5a4b198bddcbee5cf85859e81f6527a59019dc2203298cf4c22bf2a95b2c0ceb

General

Target

4529e8edd84ef2a53a9cbbde19ed72d2.exe
Size

88KB
MD5

4529e8edd84ef2a53a9cbbde19ed72d2
SHA1

d56b27003a3e2f0042a310581855b501897a66c0
SHA256

5a4b198bddcbee5cf85859e81f6527a59019dc2203298cf4c22bf2a95b2c0ceb
SHA512

8a877b45848a874034598322087b31768661db96cc6bd0b6149a0c7e2636ac91cedb61d15021360f105eaa06e06d726481af543f8d779eb7f65ffbd6a23fdd11
SSDEEP

768:qWb6o5VnURLQ/JD60XDeVtA5YxmHwWW2iYf/ce2NZQcy8+gxdCwaTDNmDIBT/kbQ:q4VIQ/JDHKa5LJW6/Z2NZQKvdmNmS/

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	4529e8edd84ef2a53a9cbbde19ed72d2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	kiourug.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	4529e8edd84ef2a53a9cbbde19ed72d2.exe

Executes dropped EXE 1 IoCs

pid	Process
2956	kiourug.exe

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiourug = "C:\\Users\\Admin\\kiourug.exe /s"	kiourug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiourug = "C:\\Users\\Admin\\kiourug.exe /a"	kiourug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiourug = "C:\\Users\\Admin\\kiourug.exe /b"	kiourug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiourug = "C:\\Users\\Admin\\kiourug.exe /s"	4529e8edd84ef2a53a9cbbde19ed72d2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiourug = "C:\\Users\\Admin\\kiourug.exe /h"	kiourug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiourug = "C:\\Users\\Admin\\kiourug.exe /g"	kiourug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiourug = "C:\\Users\\Admin\\kiourug.exe /c"	kiourug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiourug = "C:\\Users\\Admin\\kiourug.exe /z"	kiourug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kiourug = "C:\\Users\\Admin\\kiourug.exe /u"	kiourug.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
456	4529e8edd84ef2a53a9cbbde19ed72d2.exe
456	4529e8edd84ef2a53a9cbbde19ed72d2.exe
2956	kiourug.exe
2956	kiourug.exe
2956	kiourug.exe
2956	kiourug.exe
2956	kiourug.exe
2956	kiourug.exe
2956	kiourug.exe
2956	kiourug.exe
2956	kiourug.exe
2956	kiourug.exe
2956	kiourug.exe
2956	kiourug.exe
2956	kiourug.exe
2956	kiourug.exe
2956	kiourug.exe
2956	kiourug.exe
2956	kiourug.exe
2956	kiourug.exe
2956	kiourug.exe
2956	kiourug.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
456	4529e8edd84ef2a53a9cbbde19ed72d2.exe
2956	kiourug.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 456 wrote to memory of 2956	456	4529e8edd84ef2a53a9cbbde19ed72d2.exe	90
PID 456 wrote to memory of 2956	456	4529e8edd84ef2a53a9cbbde19ed72d2.exe	90
PID 456 wrote to memory of 2956	456	4529e8edd84ef2a53a9cbbde19ed72d2.exe	90

C:\Users\Admin\AppData\Local\Temp\4529e8edd84ef2a53a9cbbde19ed72d2.exe
"C:\Users\Admin\AppData\Local\Temp\4529e8edd84ef2a53a9cbbde19ed72d2.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:456
- C:\Users\Admin\kiourug.exe
  "C:\Users\Admin\kiourug.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\kiourug.exe

Filesize
5KB

MD5
1a47767a79cfb879e9ae7ade24b387e3

SHA1
00fa3d2839b98fbdcf89b2b71ec89b4f7e656dc3

SHA256
8f5ecadb42fbb9ca9b88c449b2559868cf1deedcc9df4bf46b07d326187d76aa

SHA512
471416a6d64ef2f5647172b4fca13bd72c4002fe581f616b0d89154fab882cf21be5639f90a59600d339664451644142243d71986169ea412654e672d91ebb9a

Download Submit
C:\Users\Admin\kiourug.exe

Filesize
33KB

MD5
01c837d2d32b2f6dc4009c75bbc44e1e

SHA1
df719382e25c2bcba3781a4a8d723dc89840a380

SHA256
55f83fc4fd193560d6f8cf442ef6681e52592cd5802d461ea9f7151a59e49e1a

SHA512
591f5f7b4aa03960519c40e29ba82bf86a1cc642c08064e8a03ce8da982aa8f693b56e39efecc0a1eaeae28b708285a5bd41f5c8e7d524be96a2669da7f3364e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads