Analysis

  • max time kernel
    120s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-en-20211014
  • submitted
    05-12-2021 03:49

General

  • Target

    image.exe

  • Size

    460KB

  • MD5

    41272cf867595eea4c729a1e3d2c97f4

  • SHA1

    1ee33f8015955ba97e422c6e7fa55949706dcc90

  • SHA256

    0a135e636efd63a00b06c31ffb57a6ec40dd466d9ff8ad4a3b34763356b76d03

  • SHA512

    140f13f827bbc62eed5b85ef8ee576b85cef24aea7ac37ba74307a63e67b82f0b400116ddda514bf45cbf673124becd57808b6c11915608b3fb664646d266b5f

Malware Config

Signatures

  • Kutaki

    Information stealer and keylogger that hides inside legitimate Visual Basic applications.

  • Kutaki Executable 4 IoCs
  • Executes dropped EXE 1 IoCs
  • Drops startup file 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\image.exe
    "C:\Users\Admin\AppData\Local\Temp\image.exe"
    1⤵
    • Drops startup file
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:460
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c C:\Users\Admin\AppData\Local\Temp\NewBitmapImage.bmp
      2⤵
        PID:328
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wwkbyfch.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wwkbyfch.exe"
        2⤵
        • Executes dropped EXE
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1180
    • C:\Windows\SysWOW64\DllHost.exe
      C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
      1⤵
      • Suspicious use of FindShellTrayWindow
      PID:1768

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wwkbyfch.exe

      MD5

      41272cf867595eea4c729a1e3d2c97f4

      SHA1

      1ee33f8015955ba97e422c6e7fa55949706dcc90

      SHA256

      0a135e636efd63a00b06c31ffb57a6ec40dd466d9ff8ad4a3b34763356b76d03

      SHA512

      140f13f827bbc62eed5b85ef8ee576b85cef24aea7ac37ba74307a63e67b82f0b400116ddda514bf45cbf673124becd57808b6c11915608b3fb664646d266b5f

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wwkbyfch.exe

      MD5

      41272cf867595eea4c729a1e3d2c97f4

      SHA1

      1ee33f8015955ba97e422c6e7fa55949706dcc90

      SHA256

      0a135e636efd63a00b06c31ffb57a6ec40dd466d9ff8ad4a3b34763356b76d03

      SHA512

      140f13f827bbc62eed5b85ef8ee576b85cef24aea7ac37ba74307a63e67b82f0b400116ddda514bf45cbf673124becd57808b6c11915608b3fb664646d266b5f

    • \Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wwkbyfch.exe

      MD5

      41272cf867595eea4c729a1e3d2c97f4

      SHA1

      1ee33f8015955ba97e422c6e7fa55949706dcc90

      SHA256

      0a135e636efd63a00b06c31ffb57a6ec40dd466d9ff8ad4a3b34763356b76d03

      SHA512

      140f13f827bbc62eed5b85ef8ee576b85cef24aea7ac37ba74307a63e67b82f0b400116ddda514bf45cbf673124becd57808b6c11915608b3fb664646d266b5f

    • \Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wwkbyfch.exe

      MD5

      41272cf867595eea4c729a1e3d2c97f4

      SHA1

      1ee33f8015955ba97e422c6e7fa55949706dcc90

      SHA256

      0a135e636efd63a00b06c31ffb57a6ec40dd466d9ff8ad4a3b34763356b76d03

      SHA512

      140f13f827bbc62eed5b85ef8ee576b85cef24aea7ac37ba74307a63e67b82f0b400116ddda514bf45cbf673124becd57808b6c11915608b3fb664646d266b5f

    • memory/328-68-0x00000000022A0000-0x00000000022A2000-memory.dmp

      Filesize

      8KB

    • memory/328-58-0x0000000000000000-mapping.dmp

    • memory/460-56-0x0000000000220000-0x000000000022A000-memory.dmp

      Filesize

      40KB

    • memory/460-57-0x0000000075B71000-0x0000000075B73000-memory.dmp

      Filesize

      8KB

    • memory/460-55-0x0000000000220000-0x0000000000226000-memory.dmp

      Filesize

      24KB

    • memory/1180-62-0x0000000000000000-mapping.dmp

    • memory/1180-65-0x00000000001B0000-0x00000000001BA000-memory.dmp

      Filesize

      40KB

    • memory/1180-71-0x0000000003DD1000-0x0000000004C7D000-memory.dmp

      Filesize

      14.7MB

    • memory/1180-64-0x00000000001B0000-0x00000000001B6000-memory.dmp

      Filesize

      24KB

    • memory/1768-69-0x00000000001E0000-0x00000000001E2000-memory.dmp

      Filesize

      8KB

    • memory/1768-70-0x00000000002C0000-0x00000000002C1000-memory.dmp

      Filesize

      4KB