kutaki | 45aecd6123f928ed68dd96ff464e22bdcd92ff3872159649edf8a082bbaa5d8c

General

Target

Payment Invoice.exe
Size

376KB
MD5

a7f37abc65de8b02ac67af17a289ad69
SHA1

6d271d0f377728657f4c284253cdc51faa3fdb5c
SHA256

7dfb08f5a669070d545d5e1e4d72c27b8c80d9c95820e441bbbacf1e9dd4aa31
SHA512

fec499c6dc1f5bbef6f36aa90cbbe35217633ebbafad5429af229a72909445273cecfb0c5b109bec680f54663d51d3b9fa4376c6926c56ef81112d32c8737f3b

Score

10^/10

kutaki keylogger stealer

Malware Config

Signatures

Kutaki
Information stealer and keylogger that hides inside legitimate Visual Basic applications.
stealer keylogger kutaki

Kutaki Executable 4 IoCs

resource	yara_rule
behavioral1/files/0x000a000000012685-63.dat	family_kutaki
behavioral1/files/0x000a000000012685-65.dat	family_kutaki
behavioral1/files/0x000a000000012685-64.dat	family_kutaki
behavioral1/files/0x000a000000012685-70.dat	family_kutaki

Executes dropped EXE 1 IoCs

pid	Process
672	gdonvdch.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gdonvdch.exe	Payment Invoice.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gdonvdch.exe	Payment Invoice.exe

Loads dropped DLL 2 IoCs

pid	Process
1192	Payment Invoice.exe
1192	Payment Invoice.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main	gdonvdch.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main	Payment Invoice.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1944	DllHost.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1192	Payment Invoice.exe
1192	Payment Invoice.exe
1192	Payment Invoice.exe
672	gdonvdch.exe
672	gdonvdch.exe
672	gdonvdch.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 812	1192	Payment Invoice.exe	27
PID 1192 wrote to memory of 812	1192	Payment Invoice.exe	27
PID 1192 wrote to memory of 812	1192	Payment Invoice.exe	27
PID 1192 wrote to memory of 812	1192	Payment Invoice.exe	27
PID 1192 wrote to memory of 672	1192	Payment Invoice.exe	31
PID 1192 wrote to memory of 672	1192	Payment Invoice.exe	31
PID 1192 wrote to memory of 672	1192	Payment Invoice.exe	31
PID 1192 wrote to memory of 672	1192	Payment Invoice.exe	31

C:\Users\Admin\AppData\Local\Temp\Payment Invoice.exe
"C:\Users\Admin\AppData\Local\Temp\Payment Invoice.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\NewBitmapImage.bmp
  2⤵
  PID:812
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gdonvdch.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gdonvdch.exe"
  2⤵
  - Executes dropped EXE
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:672

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:1944

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/672-69-0x00000000031F1000-0x000000000409D000-memory.dmp

Filesize
14.7MB

Download
memory/812-59-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/1192-56-0x0000000075891000-0x0000000075893000-memory.dmp

Filesize
8KB

Download
memory/1192-62-0x00000000032F1000-0x000000000419D000-memory.dmp

Filesize
14.7MB

Download
memory/1944-60-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/1944-61-0x0000000000340000-0x0000000000341000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing