a62827d89a7c64c0a93f419fc55a00f70c95759bbf39edeb9a5e7ab60b524914

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
11/05/2022, 09:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Trojan.Ciusky.Gen.6.28782.exe
Size 1.6MB
Sample220511-ltxqgagce5
SHA256 a62827d89a7c64c0a93f419fc55a00f70c95759bbf39edeb9a5e7ab60b524914
MD5 0103d36de2702e7249ee2bf5a7e3bd52
SHA1 1b5e3d19495e46ae92169398d01176cd3b59b894
SHA512 c503776c1c4f56fbfcb8ce756c9a7cea006ccf0edb59c153bfcf8f954a332cf4beaf54fab540b268fed9b433f12b6e060beb575492acf303282a5c3738a954d3
MD5 SHA1 SHA512

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	SecuriteInfo.com.Trojan.Ciusky.Gen.6.28782.exe

Loads dropped DLL 4 IoCs

pid	Process
3380	rundll32.exe
3380	rundll32.exe
408	rundll32.exe
408	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3520 wrote to memory of 4256	3520	SecuriteInfo.com.Trojan.Ciusky.Gen.6.28782.exe	81
PID 3520 wrote to memory of 4256	3520	SecuriteInfo.com.Trojan.Ciusky.Gen.6.28782.exe	81
PID 3520 wrote to memory of 4256	3520	SecuriteInfo.com.Trojan.Ciusky.Gen.6.28782.exe	81
PID 4256 wrote to memory of 3380	4256	control.exe	82
PID 4256 wrote to memory of 3380	4256	control.exe	82
PID 4256 wrote to memory of 3380	4256	control.exe	82
PID 3380 wrote to memory of 8	3380	rundll32.exe	83
PID 3380 wrote to memory of 8	3380	rundll32.exe	83
PID 8 wrote to memory of 408	8	RunDll32.exe	84
PID 8 wrote to memory of 408	8	RunDll32.exe	84
PID 8 wrote to memory of 408	8	RunDll32.exe	84

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Ciusky.Gen.6.28782.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Ciusky.Gen.6.28782.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3520
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe" .\dGUFM4u.K3
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4256
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\dGUFM4u.K3
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:3380
  - - C:\Windows\system32\RunDll32.exe
      C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\dGUFM4u.K3
      4⤵
      Suspicious use of WriteProcessMemory
      PID:8
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\dGUFM4u.K3
        5⤵
        Loads dropped DLL
        
        PID:408

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dGUFM4u.K3

Path C:\Users\Admin\AppData\Local\Temp\dGUFM4u.K3
Size 184.6MB
SHA256 d5f4a900010b82d926549dd32f300925e167e3db933b4016b1f759bc679a6ccf
MD5 d0c0643ff0073d4e522ffc6ac0b02b73
SHA1 14d67cf937c7665353aa417fdcbf05dbc821ee73
SHA512 3203f1dfc06e8938cfa81001846ba7bcf3427547bf1b4d2148b4f334456b1e8e212c0d38578e8973db3c5cd92f46eacd7e02907d44a0b509caa1ebfa00b3487a
SSDEEP 24576:D4j7SgeblcKavhivBfRaSPwo7S09m1pL9ivW8ALlOLS/OjhDkUQOYP4:8kz3RxbMAWTEnhDTQFP4
MD5 SHA1 SHA512 SSDEEP

Submit Download

dGuFM4u.k3

Path C:\Users\Admin\AppData\Local\Temp\dGuFM4u.k3
Size 151.1MB
SHA256 d902d41b2fd3d28b21fb46c4d5266a70df06613a1eff36bd664821f198f11763
MD5 ab8ea8cb84a36a757e66f2962ddc67c0
SHA1 a66cf7348856146c00b17b4387b95a528a1d82b7
SHA512 2f778eb0bee0de60d974bfedb2c1d1c706d19c38f24a7ef19e1e40b86fc9923137bd2f27171829d980ae3e657191714c65b06dc36af38a44dfec3d12fed4cdc8
SSDEEP 24576:D4j7SgeblcKavhivBfRaSPwo7S09m1pL9ivW8ALlOLS/OjhDkUQOYP4:8kz3RxbMAWTEnhDTQFP4
MD5 SHA1 SHA512 SSDEEP

