kutaki | 0c78322817eb54c31659eb3ea8b2de29c045ab29e2db80cada6bd11bc1b48946

Analysis

max time kernel
156s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
29/05/2022, 23:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0c78322817eb54c31659eb3ea8b2de29c045ab29e2db80cada6bd11bc1b48946.exe
Size 1.1MB
Sample220529-3txh5seee6
SHA256 0c78322817eb54c31659eb3ea8b2de29c045ab29e2db80cada6bd11bc1b48946
MD5 4caebe06a29f139244f1dbabce06db7a
SHA1 b846fe335114a011ae0603c4cf46d8294e39a62a
SHA512 e250676d0fc96264146020454deb35c8b65587156df0cd0d4dbde3a8ada4700d5e7abc48f0a237bdf5d682d7c7745b4744d8c11959811f27850246443ee9d33b
MD5 SHA1 SHA512

Score

10^/10

kutaki keylogger stealer

Malware Config

Signatures

Kutaki
Information stealer and keylogger that hides inside legitimate Visual Basic applications.
stealer keylogger kutaki

Kutaki Executable 2 IoCs

resource	yara_rule
behavioral2/files/0x000600000001e6fb-144.dat	family_kutaki
behavioral2/files/0x000600000001e6fb-143.dat	family_kutaki

Executes dropped EXE 1 IoCs

pid	Process
2892	frufetch.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	cmd.exe

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\frufetch.exe	0c78322817eb54c31659eb3ea8b2de29c045ab29e2db80cada6bd11bc1b48946.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\frufetch.exe	0c78322817eb54c31659eb3ea8b2de29c045ab29e2db80cada6bd11bc1b48946.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AdvStart.ini	frufetch.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	frufetch.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	frufetch.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2832	WINWORD.EXE
2832	WINWORD.EXE

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
1140	0c78322817eb54c31659eb3ea8b2de29c045ab29e2db80cada6bd11bc1b48946.exe
1140	0c78322817eb54c31659eb3ea8b2de29c045ab29e2db80cada6bd11bc1b48946.exe
1140	0c78322817eb54c31659eb3ea8b2de29c045ab29e2db80cada6bd11bc1b48946.exe
2832	WINWORD.EXE
2832	WINWORD.EXE
2832	WINWORD.EXE
2832	WINWORD.EXE
2832	WINWORD.EXE
2832	WINWORD.EXE
2832	WINWORD.EXE
2832	WINWORD.EXE
2832	WINWORD.EXE
2892	frufetch.exe
2892	frufetch.exe
2892	frufetch.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 3156	1140	0c78322817eb54c31659eb3ea8b2de29c045ab29e2db80cada6bd11bc1b48946.exe	81
PID 1140 wrote to memory of 3156	1140	0c78322817eb54c31659eb3ea8b2de29c045ab29e2db80cada6bd11bc1b48946.exe	81
PID 1140 wrote to memory of 3156	1140	0c78322817eb54c31659eb3ea8b2de29c045ab29e2db80cada6bd11bc1b48946.exe	81
PID 3156 wrote to memory of 2832	3156	cmd.exe	83
PID 3156 wrote to memory of 2832	3156	cmd.exe	83
PID 1140 wrote to memory of 2892	1140	0c78322817eb54c31659eb3ea8b2de29c045ab29e2db80cada6bd11bc1b48946.exe	89
PID 1140 wrote to memory of 2892	1140	0c78322817eb54c31659eb3ea8b2de29c045ab29e2db80cada6bd11bc1b48946.exe	89
PID 1140 wrote to memory of 2892	1140	0c78322817eb54c31659eb3ea8b2de29c045ab29e2db80cada6bd11bc1b48946.exe	89

