kutaki | 2e5d72526f20a77c48730482202938ea1bedc95444c9334b2b8f14eb877bf8c1

Analysis

max time kernel
128s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
21/05/2022, 01:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

image.exe
Size

536KB
MD5

9bcc23452d5a20790ff08c81812d7fd2
SHA1

9ad029bf6cebf0308db6771d423018289684faf5
SHA256

e33166cf9f69cdc54b3ca9721a6837d961ee42285c766561a9ff8a1719f39405
SHA512

89b39cc4b9bfef88cc99df3de3501a61f8e40a0becad0c5b2d83054db2414a723e25f85c638b22f98a3adcc3870952aa76d4dc1c66a61d13a2510dd147757606

Score

10^/10

kutaki keylogger stealer

Malware Config

Signatures

Kutaki
Information stealer and keylogger that hides inside legitimate Visual Basic applications.
stealer keylogger kutaki

Kutaki Executable 2 IoCs

resource	yara_rule
behavioral2/files/0x000800000001dabb-134.dat	family_kutaki
behavioral2/files/0x000800000001dabb-135.dat	family_kutaki

Executes dropped EXE 1 IoCs

pid	Process
4964	dnkfwoch.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dnkfwoch.exe	image.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dnkfwoch.exe	image.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4100	image.exe
4100	image.exe
4100	image.exe
4964	dnkfwoch.exe
4964	dnkfwoch.exe
4964	dnkfwoch.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4100 wrote to memory of 4668	4100	image.exe	78
PID 4100 wrote to memory of 4668	4100	image.exe	78
PID 4100 wrote to memory of 4668	4100	image.exe	78
PID 4100 wrote to memory of 4964	4100	image.exe	82
PID 4100 wrote to memory of 4964	4100	image.exe	82
PID 4100 wrote to memory of 4964	4100	image.exe	82

C:\Users\Admin\AppData\Local\Temp\image.exe
"C:\Users\Admin\AppData\Local\Temp\image.exe"
1⤵
- Drops startup file
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4100
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  PID:4668
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dnkfwoch.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dnkfwoch.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4964

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dnkfwoch.exe

Filesize
536KB

MD5
9bcc23452d5a20790ff08c81812d7fd2

SHA1
9ad029bf6cebf0308db6771d423018289684faf5

SHA256
e33166cf9f69cdc54b3ca9721a6837d961ee42285c766561a9ff8a1719f39405

SHA512
89b39cc4b9bfef88cc99df3de3501a61f8e40a0becad0c5b2d83054db2414a723e25f85c638b22f98a3adcc3870952aa76d4dc1c66a61d13a2510dd147757606

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dnkfwoch.exe

Filesize
536KB

MD5
9bcc23452d5a20790ff08c81812d7fd2

SHA1
9ad029bf6cebf0308db6771d423018289684faf5

SHA256
e33166cf9f69cdc54b3ca9721a6837d961ee42285c766561a9ff8a1719f39405

SHA512
89b39cc4b9bfef88cc99df3de3501a61f8e40a0becad0c5b2d83054db2414a723e25f85c638b22f98a3adcc3870952aa76d4dc1c66a61d13a2510dd147757606

Download Submit