Submit Download

dGuFM4u.k3

Path C:\Users\Admin\AppData\Local\Temp\dGuFM4u.k3
Size 150.1MB
SHA256 aad76bec824e344d88adbc29dfc9ff65f0f38eb066604cdc2f7f2a03cf2ffc75
MD5 52d9c0cfa4c22dc2dd728807770d3eea
SHA1 ec2d8ea1045f4525069e28f17cb4e83628771d09
SHA512 6d5684917ca5aee8aac0988b2b732898d0b580a71e0fc4c2b27771f092d1babb4ed60e0019997c847d5bde8c0153e0004596523fc9d5a2254ff6718e95c73342
SSDEEP 24576:D4j7SgeblcKavhivBfRaSPwo7S09m1pL9ivW8ALlOLS/OjhDkUQOYP4:8kz3RxbMAWTEnhDTQFP4
MD5 SHA1 SHA512 SSDEEP

Submit Download

dGuFM4u.k3

Path C:\Users\Admin\AppData\Local\Temp\dGuFM4u.k3
Size 133.2MB
SHA256 376c3a6f7e5de6b9cfa3e808dace9bdbad90c578cb03d1cec7ef55be695f04cb
MD5 b396b4da5067a157598523c32429c5bf
SHA1 0d423725d45b9a35bc20d5f65e5ac3bca4ea7cfe
SHA512 b78d2fc7d6bb455790a2e9502bafb7afef7966b5063375b72d35201d64afdddc1ddfec5f02fa387ca7ce292740abbc57e28a05fe60419c1f2c54c98d8e12ca35
SSDEEP 24576:D4j7SgeblcKavhivBfRaSPwo7S09m1pL9ivW8ALlOLS/OjhDkUQOYP4:8kz3RxbMAWTEnhDTQFP4
MD5 SHA1 SHA512 SSDEEP

Submit Download

dGuFM4u.k3

Path C:\Users\Admin\AppData\Local\Temp\dGuFM4u.k3
Size 136.2MB
SHA256 1b0d5216e9d2dee692e542bbfa1daf335f74fd866d4424730e4ff9bf5b71f0a7
MD5 67340f90d3cd73d40ef9fa095b182300
SHA1 c262990724090b02979662fd491a90253f4470bd
SHA512 3cfc3d8db24f8c8c4f959cfdda7e905800ed16808b104069c19b41fa0ad2a210c0f03bf003b9b26d4704cf0ca787921a8ea59ad54f36c27407f3f294601a4735
SSDEEP 24576:D4j7SgeblcKavhivBfRaSPwo7S09m1pL9ivW8ALlOLS/OjhDkUQOYP4:8kz3RxbMAWTEnhDTQFP4
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/408-151-0x000000002D890000-0x000000002D930000-memory.dmp

Download

memory/408-149-0x000000002D7D0000-0x000000002D884000-memory.dmp

Download

memory/408-148-0x000000002D710000-0x000000002D7CA000-memory.dmp

Download

memory/408-147-0x000000002D590000-0x000000002D64E000-memory.dmp

Download

memory/408-146-0x00000000029F0000-0x00000000039F0000-memory.dmp

Download

memory/3380-135-0x0000000002D70000-0x0000000003D70000-memory.dmp

Download

memory/3380-140-0x000000002DCA0000-0x000000002DD40000-memory.dmp

Download

memory/3380-139-0x000000002DCA0000-0x000000002DD40000-memory.dmp

Download

memory/3380-138-0x000000002DBE0000-0x000000002DC94000-memory.dmp

Download

memory/3380-136-0x000000002D9A0000-0x000000002DA5E000-memory.dmp

Download

memory/3380-137-0x000000002DB20000-0x000000002DBDA000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads