Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
29-12-2021 01:23
Static task
static1
Behavioral task
behavioral1
Sample
image.exe
Resource
win7-en-20211208
General
-
Target
image.exe
-
Size
516KB
-
MD5
c43b7d74eef3fa1c025f08939e9d4be2
-
SHA1
0b41411bd1f52c115d77fc44815beed1b3cb749c
-
SHA256
d0fd86e3254a14f3b99d141b8512eae447cd716436ba8a192422596a2b0bb625
-
SHA512
9104a982f97370c03a95955b86bd9c37681d2c5aed2ba46ed0f113d915dbd83b1d237c6c5b128e24c7a3a3dc01c11fded5ef9eecf217255da98dd0eea5ee4d3d
Malware Config
Signatures
-
Kutaki Executable 2 IoCs
Processes:
resource yara_rule behavioral2/files/0x000a00000001ab3e-123.dat family_kutaki behavioral2/files/0x000a00000001ab3e-124.dat family_kutaki -
Executes dropped EXE 1 IoCs
Processes:
rrnbsoch.exepid Process 416 rrnbsoch.exe -
Drops startup file 2 IoCs
Processes:
image.exedescription ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rrnbsoch.exe image.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rrnbsoch.exe image.exe -
Drops file in Windows directory 1 IoCs
Processes:
mspaint.exedescription ioc Process File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
cmd.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings cmd.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
mspaint.exepid Process 4356 mspaint.exe 4356 mspaint.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
image.exemspaint.exerrnbsoch.exepid Process 3044 image.exe 3044 image.exe 3044 image.exe 4356 mspaint.exe 4356 mspaint.exe 4356 mspaint.exe 4356 mspaint.exe 416 rrnbsoch.exe 416 rrnbsoch.exe 416 rrnbsoch.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
image.execmd.exedescription pid Process procid_target PID 3044 wrote to memory of 4256 3044 image.exe 69 PID 3044 wrote to memory of 4256 3044 image.exe 69 PID 3044 wrote to memory of 4256 3044 image.exe 69 PID 4256 wrote to memory of 4356 4256 cmd.exe 71 PID 4256 wrote to memory of 4356 4256 cmd.exe 71 PID 4256 wrote to memory of 4356 4256 cmd.exe 71 PID 3044 wrote to memory of 416 3044 image.exe 75 PID 3044 wrote to memory of 416 3044 image.exe 75 PID 3044 wrote to memory of 416 3044 image.exe 75
Processes
-
C:\Users\Admin\AppData\Local\Temp\image.exe"C:\Users\Admin\AppData\Local\Temp\image.exe"1⤵
- Drops startup file
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Users\Admin\AppData\Local\Temp\NewBitmapImage.bmp2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Windows\SysWOW64\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\NewBitmapImage.bmp"3⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4356
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rrnbsoch.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rrnbsoch.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:416
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DeviceAssociationService1⤵PID:3848
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
c43b7d74eef3fa1c025f08939e9d4be2
SHA10b41411bd1f52c115d77fc44815beed1b3cb749c
SHA256d0fd86e3254a14f3b99d141b8512eae447cd716436ba8a192422596a2b0bb625
SHA5129104a982f97370c03a95955b86bd9c37681d2c5aed2ba46ed0f113d915dbd83b1d237c6c5b128e24c7a3a3dc01c11fded5ef9eecf217255da98dd0eea5ee4d3d
-
MD5
c43b7d74eef3fa1c025f08939e9d4be2
SHA10b41411bd1f52c115d77fc44815beed1b3cb749c
SHA256d0fd86e3254a14f3b99d141b8512eae447cd716436ba8a192422596a2b0bb625
SHA5129104a982f97370c03a95955b86bd9c37681d2c5aed2ba46ed0f113d915dbd83b1d237c6c5b128e24c7a3a3dc01c11fded5ef9eecf217255da98dd0eea5ee4d3d