36194d07ea9897f2276215a1361291ba8e32843caf3056b4f096c213b1bfadb3

Analysis

max time kernel
53s
max time network
30s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
03/07/2023, 19:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Trojan.Uztuby.4.20085.29220.exe
Size

1.7MB
MD5

af223db55c63038d78116cf8aed34b04
SHA1

3cd541ef16e0089dde1192af7b25398c5334846e
SHA256

36194d07ea9897f2276215a1361291ba8e32843caf3056b4f096c213b1bfadb3
SHA512

8c1469ebe9a5388bb092d1be0f77065f0e82b336012a3b2837f06cb743fc9a04e12e0ae099f1a83d232ada433bf6f7255db29ac6a3d53f6357e108e750955fe5
SSDEEP

24576:F/rPkVdKtQBoZUABKUlY0Q1MhhvjdVmOFMZUdNoEiaWpI83X6pxxAcyh/GqIUbcE:Paqbov0Qk1R6qzl526Txo/GqIUDjQa

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 8 IoCs

pid	Process
3012	rundll32.exe
3012	rundll32.exe
3012	rundll32.exe
3012	rundll32.exe
2900	rundll32.exe
2900	rundll32.exe
2900	rundll32.exe
2900	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 2960	2388	SecuriteInfo.com.Trojan.Uztuby.4.20085.29220.exe	28
PID 2388 wrote to memory of 2960	2388	SecuriteInfo.com.Trojan.Uztuby.4.20085.29220.exe	28
PID 2388 wrote to memory of 2960	2388	SecuriteInfo.com.Trojan.Uztuby.4.20085.29220.exe	28
PID 2388 wrote to memory of 2960	2388	SecuriteInfo.com.Trojan.Uztuby.4.20085.29220.exe	28
PID 2960 wrote to memory of 3012	2960	control.exe	29
PID 2960 wrote to memory of 3012	2960	control.exe	29
PID 2960 wrote to memory of 3012	2960	control.exe	29
PID 2960 wrote to memory of 3012	2960	control.exe	29
PID 2960 wrote to memory of 3012	2960	control.exe	29
PID 2960 wrote to memory of 3012	2960	control.exe	29
PID 2960 wrote to memory of 3012	2960	control.exe	29
PID 3012 wrote to memory of 1644	3012	rundll32.exe	30
PID 3012 wrote to memory of 1644	3012	rundll32.exe	30
PID 3012 wrote to memory of 1644	3012	rundll32.exe	30
PID 3012 wrote to memory of 1644	3012	rundll32.exe	30
PID 1644 wrote to memory of 2900	1644	RunDll32.exe	31
PID 1644 wrote to memory of 2900	1644	RunDll32.exe	31
PID 1644 wrote to memory of 2900	1644	RunDll32.exe	31
PID 1644 wrote to memory of 2900	1644	RunDll32.exe	31
PID 1644 wrote to memory of 2900	1644	RunDll32.exe	31
PID 1644 wrote to memory of 2900	1644	RunDll32.exe	31
PID 1644 wrote to memory of 2900	1644	RunDll32.exe	31

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Uztuby.4.20085.29220.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Uztuby.4.20085.29220.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\AkKILS.CPl",
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2960
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\AkKILS.CPl",
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:3012
  - - C:\Windows\system32\RunDll32.exe
      C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\AkKILS.CPl",
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1644
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\AkKILS.CPl",
        5⤵
        Loads dropped DLL
        
        PID:2900

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\AkKILS.CPl

Filesize
1.5MB

MD5
69e6675edc7282c6fadf1eea0d490809

SHA1
78a366f87e2acc5bff639f95423ab87f54c19956

SHA256
813a6391333501d4b941c6118bb3e3127fa6f8c7e51ea65e36aff1be8a3ecf72

SHA512
88a79f35812c7d6de32a5659f5135447ad2e730820b740a3e118cee70a082efba075491f6a31be68f500a0886c50108575a707d93f2cde8e37e3ca4434d4a699

Download Submit
\Users\Admin\AppData\Local\Temp\AkKILS.cpl

Filesize
1.5MB

MD5
69e6675edc7282c6fadf1eea0d490809

SHA1
78a366f87e2acc5bff639f95423ab87f54c19956

SHA256
813a6391333501d4b941c6118bb3e3127fa6f8c7e51ea65e36aff1be8a3ecf72

SHA512
88a79f35812c7d6de32a5659f5135447ad2e730820b740a3e118cee70a082efba075491f6a31be68f500a0886c50108575a707d93f2cde8e37e3ca4434d4a699

Download Submit
\Users\Admin\AppData\Local\Temp\AkKILS.cpl

Filesize
1.5MB

MD5
69e6675edc7282c6fadf1eea0d490809

SHA1
78a366f87e2acc5bff639f95423ab87f54c19956

SHA256
813a6391333501d4b941c6118bb3e3127fa6f8c7e51ea65e36aff1be8a3ecf72

SHA512
88a79f35812c7d6de32a5659f5135447ad2e730820b740a3e118cee70a082efba075491f6a31be68f500a0886c50108575a707d93f2cde8e37e3ca4434d4a699

