kutaki | 6bc635e6ac09b880a389ddf37ceaae81cb38fd81b3966ca1656b65c7d0f4d8fd

General

Target

PRODUCT SAMPLE & ORDER SHEET.PDF.scr
Size

488KB
MD5

85f51ff6bd810b0122a2c38eef70fa06
SHA1

aa49ffa7db0c118b644b62d75a0cc27b62a680aa
SHA256

6bc635e6ac09b880a389ddf37ceaae81cb38fd81b3966ca1656b65c7d0f4d8fd
SHA512

e20cc0744e2d3378958990e27ce59f25787f3133a67e4f0d21d63d7da1fc56ef9b2a297303f723a9408f24d3321931a45ecfcc70d6a19b954eab04602c3f4698

Score

10^/10

kutaki keylogger stealer

Malware Config

Signatures

Kutaki
Information stealer and keylogger that hides inside legitimate Visual Basic applications.
stealer keylogger kutaki

Kutaki Executable 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tsslvych.exe	family_kutaki
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tsslvych.exe	family_kutaki

Executes dropped EXE 1 IoCs

Processes:

tsslvych.exe

pid process

2020 tsslvych.exe

pid	process
2020	tsslvych.exe

Drops startup file 2 IoCs

Processes:

PRODUCT SAMPLE & ORDER SHEET.PDF.scr

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tsslvych.exe	PRODUCT SAMPLE & ORDER SHEET.PDF.scr
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tsslvych.exe	PRODUCT SAMPLE & ORDER SHEET.PDF.scr

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

PRODUCT SAMPLE & ORDER SHEET.PDF.scrtsslvych.exe

pid	process
4024	PRODUCT SAMPLE & ORDER SHEET.PDF.scr
4024	PRODUCT SAMPLE & ORDER SHEET.PDF.scr
4024	PRODUCT SAMPLE & ORDER SHEET.PDF.scr
2020	tsslvych.exe
2020	tsslvych.exe
2020	tsslvych.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

PRODUCT SAMPLE & ORDER SHEET.PDF.scr

description	pid	process	target process
PID 4024 wrote to memory of 1280	4024	PRODUCT SAMPLE & ORDER SHEET.PDF.scr	cmd.exe
PID 4024 wrote to memory of 1280	4024	PRODUCT SAMPLE & ORDER SHEET.PDF.scr	cmd.exe
PID 4024 wrote to memory of 1280	4024	PRODUCT SAMPLE & ORDER SHEET.PDF.scr	cmd.exe
PID 4024 wrote to memory of 2020	4024	PRODUCT SAMPLE & ORDER SHEET.PDF.scr	tsslvych.exe
PID 4024 wrote to memory of 2020	4024	PRODUCT SAMPLE & ORDER SHEET.PDF.scr	tsslvych.exe
PID 4024 wrote to memory of 2020	4024	PRODUCT SAMPLE & ORDER SHEET.PDF.scr	tsslvych.exe

C:\Users\Admin\AppData\Local\Temp\PRODUCT SAMPLE & ORDER SHEET.PDF.scr
"C:\Users\Admin\AppData\Local\Temp\PRODUCT SAMPLE & ORDER SHEET.PDF.scr" /S
1⤵
- Drops startup file
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4024
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\images.jpg
  2⤵
  PID:1280
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tsslvych.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tsslvych.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2020

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tsslvych.exe

MD5
85f51ff6bd810b0122a2c38eef70fa06

SHA1
aa49ffa7db0c118b644b62d75a0cc27b62a680aa

SHA256
6bc635e6ac09b880a389ddf37ceaae81cb38fd81b3966ca1656b65c7d0f4d8fd

SHA512
e20cc0744e2d3378958990e27ce59f25787f3133a67e4f0d21d63d7da1fc56ef9b2a297303f723a9408f24d3321931a45ecfcc70d6a19b954eab04602c3f4698

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tsslvych.exe

MD5
85f51ff6bd810b0122a2c38eef70fa06

SHA1
aa49ffa7db0c118b644b62d75a0cc27b62a680aa

SHA256
6bc635e6ac09b880a389ddf37ceaae81cb38fd81b3966ca1656b65c7d0f4d8fd

SHA512
e20cc0744e2d3378958990e27ce59f25787f3133a67e4f0d21d63d7da1fc56ef9b2a297303f723a9408f24d3321931a45ecfcc70d6a19b954eab04602c3f4698

Download Submit
memory/1280-116-0x0000000000000000-mapping.dmp

Download
memory/2020-117-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads