Malware Analysis Report

2024-11-30 11:27

Sample ID 220503-y3qpqsedfl
Target 5575d516016285aaa303aef92c9e9ee7f65aa2982bff91664faeb4d767893594
SHA256 5575d516016285aaa303aef92c9e9ee7f65aa2982bff91664faeb4d767893594
Tags
kutaki keylogger stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

5575d516016285aaa303aef92c9e9ee7f65aa2982bff91664faeb4d767893594

Threat Level: Known bad

The file 5575d516016285aaa303aef92c9e9ee7f65aa2982bff91664faeb4d767893594 was found to be: Known bad.

Malicious Activity Summary

kutaki keylogger stealer

Kutaki

Kutaki Executable

Kutaki family

Executes dropped EXE

Loads dropped DLL

Drops startup file

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-05-03 20:18

Signatures

Kutaki Executable

Description Indicator Process Target
N/A N/A N/A N/A

Kutaki family

kutaki

Analysis: behavioral1

Detonation Overview

Submitted

2022-05-03 20:18

Reported

2022-05-03 20:21

Platform

win7-20220414-en

Max time kernel

104s

Max time network

50s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TRANSFER COPY.exe"

Signatures

Kutaki

stealer keylogger kutaki

Kutaki Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe C:\Users\Admin\AppData\Local\Temp\TRANSFER COPY.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe C:\Users\Admin\AppData\Local\Temp\TRANSFER COPY.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\TRANSFER COPY.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TRANSFER COPY.exe N/A

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\TRANSFER COPY.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TRANSFER COPY.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TRANSFER COPY.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\TRANSFER COPY.exe

"C:\Users\Admin\AppData\Local\Temp\TRANSFER COPY.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c C:\Users\Admin\AppData\Local\Temp\

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe"

Network

N/A

Files

memory/892-56-0x00000000763B1000-0x00000000763B3000-memory.dmp

memory/1996-57-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe

MD5 409c3e610fdff7165ea03ae828a10a85
SHA1 6c74e3488bc6b2dd6ae7c4f6dcb0388a50282d61
SHA256 f8a24fe1aa9092c805572d4e2e6188dc4c99ca9255f0fbf98fb101f33e9e99b7
SHA512 12c93a24ac73e4bb1eb2040107fdb845e48f96f91bd301e91614a247ef002e4b8657603d636de6c87f338dc3a3dc55f1dbf3a3cddec1e021fe68f29baf41b53f

\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe

MD5 409c3e610fdff7165ea03ae828a10a85
SHA1 6c74e3488bc6b2dd6ae7c4f6dcb0388a50282d61
SHA256 f8a24fe1aa9092c805572d4e2e6188dc4c99ca9255f0fbf98fb101f33e9e99b7
SHA512 12c93a24ac73e4bb1eb2040107fdb845e48f96f91bd301e91614a247ef002e4b8657603d636de6c87f338dc3a3dc55f1dbf3a3cddec1e021fe68f29baf41b53f

memory/2040-60-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rnjgzjch.exe

MD5 409c3e610fdff7165ea03ae828a10a85
SHA1 6c74e3488bc6b2dd6ae7c4f6dcb0388a50282d61
SHA256 f8a24fe1aa9092c805572d4e2e6188dc4c99ca9255f0fbf98fb101f33e9e99b7
SHA512 12c93a24ac73e4bb1eb2040107fdb845e48f96f91bd301e91614a247ef002e4b8657603d636de6c87f338dc3a3dc55f1dbf3a3cddec1e021fe68f29baf41b53f

Analysis: behavioral2

Detonation Overview

Submitted

2022-05-03 20:18

Reported

2022-05-03 20:21

Platform

win10v2004-20220414-en

Max time kernel

126s

Max time network

142s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TRANSFER COPY.exe"

Signatures

Kutaki

stealer keylogger kutaki

Kutaki Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mvgwbzch.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mvgwbzch.exe C:\Users\Admin\AppData\Local\Temp\TRANSFER COPY.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mvgwbzch.exe C:\Users\Admin\AppData\Local\Temp\TRANSFER COPY.exe N/A

Enumerates physical storage devices

Processes

C:\Users\Admin\AppData\Local\Temp\TRANSFER COPY.exe

"C:\Users\Admin\AppData\Local\Temp\TRANSFER COPY.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c C:\Users\Admin\AppData\Local\Temp\

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mvgwbzch.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mvgwbzch.exe"

Network

Country Destination Domain Proto
FR 2.18.109.224:443 tcp
FR 2.18.109.224:443 storesdk.dsx.mp.microsoft.com tcp
US 20.189.173.1:443 tcp
NL 178.79.208.1:80 tcp
US 104.18.25.243:80 tcp

Files

memory/3112-132-0x0000000000000000-mapping.dmp

memory/752-133-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mvgwbzch.exe

MD5 409c3e610fdff7165ea03ae828a10a85
SHA1 6c74e3488bc6b2dd6ae7c4f6dcb0388a50282d61
SHA256 f8a24fe1aa9092c805572d4e2e6188dc4c99ca9255f0fbf98fb101f33e9e99b7
SHA512 12c93a24ac73e4bb1eb2040107fdb845e48f96f91bd301e91614a247ef002e4b8657603d636de6c87f338dc3a3dc55f1dbf3a3cddec1e021fe68f29baf41b53f

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mvgwbzch.exe

MD5 409c3e610fdff7165ea03ae828a10a85
SHA1 6c74e3488bc6b2dd6ae7c4f6dcb0388a50282d61
SHA256 f8a24fe1aa9092c805572d4e2e6188dc4c99ca9255f0fbf98fb101f33e9e99b7
SHA512 12c93a24ac73e4bb1eb2040107fdb845e48f96f91bd301e91614a247ef002e4b8657603d636de6c87f338dc3a3dc55f1dbf3a3cddec1e021fe68f29baf41b53f