Download Submit
\Users\Admin\AppData\Local\Temp\AkKILS.cpl

Filesize
1.5MB

MD5
69e6675edc7282c6fadf1eea0d490809

SHA1
78a366f87e2acc5bff639f95423ab87f54c19956

SHA256
813a6391333501d4b941c6118bb3e3127fa6f8c7e51ea65e36aff1be8a3ecf72

SHA512
88a79f35812c7d6de32a5659f5135447ad2e730820b740a3e118cee70a082efba075491f6a31be68f500a0886c50108575a707d93f2cde8e37e3ca4434d4a699

Download Submit
\Users\Admin\AppData\Local\Temp\AkKILS.cpl

Filesize
1.5MB

MD5
69e6675edc7282c6fadf1eea0d490809

SHA1
78a366f87e2acc5bff639f95423ab87f54c19956

SHA256
813a6391333501d4b941c6118bb3e3127fa6f8c7e51ea65e36aff1be8a3ecf72

SHA512
88a79f35812c7d6de32a5659f5135447ad2e730820b740a3e118cee70a082efba075491f6a31be68f500a0886c50108575a707d93f2cde8e37e3ca4434d4a699

Download Submit
\Users\Admin\AppData\Local\Temp\AkKILS.cpl

Filesize
1.5MB

MD5
69e6675edc7282c6fadf1eea0d490809

SHA1
78a366f87e2acc5bff639f95423ab87f54c19956

SHA256
813a6391333501d4b941c6118bb3e3127fa6f8c7e51ea65e36aff1be8a3ecf72

SHA512
88a79f35812c7d6de32a5659f5135447ad2e730820b740a3e118cee70a082efba075491f6a31be68f500a0886c50108575a707d93f2cde8e37e3ca4434d4a699

Download Submit
\Users\Admin\AppData\Local\Temp\AkKILS.cpl

Filesize
1.5MB

MD5
69e6675edc7282c6fadf1eea0d490809

SHA1
78a366f87e2acc5bff639f95423ab87f54c19956

SHA256
813a6391333501d4b941c6118bb3e3127fa6f8c7e51ea65e36aff1be8a3ecf72

SHA512
88a79f35812c7d6de32a5659f5135447ad2e730820b740a3e118cee70a082efba075491f6a31be68f500a0886c50108575a707d93f2cde8e37e3ca4434d4a699

Download Submit
\Users\Admin\AppData\Local\Temp\AkKILS.cpl

Filesize
1.5MB

MD5
69e6675edc7282c6fadf1eea0d490809

SHA1
78a366f87e2acc5bff639f95423ab87f54c19956

SHA256
813a6391333501d4b941c6118bb3e3127fa6f8c7e51ea65e36aff1be8a3ecf72

SHA512
88a79f35812c7d6de32a5659f5135447ad2e730820b740a3e118cee70a082efba075491f6a31be68f500a0886c50108575a707d93f2cde8e37e3ca4434d4a699

Download Submit
\Users\Admin\AppData\Local\Temp\AkKILS.cpl

Filesize
1.5MB

MD5
69e6675edc7282c6fadf1eea0d490809

SHA1
78a366f87e2acc5bff639f95423ab87f54c19956

SHA256
813a6391333501d4b941c6118bb3e3127fa6f8c7e51ea65e36aff1be8a3ecf72

SHA512
88a79f35812c7d6de32a5659f5135447ad2e730820b740a3e118cee70a082efba075491f6a31be68f500a0886c50108575a707d93f2cde8e37e3ca4434d4a699

Download Submit
memory/2900-80-0x0000000001E60000-0x0000000001FE9000-memory.dmp

Filesize
1.5MB

Download
memory/2900-89-0x0000000002310000-0x00000000023FA000-memory.dmp

Filesize
936KB

Download
memory/2900-88-0x0000000002310000-0x00000000023FA000-memory.dmp

Filesize
936KB

Download
memory/2900-85-0x0000000002310000-0x00000000023FA000-memory.dmp

Filesize
936KB

Download
memory/2900-84-0x0000000002770000-0x0000000002874000-memory.dmp

Filesize
1.0MB

Download
memory/2900-79-0x0000000001E60000-0x0000000001FE9000-memory.dmp

Filesize
1.5MB

Download
memory/2900-82-0x0000000000150000-0x0000000000156000-memory.dmp

Filesize
24KB

Download
memory/3012-69-0x0000000002610000-0x0000000002714000-memory.dmp

Filesize
1.0MB

Download
memory/3012-62-0x00000000008C0000-0x0000000000A49000-memory.dmp

Filesize
1.5MB

Download
memory/3012-63-0x00000000008C0000-0x0000000000A49000-memory.dmp

Filesize
1.5MB

Download
memory/3012-65-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/3012-70-0x0000000002720000-0x000000000280A000-memory.dmp

Filesize
936KB

Download
memory/3012-74-0x0000000002720000-0x000000000280A000-memory.dmp

Filesize
936KB

Download
memory/3012-73-0x0000000002720000-0x000000000280A000-memory.dmp

Filesize
936KB

Download