Analysis
-
max time kernel
133s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-09-2022 06:57
Static task
static1
General
-
Target
4372b8241526c35a4bb63cc5a5d653bd3689728cf73bb8d4a93d822d8145cb56.exe
-
Size
375KB
-
MD5
660ae7068b4c00acffbc7c467a6a4726
-
SHA1
8a2d8dab6a1dec8a55ce0b700f728fbc0b5008a9
-
SHA256
4372b8241526c35a4bb63cc5a5d653bd3689728cf73bb8d4a93d822d8145cb56
-
SHA512
a3f03c3b19289f7a8846585dc9ceec594a6713680ffb975fad12cef77e7181ed539ae2055936fd45ada4e11916f0271f6d56d6015ded70052d005bca4844e1f9
-
SSDEEP
6144:9v5zQJVb5p72cHF1ybDFwekh212KhvwIb759QOaBjpaVRPu23E2rJmWjFc94:94VOiF1WD7kE1dTYOi8V5u23zmWFy4
Malware Config
Signatures
-
Gh0st RAT payload 9 IoCs
Processes:
resource yara_rule behavioral1/memory/3836-136-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/3836-137-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/3836-138-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/3136-152-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/3136-153-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/2688-154-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/3136-157-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/3136-173-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat behavioral1/memory/4644-176-0x0000000010000000-0x0000000010362000-memory.dmp family_gh0strat -
Executes dropped EXE 4 IoCs
Processes:
SQLSerasi.exeSQLSerasi.exeSQLSerasi.exeSQLSerasi.exepid process 2688 SQLSerasi.exe 3136 SQLSerasi.exe 4644 SQLSerasi.exe 4704 SQLSerasi.exe -
Processes:
resource yara_rule behavioral1/memory/3836-133-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/3836-136-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/3836-137-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/3836-138-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/3136-149-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/3136-152-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/3136-153-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/2688-154-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/3136-157-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/3136-173-0x0000000010000000-0x0000000010362000-memory.dmp upx behavioral1/memory/4644-176-0x0000000010000000-0x0000000010362000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
4372b8241526c35a4bb63cc5a5d653bd3689728cf73bb8d4a93d822d8145cb56.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 4372b8241526c35a4bb63cc5a5d653bd3689728cf73bb8d4a93d822d8145cb56.exe -
Drops file in System32 directory 4 IoCs
Processes:
SQLSerasi.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 SQLSerasi.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 SQLSerasi.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE SQLSerasi.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies SQLSerasi.exe -
Drops file in Program Files directory 2 IoCs
Processes:
4372b8241526c35a4bb63cc5a5d653bd3689728cf73bb8d4a93d822d8145cb56.exedescription ioc process File created C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe 4372b8241526c35a4bb63cc5a5d653bd3689728cf73bb8d4a93d822d8145cb56.exe File opened for modification C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe 4372b8241526c35a4bb63cc5a5d653bd3689728cf73bb8d4a93d822d8145cb56.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 732 3136 WerFault.exe SQLSerasi.exe -
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
SQLSerasi.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 SQLSerasi.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString SQLSerasi.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 SQLSerasi.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 SQLSerasi.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString SQLSerasi.exe -
Modifies data under HKEY_USERS 8 IoCs
Processes:
SQLSerasi.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ SQLSerasi.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" SQLSerasi.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" SQLSerasi.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" SQLSerasi.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" SQLSerasi.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix SQLSerasi.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" SQLSerasi.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" SQLSerasi.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
4372b8241526c35a4bb63cc5a5d653bd3689728cf73bb8d4a93d822d8145cb56.exeSQLSerasi.exeSQLSerasi.exeSQLSerasi.exeSQLSerasi.exedescription pid process Token: SeDebugPrivilege 3836 4372b8241526c35a4bb63cc5a5d653bd3689728cf73bb8d4a93d822d8145cb56.exe Token: SeDebugPrivilege 2688 SQLSerasi.exe Token: SeDebugPrivilege 3136 SQLSerasi.exe Token: SeDebugPrivilege 3136 SQLSerasi.exe Token: SeDebugPrivilege 3136 SQLSerasi.exe Token: SeDebugPrivilege 4644 SQLSerasi.exe Token: SeDebugPrivilege 4704 SQLSerasi.exe Token: SeDebugPrivilege 4644 SQLSerasi.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
4372b8241526c35a4bb63cc5a5d653bd3689728cf73bb8d4a93d822d8145cb56.exeSQLSerasi.exedescription pid process target process PID 3836 wrote to memory of 2688 3836 4372b8241526c35a4bb63cc5a5d653bd3689728cf73bb8d4a93d822d8145cb56.exe SQLSerasi.exe PID 3836 wrote to memory of 2688 3836 4372b8241526c35a4bb63cc5a5d653bd3689728cf73bb8d4a93d822d8145cb56.exe SQLSerasi.exe PID 3836 wrote to memory of 2688 3836 4372b8241526c35a4bb63cc5a5d653bd3689728cf73bb8d4a93d822d8145cb56.exe SQLSerasi.exe PID 3136 wrote to memory of 4644 3136 SQLSerasi.exe SQLSerasi.exe PID 3136 wrote to memory of 4644 3136 SQLSerasi.exe SQLSerasi.exe PID 3136 wrote to memory of 4644 3136 SQLSerasi.exe SQLSerasi.exe PID 3136 wrote to memory of 4704 3136 SQLSerasi.exe SQLSerasi.exe PID 3136 wrote to memory of 4704 3136 SQLSerasi.exe SQLSerasi.exe PID 3136 wrote to memory of 4704 3136 SQLSerasi.exe SQLSerasi.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4372b8241526c35a4bb63cc5a5d653bd3689728cf73bb8d4a93d822d8145cb56.exe"C:\Users\Admin\AppData\Local\Temp\4372b8241526c35a4bb63cc5a5d653bd3689728cf73bb8d4a93d822d8145cb56.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3136 -s 5762⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3136 -ip 31361⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exeFilesize
39.4MB
MD51f2cab2ea25daea5409304d0e2bf126f
SHA1834247b83b99f40778e78f59f5474d82147db57a
SHA256e34ecdc029ca36dea25d4ee30c87036cdf1e67c114c5fd8a7d2a861dfbd75abc
SHA512c9fcca73bcae5877301ae389c0c127a8aee42964b67300d9283bc7fb8c048adcf2d61e0fed7b5c76feffcbf765eef94711b9758b4556e2e0f46b5694dba00fe6
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exeFilesize
39.4MB
MD51f2cab2ea25daea5409304d0e2bf126f
SHA1834247b83b99f40778e78f59f5474d82147db57a
SHA256e34ecdc029ca36dea25d4ee30c87036cdf1e67c114c5fd8a7d2a861dfbd75abc
SHA512c9fcca73bcae5877301ae389c0c127a8aee42964b67300d9283bc7fb8c048adcf2d61e0fed7b5c76feffcbf765eef94711b9758b4556e2e0f46b5694dba00fe6
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exeFilesize
39.4MB
MD51f2cab2ea25daea5409304d0e2bf126f
SHA1834247b83b99f40778e78f59f5474d82147db57a
SHA256e34ecdc029ca36dea25d4ee30c87036cdf1e67c114c5fd8a7d2a861dfbd75abc
SHA512c9fcca73bcae5877301ae389c0c127a8aee42964b67300d9283bc7fb8c048adcf2d61e0fed7b5c76feffcbf765eef94711b9758b4556e2e0f46b5694dba00fe6
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exeFilesize
39.4MB
MD51f2cab2ea25daea5409304d0e2bf126f
SHA1834247b83b99f40778e78f59f5474d82147db57a
SHA256e34ecdc029ca36dea25d4ee30c87036cdf1e67c114c5fd8a7d2a861dfbd75abc
SHA512c9fcca73bcae5877301ae389c0c127a8aee42964b67300d9283bc7fb8c048adcf2d61e0fed7b5c76feffcbf765eef94711b9758b4556e2e0f46b5694dba00fe6
-
C:\Program Files (x86)\Microsoft SQL Server\SQLSerasi.exeFilesize
39.4MB
MD51f2cab2ea25daea5409304d0e2bf126f
SHA1834247b83b99f40778e78f59f5474d82147db57a
SHA256e34ecdc029ca36dea25d4ee30c87036cdf1e67c114c5fd8a7d2a861dfbd75abc
SHA512c9fcca73bcae5877301ae389c0c127a8aee42964b67300d9283bc7fb8c048adcf2d61e0fed7b5c76feffcbf765eef94711b9758b4556e2e0f46b5694dba00fe6
-
memory/2688-158-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/2688-156-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/2688-139-0x0000000000000000-mapping.dmp
-
memory/2688-154-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/3136-153-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/3136-152-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/3136-155-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/3136-157-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/3136-149-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/3136-173-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/3836-133-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/3836-132-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/3836-143-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/3836-138-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/3836-137-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/3836-136-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/4644-159-0x0000000000000000-mapping.dmp
-
memory/4644-174-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/4644-176-0x0000000010000000-0x0000000010362000-memory.dmpFilesize
3.4MB
-
memory/4704-175-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/4704-162-0x0000000000000000-mapping.dmp
-
memory/4704-177-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB