi.exe Token: SeDebugPrivilege 840 SQLSerasi.exe Token: SeDebugPrivilege 4268 SQLSerasi.exe Token: SeDebugPrivilege 4268 SQLSerasi.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
e53e578bc6ff61d0c2e37d80faef870679e95d6c7b7fe9dfda5f8fec1d139873.exeSQLSerasi.exedescription pid process target process PID 4192 wrote to memory of 4588 4192 e53e578bc6ff61d0c2e37d80faef870679e95d6c7b7fe9dfda5f8fec1d139873.exe SQLSerasi.exe PID 4192 wrote to memory of 4588 4192 e53e578bc6ff61d0c2e37d80faef870679e95d6c7b7fe9dfda5f8fec1d139873.exe SQLSerasi.exe PID 4192 wrote to memory of 4588 4192 e53e578bc6ff61d0c2e37d80faef870679e95d6c7b7fe9dfda5f8fec1d139873.exe SQLSerasi.exe PID 840 wrote to memory of 4268 840 SQLSerasi.exe SQLSerasi.exe PID 840 wrote to memory of 4268 840 SQLSerasi.exe SQLSerasi.exe PID 840 wrote to memory of 4268 840 SQLSerasi.exe SQLSerasi.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e53e578bc6ff61d0c2e37d80faef870679e95d6c7b7fe9dfda5f8fec1d139873.exe"C:\Users\Admin\AppData\Local\Temp\e53e578bc6ff61d0c2e37d80faef870679e95d6c7b7fe9dfda5f8fec1d139873.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exeFilesize
39.4MB
MD5de864683f8b09fb46808456b0a883af9
SHA169cba448a53ace918b18007092394e30dfeb982c
SHA256bf7a9c172f9157215e9b7e517cc893254ddd3ac0433397f043fa47c8284e8cf2
SHA51298c84205ac9a985dd68a8103459b6ebac31b13b80aa949294b9f2424113c2bc9b03fd8040596e0bb8b0884582af6663e18950246ec35f17e733007e1a9d91985
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exeFilesize
39.4MB
MD5de864683f8b09fb46808456b0a883af9
SHA169cba448a53ace918b18007092394e30dfeb982c
SHA256bf7a9c172f9157215e9b7e517cc893254ddd3ac0433397f043fa47c8284e8cf2
SHA51298c84205ac9a985dd68a8103459b6ebac31b13b80aa949294b9f2424113c2bc9b03fd8040596e0bb8b0884582af6663e18950246ec35f17e733007e1a9d91985
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exeFilesize
39.4MB
MD5de864683f8b09fb46808456b0a883af9
SHA169cba448a53ace918b18007092394e30dfeb982c
SHA256bf7a9c172f9157215e9b7e517cc893254ddd3ac0433397f043fa47c8284e8cf2
SHA51298c84205ac9a985dd68a8103459b6ebac31b13b80aa949294b9f2424113c2bc9b03fd8040596e0bb8b0884582af6663e18950246ec35f17e733007e1a9d91985
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exeFilesize
39.4MB
MD5de864683f8b09fb46808456b0a883af9
SHA169cba448a53ace918b18007092394e30dfeb982c
SHA256bf7a9c172f9157215e9b7e517cc893254ddd3ac0433397f043fa47c8284e8cf2
SHA51298c84205ac9a985dd68a8103459b6ebac31b13b80aa949294b9f2424113c2bc9b03fd8040596e0bb8b0884582af6663e18950246ec35f17e733007e1a9d91985
-
memory/840-303-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/840-304-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/840-374-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/840-373-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/4192-155-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/4192-164-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/4192-125-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/4192-126-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/4192-127-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/4192-159-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/4192-129-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/4192-130-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/4192-131-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/4192-132-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/4192-134-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/4192-133-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/4192-135-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/4192-136-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/4192-137-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/4192-138-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/4192-139-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/4192-140-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/4192-141-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/4192-142-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/4192-143-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/4192-144-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/4192-145-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/4192-146-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/4192-147-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/4192-148-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/4192-149-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/4192-150-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/4192-151-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/4192-152-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/4192-153-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/4192-154-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/4192-121-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/4192-156-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/4192-157-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/4192-158-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/4192-128-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/4192-120-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/4192-124-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/4192-162-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/4192-163-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/4192-161-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/4192-165-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/4192-166-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/4192-167-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/4192-168-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/4192-169-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/4192-170-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/4192-173-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/4192-174-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/4192-175-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/4192-176-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/4192-177-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/4192-178-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/4192-179-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/4192-180-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/4192-181-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/4192-182-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/4192-183-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/4192-184-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/4192-185-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/4192-186-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/4192-189-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/4192-195-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/4192-122-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/4192-160-0x0000000077330000-0x00000000774BE000-memory.dmpFilesize
1.6MB
-
memory/4192-123-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/4268-307-0x0000000000000000-mapping.dmp
-
memory/4268-363-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/4268-375-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/4588-306-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/4588-259-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/4588-190-0x0000000000000000-mapping.dmp