kutaki | 8179d2c371934e7f748fdf033d96a3b527158348e87ec21f1576136ede5d2d17

General

Target

Payment.exe
Size

752KB
MD5

55cb3b1b1f6fcb56f0e8d26cb8a4b8f2
SHA1

ce7013abac9be7c9ad1b700e8a3c735b97392819
SHA256

8179d2c371934e7f748fdf033d96a3b527158348e87ec21f1576136ede5d2d17
SHA512

a7c8e2f47bada4a62dca21ce900ad71dcdcf61011873e494603970102e9fbcb0fc8365c437c1c5f3f1f946cd78a6fc2a243df641b75df72b85910f06b98890f2

Score

10^/10

Kutaki
Information stealer and keylogger that hides inside legitimate Visual Basic applications.
stealer keylogger kutaki

Kutaki Executable 3 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uivnbkch.exe	family_kutaki
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uivnbkch.exe	family_kutaki
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uivnbkch.exe	family_kutaki

Executes dropped EXE 1 IoCs

Processes:

uivnbkch.exe

pid process

1220 uivnbkch.exe

pid	process
1220	uivnbkch.exe

Drops startup file 2 IoCs

Processes:

Payment.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uivnbkch.exe	Payment.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uivnbkch.exe	Payment.exe

Loads dropped DLL 2 IoCs

Processes:

Payment.exe

pid process

788 Payment.exe
788 Payment.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

DllHost.exe

pid process

1524 DllHost.exe

pid	process
1524	DllHost.exe

Suspicious use of SetWindowsHookEx 1052 IoCs

Processes:

Payment.exeuivnbkch.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

Payment.exe

description	pid	process	target process
PID 788 wrote to memory of 1140	788	Payment.exe	cmd.exe
PID 788 wrote to memory of 1140	788	Payment.exe	cmd.exe
PID 788 wrote to memory of 1140	788	Payment.exe	cmd.exe
PID 788 wrote to memory of 1140	788	Payment.exe	cmd.exe
PID 788 wrote to memory of 1220	788	Payment.exe	uivnbkch.exe
PID 788 wrote to memory of 1220	788	Payment.exe	uivnbkch.exe
PID 788 wrote to memory of 1220	788	Payment.exe	uivnbkch.exe
PID 788 wrote to memory of 1220	788	Payment.exe	uivnbkch.exe

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c C:\Users\Admin\AppData\Local\Temp\Receipt.bmp
2⤵
PID:1140

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:1524

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uivnbkch.exe
MD5
55cb3b1b1f6fcb56f0e8d26cb8a4b8f2

SHA1
ce7013abac9be7c9ad1b700e8a3c735b97392819

SHA256
8179d2c371934e7f748fdf033d96a3b527158348e87ec21f1576136ede5d2d17

SHA512
a7c8e2f47bada4a62dca21ce900ad71dcdcf61011873e494603970102e9fbcb0fc8365c437c1c5f3f1f946cd78a6fc2a243df641b75df72b85910f06b98890f2

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uivnbkch.exe
MD5
55cb3b1b1f6fcb56f0e8d26cb8a4b8f2

SHA1
ce7013abac9be7c9ad1b700e8a3c735b97392819

SHA256
8179d2c371934e7f748fdf033d96a3b527158348e87ec21f1576136ede5d2d17

SHA512
a7c8e2f47bada4a62dca21ce900ad71dcdcf61011873e494603970102e9fbcb0fc8365c437c1c5f3f1f946cd78a6fc2a243df641b75df72b85910f06b98890f2

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uivnbkch.exe
MD5
55cb3b1b1f6fcb56f0e8d26cb8a4b8f2

SHA1
ce7013abac9be7c9ad1b700e8a3c735b97392819

SHA256
8179d2c371934e7f748fdf033d96a3b527158348e87ec21f1576136ede5d2d17

SHA512
a7c8e2f47bada4a62dca21ce900ad71dcdcf61011873e494603970102e9fbcb0fc8365c437c1c5f3f1f946cd78a6fc2a243df641b75df72b85910f06b98890f2

Download Submit
memory/1140-4-0x0000000000000000-mapping.dmp

Download
memory/1220-7-0x0000000000000000-mapping.dmp

Download