36194d07ea9897f2276215a1361291ba8e32843caf3056b4f096c213b1bfadb3

General

Target

SecuriteInfo.com.Trojan.Uztuby.4.20085.29220.exe
Size

1.7MB
MD5

af223db55c63038d78116cf8aed34b04
SHA1

3cd541ef16e0089dde1192af7b25398c5334846e
SHA256

36194d07ea9897f2276215a1361291ba8e32843caf3056b4f096c213b1bfadb3
SHA512

8c1469ebe9a5388bb092d1be0f77065f0e82b336012a3b2837f06cb743fc9a04e12e0ae099f1a83d232ada433bf6f7255db29ac6a3d53f6357e108e750955fe5
SSDEEP

24576:F/rPkVdKtQBoZUABKUlY0Q1MhhvjdVmOFMZUdNoEiaWpI83X6pxxAcyh/GqIUbcE:Paqbov0Qk1R6qzl526Txo/GqIUDjQa

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Control Panel\International\Geo\Nation	SecuriteInfo.com.Trojan.Uztuby.4.20085.29220.exe

Loads dropped DLL 4 IoCs

pid	Process
1160	rundll32.exe
1160	rundll32.exe
1652	rundll32.exe
1652	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\Local Settings	SecuriteInfo.com.Trojan.Uztuby.4.20085.29220.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 940 wrote to memory of 1508	940	SecuriteInfo.com.Trojan.Uztuby.4.20085.29220.exe	81
PID 940 wrote to memory of 1508	940	SecuriteInfo.com.Trojan.Uztuby.4.20085.29220.exe	81
PID 940 wrote to memory of 1508	940	SecuriteInfo.com.Trojan.Uztuby.4.20085.29220.exe	81
PID 1508 wrote to memory of 1160	1508	control.exe	83
PID 1508 wrote to memory of 1160	1508	control.exe	83
PID 1508 wrote to memory of 1160	1508	control.exe	83
PID 1160 wrote to memory of 3912	1160	rundll32.exe	84
PID 1160 wrote to memory of 3912	1160	rundll32.exe	84
PID 3912 wrote to memory of 1652	3912	RunDll32.exe	85
PID 3912 wrote to memory of 1652	3912	RunDll32.exe	85
PID 3912 wrote to memory of 1652	3912	RunDll32.exe	85

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Uztuby.4.20085.29220.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Uztuby.4.20085.29220.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:940
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\AkKILS.CPl",
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1508
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\AkKILS.CPl",
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1160
  - - C:\Windows\system32\RunDll32.exe
      C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\AkKILS.CPl",
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3912
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\AkKILS.CPl",
        5⤵
        Loads dropped DLL
        
        PID:1652

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\AkKILS.CPl

Filesize
1.5MB

MD5
69e6675edc7282c6fadf1eea0d490809

SHA1
78a366f87e2acc5bff639f95423ab87f54c19956

SHA256
813a6391333501d4b941c6118bb3e3127fa6f8c7e51ea65e36aff1be8a3ecf72

SHA512
88a79f35812c7d6de32a5659f5135447ad2e730820b740a3e118cee70a082efba075491f6a31be68f500a0886c50108575a707d93f2cde8e37e3ca4434d4a699

Download Submit
C:\Users\Admin\AppData\Local\Temp\AkKILS.cpl

Filesize
1.5MB

MD5
69e6675edc7282c6fadf1eea0d490809

SHA1
78a366f87e2acc5bff639f95423ab87f54c19956

SHA256
813a6391333501d4b941c6118bb3e3127fa6f8c7e51ea65e36aff1be8a3ecf72

SHA512
88a79f35812c7d6de32a5659f5135447ad2e730820b740a3e118cee70a082efba075491f6a31be68f500a0886c50108575a707d93f2cde8e37e3ca4434d4a699

Download Submit
C:\Users\Admin\AppData\Local\Temp\AkKILS.cpl

Filesize
1.5MB

MD5
69e6675edc7282c6fadf1eea0d490809

SHA1
78a366f87e2acc5bff639f95423ab87f54c19956

SHA256
813a6391333501d4b941c6118bb3e3127fa6f8c7e51ea65e36aff1be8a3ecf72

SHA512
88a79f35812c7d6de32a5659f5135447ad2e730820b740a3e118cee70a082efba075491f6a31be68f500a0886c50108575a707d93f2cde8e37e3ca4434d4a699

Download Submit
C:\Users\Admin\AppData\Local\Temp\AkKILS.cpl

Filesize
1.5MB

MD5
69e6675edc7282c6fadf1eea0d490809

SHA1
78a366f87e2acc5bff639f95423ab87f54c19956

SHA256
813a6391333501d4b941c6118bb3e3127fa6f8c7e51ea65e36aff1be8a3ecf72

SHA512
88a79f35812c7d6de32a5659f5135447ad2e730820b740a3e118cee70a082efba075491f6a31be68f500a0886c50108575a707d93f2cde8e37e3ca4434d4a699

Download Submit
C:\Users\Admin\AppData\Local\Temp\AkKILS.cpl

Filesize
1.5MB

MD5
69e6675edc7282c6fadf1eea0d490809

SHA1
78a366f87e2acc5bff639f95423ab87f54c19956

SHA256
813a6391333501d4b941c6118bb3e3127fa6f8c7e51ea65e36aff1be8a3ecf72

SHA512
88a79f35812c7d6de32a5659f5135447ad2e730820b740a3e118cee70a082efba075491f6a31be68f500a0886c50108575a707d93f2cde8e37e3ca4434d4a699

Download Submit
C:\Users\Admin\AppData\Local\Temp\AkKILS.cpl

Filesize
1.5MB

MD5
69e6675edc7282c6fadf1eea0d490809

SHA1
78a366f87e2acc5bff639f95423ab87f54c19956

SHA256
813a6391333501d4b941c6118bb3e3127fa6f8c7e51ea65e36aff1be8a3ecf72

SHA512
88a79f35812c7d6de32a5659f5135447ad2e730820b740a3e118cee70a082efba075491f6a31be68f500a0886c50108575a707d93f2cde8e37e3ca4434d4a699

Download Submit
memory/1160-154-0x0000000002740000-0x00000000028C9000-memory.dmp

Filesize
1.5MB

Download
memory/1160-145-0x0000000002740000-0x00000000028C9000-memory.dmp

Filesize
1.5MB

Download
memory/1160-151-0x0000000002D10000-0x0000000002DFA000-memory.dmp

Filesize
936KB

Download
memory/1160-155-0x0000000002D10000-0x0000000002DFA000-memory.dmp

Filesize
936KB

Download
memory/1160-148-0x0000000000A30000-0x0000000000A36000-memory.dmp

Filesize
24KB

Download
memory/1160-156-0x0000000002D10000-0x0000000002DFA000-memory.dmp

Filesize
936KB

Download
memory/1160-146-0x0000000002740000-0x00000000028C9000-memory.dmp

Filesize
1.5MB

Download
memory/1160-150-0x0000000002C00000-0x0000000002D04000-memory.dmp

Filesize
1.0MB

Download
memory/1652-159-0x00000000025C0000-0x0000000002749000-memory.dmp

Filesize
1.5MB

Download
memory/1652-160-0x00000000025C0000-0x0000000002749000-memory.dmp

Filesize
1.5MB

Download
memory/1652-162-0x0000000002750000-0x0000000002756000-memory.dmp

Filesize
24KB

Download
memory/1652-165-0x0000000002A50000-0x0000000002B54000-memory.dmp

Filesize
1.0MB

Download
memory/1652-166-0x0000000002B60000-0x0000000002C4A000-memory.dmp

Filesize
936KB

Download
memory/1652-169-0x0000000002B60000-0x0000000002C4A000-memory.dmp

Filesize
936KB

Download
memory/1652-170-0x0000000002B60000-0x0000000002C4A000-memory.dmp

Filesize
936KB

Download

Analysis

Sharing