Analysis

  • max time kernel
    128s
  • max time network
    138s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    08-02-2022 01:54

General

  • Target

    Payment Receipt.exe

  • Size

    532KB

  • MD5

    f94a939bae7c5e1d897253f792b052f7

  • SHA1

    e21bfa3434858b47269ffbc5953760fefc9a7aec

  • SHA256

    f0d9268622a5e43c670ccc556495668967dac426fab571b78aaf1c61632f633c

  • SHA512

    7a8494329b238a7bed09ce32a247f1075f2e91b690b7c38e8417590a20233cbf382c2fbc8ab3cb6d0dcc0e8677934761db39659e8987f46c9c603ab909eb2f97

Malware Config

Signatures

  • Kutaki

    Information stealer and keylogger that hides inside legitimate Visual Basic applications.

  • Kutaki Executable 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Drops startup file 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Payment Receipt.exe
    "C:\Users\Admin\AppData\Local\Temp\Payment Receipt.exe"
    1⤵
    • Drops startup file
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1528
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c C:\Users\Admin\AppData\Local\Temp\NewBitmapImage.bmp
      2⤵
        PID:620
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uvkbvych.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uvkbvych.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1248
    • C:\Windows\SysWOW64\DllHost.exe
      C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
      1⤵
      • Suspicious use of FindShellTrayWindow
      PID:1100

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uvkbvych.exe

      MD5

      f94a939bae7c5e1d897253f792b052f7

      SHA1

      e21bfa3434858b47269ffbc5953760fefc9a7aec

      SHA256

      f0d9268622a5e43c670ccc556495668967dac426fab571b78aaf1c61632f633c

      SHA512

      7a8494329b238a7bed09ce32a247f1075f2e91b690b7c38e8417590a20233cbf382c2fbc8ab3cb6d0dcc0e8677934761db39659e8987f46c9c603ab909eb2f97

    • \Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uvkbvych.exe

      MD5

      f94a939bae7c5e1d897253f792b052f7

      SHA1

      e21bfa3434858b47269ffbc5953760fefc9a7aec

      SHA256

      f0d9268622a5e43c670ccc556495668967dac426fab571b78aaf1c61632f633c

      SHA512

      7a8494329b238a7bed09ce32a247f1075f2e91b690b7c38e8417590a20233cbf382c2fbc8ab3cb6d0dcc0e8677934761db39659e8987f46c9c603ab909eb2f97

    • \Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uvkbvych.exe

      MD5

      f94a939bae7c5e1d897253f792b052f7

      SHA1

      e21bfa3434858b47269ffbc5953760fefc9a7aec

      SHA256

      f0d9268622a5e43c670ccc556495668967dac426fab571b78aaf1c61632f633c

      SHA512

      7a8494329b238a7bed09ce32a247f1075f2e91b690b7c38e8417590a20233cbf382c2fbc8ab3cb6d0dcc0e8677934761db39659e8987f46c9c603ab909eb2f97

    • memory/620-66-0x00000000021A0000-0x00000000021A2000-memory.dmp

      Filesize

      8KB

    • memory/1100-67-0x0000000000120000-0x0000000000122000-memory.dmp

      Filesize

      8KB

    • memory/1100-68-0x0000000000280000-0x0000000000281000-memory.dmp

      Filesize

      4KB

    • memory/1528-57-0x00000000769D1000-0x00000000769D3000-memory.dmp

      Filesize

      8KB