a4428ea2a84c197502595fa85062995ea128355f66d695b76c8911bd6c519bef

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
18/07/2023, 17:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Trojan.Ciusky.Gen.6.21004.15926.exe
Size

1.6MB
MD5

cec434e1b94beae9dbbf0eb371e78f4a
SHA1

e318e77b036852ef9f4780b07e33e075635b93a5
SHA256

a4428ea2a84c197502595fa85062995ea128355f66d695b76c8911bd6c519bef
SHA512

d3e4a9c0e529ab48893d877b19d9a3c6b59bb5b68c1cb2063a510632fc1895ce1e7a0f0c33737361de6de0adea611b000496c3328034d942cae948ead5f8981d
SSDEEP

24576:WiIy60hvWIUiQjUo7zRb+YSqs18b6H9vOWQx1WvxE1ENo0fbSSvC4PnUue6VIsma:mb1x459mWwwvxEKoyvCWUuexH7PCWc

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 8 IoCs

pid	Process
3020	rundll32.exe
3020	rundll32.exe
3020	rundll32.exe
3020	rundll32.exe
2972	rundll32.exe
2972	rundll32.exe
2972	rundll32.exe
2972	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 2788	2120	SecuriteInfo.com.Trojan.Ciusky.Gen.6.21004.15926.exe	28
PID 2120 wrote to memory of 2788	2120	SecuriteInfo.com.Trojan.Ciusky.Gen.6.21004.15926.exe	28
PID 2120 wrote to memory of 2788	2120	SecuriteInfo.com.Trojan.Ciusky.Gen.6.21004.15926.exe	28
PID 2120 wrote to memory of 2788	2120	SecuriteInfo.com.Trojan.Ciusky.Gen.6.21004.15926.exe	28
PID 2788 wrote to memory of 3020	2788	control.exe	29
PID 2788 wrote to memory of 3020	2788	control.exe	29
PID 2788 wrote to memory of 3020	2788	control.exe	29
PID 2788 wrote to memory of 3020	2788	control.exe	29
PID 2788 wrote to memory of 3020	2788	control.exe	29
PID 2788 wrote to memory of 3020	2788	control.exe	29
PID 2788 wrote to memory of 3020	2788	control.exe	29
PID 3020 wrote to memory of 1232	3020	rundll32.exe	32
PID 3020 wrote to memory of 1232	3020	rundll32.exe	32
PID 3020 wrote to memory of 1232	3020	rundll32.exe	32
PID 3020 wrote to memory of 1232	3020	rundll32.exe	32
PID 1232 wrote to memory of 2972	1232	RunDll32.exe	33
PID 1232 wrote to memory of 2972	1232	RunDll32.exe	33
PID 1232 wrote to memory of 2972	1232	RunDll32.exe	33
PID 1232 wrote to memory of 2972	1232	RunDll32.exe	33
PID 1232 wrote to memory of 2972	1232	RunDll32.exe	33
PID 1232 wrote to memory of 2972	1232	RunDll32.exe	33
PID 1232 wrote to memory of 2972	1232	RunDll32.exe	33

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Ciusky.Gen.6.21004.15926.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Ciusky.Gen.6.21004.15926.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe" .\ZnTnW.Q
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\ZnTnW.Q
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:3020
  - - C:\Windows\system32\RunDll32.exe
      C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\ZnTnW.Q
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1232
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\ZnTnW.Q
        5⤵
        Loads dropped DLL
        
        PID:2972

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ZnTnW.Q

Filesize
1.3MB

MD5
a2d54abd5565daf655b3773da2aca9db

SHA1
9b3e5d463633e2b8b9c0bedc08896bed4c373d11

SHA256
af25f5a722a77976eab1c573bf9b3ca15718d9a88690bcd874771c233089fe34

SHA512
0526684719688e210d46e6b9236b0bdae0d3189f8d06435c1cd5b99c2554d542bbb8d95f2d6ab49cb325c3f35422821946a668017c09d330320ed1e365e7d8f8

Download Submit
\Users\Admin\AppData\Local\Temp\ZnTnW.Q

Filesize
1.3MB

MD5
a2d54abd5565daf655b3773da2aca9db

SHA1
9b3e5d463633e2b8b9c0bedc08896bed4c373d11

SHA256
af25f5a722a77976eab1c573bf9b3ca15718d9a88690bcd874771c233089fe34

SHA512
0526684719688e210d46e6b9236b0bdae0d3189f8d06435c1cd5b99c2554d542bbb8d95f2d6ab49cb325c3f35422821946a668017c09d330320ed1e365e7d8f8

Download Submit
\Users\Admin\AppData\Local\Temp\ZnTnW.Q

Filesize
1.3MB

MD5
a2d54abd5565daf655b3773da2aca9db

SHA1
9b3e5d463633e2b8b9c0bedc08896bed4c373d11

SHA256
af25f5a722a77976eab1c573bf9b3ca15718d9a88690bcd874771c233089fe34

SHA512
0526684719688e210d46e6b9236b0bdae0d3189f8d06435c1cd5b99c2554d542bbb8d95f2d6ab49cb325c3f35422821946a668017c09d330320ed1e365e7d8f8

Download Submit
\Users\Admin\AppData\Local\Temp\ZnTnW.Q

Filesize
1.3MB

MD5
a2d54abd5565daf655b3773da2aca9db

SHA1
9b3e5d463633e2b8b9c0bedc08896bed4c373d11

SHA256
af25f5a722a77976eab1c573bf9b3ca15718d9a88690bcd874771c233089fe34

SHA512
0526684719688e210d46e6b9236b0bdae0d3189f8d06435c1cd5b99c2554d542bbb8d95f2d6ab49cb325c3f35422821946a668017c09d330320ed1e365e7d8f8

Download Submit
\Users\Admin\AppData\Local\Temp\ZnTnW.Q

Filesize
1.3MB

MD5
a2d54abd5565daf655b3773da2aca9db

SHA1
9b3e5d463633e2b8b9c0bedc08896bed4c373d11

SHA256
af25f5a722a77976eab1c573bf9b3ca15718d9a88690bcd874771c233089fe34

SHA512
0526684719688e210d46e6b9236b0bdae0d3189f8d06435c1cd5b99c2554d542bbb8d95f2d6ab49cb325c3f35422821946a668017c09d330320ed1e365e7d8f8

Download Submit
\Users\Admin\AppData\Local\Temp\ZnTnW.Q

Filesize
1.3MB

MD5
a2d54abd5565daf655b3773da2aca9db

SHA1
9b3e5d463633e2b8b9c0bedc08896bed4c373d11

SHA256
af25f5a722a77976eab1c573bf9b3ca15718d9a88690bcd874771c233089fe34

SHA512
0526684719688e210d46e6b9236b0bdae0d3189f8d06435c1cd5b99c2554d542bbb8d95f2d6ab49cb325c3f35422821946a668017c09d330320ed1e365e7d8f8

Download Submit
\Users\Admin\AppData\Local\Temp\ZnTnW.Q

Filesize
1.3MB

MD5
a2d54abd5565daf655b3773da2aca9db

SHA1
9b3e5d463633e2b8b9c0bedc08896bed4c373d11

SHA256
af25f5a722a77976eab1c573bf9b3ca15718d9a88690bcd874771c233089fe34

SHA512
0526684719688e210d46e6b9236b0bdae0d3189f8d06435c1cd5b99c2554d542bbb8d95f2d6ab49cb325c3f35422821946a668017c09d330320ed1e365e7d8f8

Download Submit
\Users\Admin\AppData\Local\Temp\ZnTnW.Q

Filesize
1.3MB

MD5
a2d54abd5565daf655b3773da2aca9db

SHA1
9b3e5d463633e2b8b9c0bedc08896bed4c373d11

SHA256
af25f5a722a77976eab1c573bf9b3ca15718d9a88690bcd874771c233089fe34

SHA512
0526684719688e210d46e6b9236b0bdae0d3189f8d06435c1cd5b99c2554d542bbb8d95f2d6ab49cb325c3f35422821946a668017c09d330320ed1e365e7d8f8

Download Submit
\Users\Admin\AppData\Local\Temp\ZnTnW.Q

Filesize
1.3MB

MD5
a2d54abd5565daf655b3773da2aca9db

SHA1
9b3e5d463633e2b8b9c0bedc08896bed4c373d11

SHA256
af25f5a722a77976eab1c573bf9b3ca15718d9a88690bcd874771c233089fe34

SHA512
0526684719688e210d46e6b9236b0bdae0d3189f8d06435c1cd5b99c2554d542bbb8d95f2d6ab49cb325c3f35422821946a668017c09d330320ed1e365e7d8f8

Download Submit
memory/2972-78-0x0000000000150000-0x0000000000156000-memory.dmp

Filesize
24KB

Download
memory/2972-83-0x00000000028E0000-0x00000000029F6000-memory.dmp

Filesize
1.1MB

Download
memory/2972-89-0x0000000002540000-0x000000000263B000-memory.dmp

Filesize
1004KB

Download
memory/2972-88-0x0000000002540000-0x000000000263B000-memory.dmp

Filesize
1004KB

Download
memory/2972-77-0x0000000001F70000-0x00000000020B3000-memory.dmp

Filesize
1.3MB

Download
memory/2972-85-0x0000000002540000-0x000000000263B000-memory.dmp

Filesize
1004KB

Download
memory/2972-84-0x0000000001F70000-0x00000000020B3000-memory.dmp

Filesize
1.3MB

Download
memory/2972-79-0x0000000001F70000-0x00000000020B3000-memory.dmp

Filesize
1.3MB

Download
memory/3020-62-0x0000000000950000-0x0000000000A93000-memory.dmp

Filesize
1.3MB

Download
memory/3020-61-0x0000000000950000-0x0000000000A93000-memory.dmp

Filesize
1.3MB

Download
memory/3020-71-0x00000000026C0000-0x00000000027BB000-memory.dmp

Filesize
1004KB

Download
memory/3020-64-0x00000000001E0000-0x00000000001E6000-memory.dmp

Filesize
24KB

Download
memory/3020-67-0x00000000025A0000-0x00000000026B6000-memory.dmp

Filesize
1.1MB

Download
memory/3020-68-0x00000000026C0000-0x00000000027BB000-memory.dmp

Filesize
1004KB

Download
memory/3020-72-0x00000000026C0000-0x00000000027BB000-memory.dmp

Filesize
1004KB

Download