kutaki | e6cd47abf6c7c73449bd05329a0e30a48012c947d8762dd2429333af8d7bc198

Analysis

Target

tracking details.exe
Size

752KB
MD5

3c35fca6cb231d20cc04e6d8b2601010
SHA1

aecde409a20bdaa63be0570d5625938e7df50197
SHA256

e6cd47abf6c7c73449bd05329a0e30a48012c947d8762dd2429333af8d7bc198
SHA512

0b7e2604adf2d89ef471336f8dd322c9f8b222e404aa68fbf67a13ced6ec0eb0a8c9968cb92401b44d2d4d1a1e53e51e7d8840f74ee4baec3f1d4b05d76d1d77

Score

10^/10

Kutaki
Information stealer and keylogger that hides inside legitimate Visual Basic applications.
stealer keylogger kutaki

Kutaki Executable 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\syilizch.exe	family_kutaki
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\syilizch.exe	family_kutaki

Executes dropped EXE 1 IoCs

Processes:

syilizch.exe

pid process

504 syilizch.exe

pid	process
504	syilizch.exe

Drops startup file 2 IoCs

Processes:

tracking details.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\syilizch.exe	tracking details.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\syilizch.exe	tracking details.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

tracking details.exesyilizch.exe

pid process

812 tracking details.exe
812 tracking details.exe
812 tracking details.exe
504 syilizch.exe
504 syilizch.exe
504 syilizch.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

tracking details.exe

description	pid	process	target process
PID 812 wrote to memory of 3984	812	tracking details.exe	cmd.exe
PID 812 wrote to memory of 3984	812	tracking details.exe	cmd.exe
PID 812 wrote to memory of 3984	812	tracking details.exe	cmd.exe
PID 812 wrote to memory of 504	812	tracking details.exe	syilizch.exe
PID 812 wrote to memory of 504	812	tracking details.exe	syilizch.exe
PID 812 wrote to memory of 504	812	tracking details.exe	syilizch.exe

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
2⤵
PID:3984

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\syilizch.exe
MD5
3c35fca6cb231d20cc04e6d8b2601010

SHA1
aecde409a20bdaa63be0570d5625938e7df50197

SHA256
e6cd47abf6c7c73449bd05329a0e30a48012c947d8762dd2429333af8d7bc198

SHA512
0b7e2604adf2d89ef471336f8dd322c9f8b222e404aa68fbf67a13ced6ec0eb0a8c9968cb92401b44d2d4d1a1e53e51e7d8840f74ee4baec3f1d4b05d76d1d77

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\syilizch.exe
MD5
3c35fca6cb231d20cc04e6d8b2601010

SHA1
aecde409a20bdaa63be0570d5625938e7df50197

SHA256
e6cd47abf6c7c73449bd05329a0e30a48012c947d8762dd2429333af8d7bc198

SHA512
0b7e2604adf2d89ef471336f8dd322c9f8b222e404aa68fbf67a13ced6ec0eb0a8c9968cb92401b44d2d4d1a1e53e51e7d8840f74ee4baec3f1d4b05d76d1d77

Download Submit
memory/504-5-0x0000000000000000-mapping.dmp

Download
memory/3984-4-0x0000000000000000-mapping.dmp

Download