Malware Analysis Report

2024-11-30 11:24

Sample ID 220527-3nxxqahae3
Target 03afc77a1e8c8966432bd341c66d3186b31141bc64d971893e834473a67b5b55
SHA256 03afc77a1e8c8966432bd341c66d3186b31141bc64d971893e834473a67b5b55
Tags
kutaki keylogger stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

03afc77a1e8c8966432bd341c66d3186b31141bc64d971893e834473a67b5b55

Threat Level: Known bad

The file 03afc77a1e8c8966432bd341c66d3186b31141bc64d971893e834473a67b5b55 was found to be: Known bad.

Malicious Activity Summary

kutaki keylogger stealer

Kutaki Executable

Kutaki family

Kutaki

Executes dropped EXE

Drops startup file

Loads dropped DLL

Maps connected drives based on registry

Enumerates physical storage devices

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-05-27 23:40

Signatures

Kutaki Executable

Description Indicator Process Target
N/A N/A N/A N/A

Kutaki family

kutaki

Analysis: behavioral2

Detonation Overview

Submitted

2022-05-27 23:40

Reported

2022-05-28 01:50

Platform

win10v2004-20220414-en

Max time kernel

164s

Max time network

180s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Tax Payment Challan.exe"

Signatures

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Tax Payment Challan.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Tax Payment Challan.exe

"C:\Users\Admin\AppData\Local\Temp\Tax Payment Challan.exe"

Network

Country Destination Domain Proto
US 8.253.69.232:80 tcp
US 67.26.205.254:80 tcp
US 67.26.205.254:80 tcp
US 20.42.65.88:443 tcp
US 67.26.205.254:80 tcp
US 67.26.205.254:80 tcp
US 67.26.205.254:80 tcp
US 8.8.8.8:53 97.97.242.52.in-addr.arpa udp
US 8.8.8.8:53 226.101.242.52.in-addr.arpa udp
US 8.8.8.8:53 a.2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.5.0.8.0.0.3.0.1.3.0.6.2.ip6.arpa udp
US 67.27.131.254:80 tcp

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-05-27 23:40

Reported

2022-05-28 01:50

Platform

win7-20220414-en

Max time kernel

102s

Max time network

45s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Tax Payment Challan.exe"

Signatures

Kutaki

stealer keylogger kutaki

Kutaki Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe C:\Users\Admin\AppData\Local\Temp\Tax Payment Challan.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe C:\Users\Admin\AppData\Local\Temp\Tax Payment Challan.exe N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A

Enumerates physical storage devices

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\DllHost.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Tax Payment Challan.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Tax Payment Challan.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Tax Payment Challan.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\Tax Payment Challan.exe

"C:\Users\Admin\AppData\Local\Temp\Tax Payment Challan.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c C:\Users\Admin\AppData\Local\Temp\NewBitmapImage.bmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe"

C:\Windows\SysWOW64\DllHost.exe

C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}

Network

N/A

Files

memory/1072-56-0x0000000075841000-0x0000000075843000-memory.dmp

memory/952-57-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe

MD5 f85699f0c3bca198228a5af7de67ecba
SHA1 56f4a24a398dae4e6e47d62832144673b3486f9f
SHA256 4c1bc4e929ba5c02a4fbba9b7bb3eb728a3f4e010e04a9c10189487c1843085e
SHA512 b170c937b015ae6a2ae98ae609f2c6626130681b95d45089d99d9bed9b8fffc54b170b1f69d0d2b64acbf8d3282e08e45b5accbdbbc753dbaa13d6ff510e3582

\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe

MD5 f85699f0c3bca198228a5af7de67ecba
SHA1 56f4a24a398dae4e6e47d62832144673b3486f9f
SHA256 4c1bc4e929ba5c02a4fbba9b7bb3eb728a3f4e010e04a9c10189487c1843085e
SHA512 b170c937b015ae6a2ae98ae609f2c6626130681b95d45089d99d9bed9b8fffc54b170b1f69d0d2b64acbf8d3282e08e45b5accbdbbc753dbaa13d6ff510e3582

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pymluwch.exe

MD5 f85699f0c3bca198228a5af7de67ecba
SHA1 56f4a24a398dae4e6e47d62832144673b3486f9f
SHA256 4c1bc4e929ba5c02a4fbba9b7bb3eb728a3f4e010e04a9c10189487c1843085e
SHA512 b170c937b015ae6a2ae98ae609f2c6626130681b95d45089d99d9bed9b8fffc54b170b1f69d0d2b64acbf8d3282e08e45b5accbdbbc753dbaa13d6ff510e3582

memory/1120-61-0x0000000000000000-mapping.dmp