C:\Users\Admin\AppData\Local\Temp\0c78322817eb54c31659eb3ea8b2de29c045ab29e2db80cada6bd11bc1b48946.exe
"C:\Users\Admin\AppData\Local\Temp\0c78322817eb54c31659eb3ea8b2de29c045ab29e2db80cada6bd11bc1b48946.exe"
1⤵
- Drops startup file
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\dbe_certification_application.docx
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3156
- - C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\dbe_certification_application.docx" /o ""
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of SetWindowsHookEx
    PID:2832
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\frufetch.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\frufetch.exe"
  2⤵
  - Executes dropped EXE
  - Drops startup file
  - Maps connected drives based on registry
  - Suspicious use of SetWindowsHookEx
  PID:2892

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dbe_certification_application.docx

Path C:\Users\Admin\AppData\Local\Temp\dbe_certification_application.docx
Size 244KB
SHA256 9fbfaa0a155fc463b1e5195f2f029d235c00843013a34d150a6c4b404aac5f39
MD5 778a7309369f02b9fb630a37aa0aeed9
SHA1 3bdc69a16ff36721a0366279700b4b6a9af69b62
SHA512 a815386a90765609f67d4166d39dbdd40217e7fa371c59dd00bd9ce8bed533a93f4dd2e231a5cdc8b65fa0c9c4b7e3be2d2f830cad856bd0af665d44e21b848d
SSDEEP 6144:JWd4kOefELWy0lN32u65/f1GJZIlW1anwcTncdgTm/PWnMud:s34Wy0lUuAYJAWMwWcay/PWnpd
MD5 SHA1 SHA512 SSDEEP

Submit Download

frufetch.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\frufetch.exe
Size 1.1MB
SHA256 0c78322817eb54c31659eb3ea8b2de29c045ab29e2db80cada6bd11bc1b48946
MD5 4caebe06a29f139244f1dbabce06db7a
SHA1 b846fe335114a011ae0603c4cf46d8294e39a62a
SHA512 e250676d0fc96264146020454deb35c8b65587156df0cd0d4dbde3a8ada4700d5e7abc48f0a237bdf5d682d7c7745b4744d8c11959811f27850246443ee9d33b
SSDEEP 24576:uY4Vv3W+AyA/cayWpFVG96r1/kGlVZshDhwZ:QALdFU9E19lPshwZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

frufetch.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\frufetch.exe
Size 1.1MB
SHA256 0c78322817eb54c31659eb3ea8b2de29c045ab29e2db80cada6bd11bc1b48946
MD5 4caebe06a29f139244f1dbabce06db7a
SHA1 b846fe335114a011ae0603c4cf46d8294e39a62a
SHA512 e250676d0fc96264146020454deb35c8b65587156df0cd0d4dbde3a8ada4700d5e7abc48f0a237bdf5d682d7c7745b4744d8c11959811f27850246443ee9d33b
SSDEEP 24576:uY4Vv3W+AyA/cayWpFVG96r1/kGlVZshDhwZ:QALdFU9E19lPshwZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2832-136-0x00007FFC9C0B0000-0x00007FFC9C0C0000-memory.dmp

Download

memory/2832-148-0x00007FFC9C0B0000-0x00007FFC9C0C0000-memory.dmp

Download

memory/2832-137-0x00007FFC9C0B0000-0x00007FFC9C0C0000-memory.dmp

Download

memory/2832-138-0x00007FFC9C0B0000-0x00007FFC9C0C0000-memory.dmp

Download

memory/2832-139-0x00007FFC9C0B0000-0x00007FFC9C0C0000-memory.dmp

Download

memory/2832-140-0x00007FFC9A050000-0x00007FFC9A060000-memory.dmp

Download

memory/2832-141-0x00007FFC9A050000-0x00007FFC9A060000-memory.dmp

Download

memory/2832-151-0x00007FFC9C0B0000-0x00007FFC9C0C0000-memory.dmp

Download

memory/2832-135-0x00007FFC9C0B0000-0x00007FFC9C0C0000-memory.dmp

Download

memory/2832-150-0x00007FFC9C0B0000-0x00007FFC9C0C0000-memory.dmp

Download

memory/2832-149-0x00007FFC9C0B0000-0x00007FFC9C0C0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads