Analysis

  • max time kernel
    188s
  • max time network
    45s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    25-06-2022 05:26

General

  • Target

    8b12a088323095e7307e40be4b3194cebd6756d9414d360e06e2015804ad6b58.exe

  • Size

    707KB

  • MD5

    2600b7e78f3a1d996294bcc27b309594

  • SHA1

    a90f63310dca46b419cfcbe95d90e1517932d6d3

  • SHA256

    8b12a088323095e7307e40be4b3194cebd6756d9414d360e06e2015804ad6b58

  • SHA512

    db6926d1cf359712dd7c77b48444f00d0f8ea776cdec752d604a68a3037eadbd38723f50ee655821eda51d21a528c00313e505575816c2ad659856fad886da7b

Malware Config

Signatures

  • Kutaki

    Information stealer and keylogger that hides inside legitimate Visual Basic applications.

  • Kutaki Executable 4 IoCs
  • Executes dropped EXE 1 IoCs
  • Drops startup file 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8b12a088323095e7307e40be4b3194cebd6756d9414d360e06e2015804ad6b58.exe
    "C:\Users\Admin\AppData\Local\Temp\8b12a088323095e7307e40be4b3194cebd6756d9414d360e06e2015804ad6b58.exe"
    1⤵
    • Drops startup file
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1764
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
      2⤵
        PID:1380
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hyuder.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hyuder.exe"
        2⤵
        • Executes dropped EXE
        • Maps connected drives based on registry
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1736

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hyuder.exe

      Filesize

      707KB

      MD5

      2600b7e78f3a1d996294bcc27b309594

      SHA1

      a90f63310dca46b419cfcbe95d90e1517932d6d3

      SHA256

      8b12a088323095e7307e40be4b3194cebd6756d9414d360e06e2015804ad6b58

      SHA512

      db6926d1cf359712dd7c77b48444f00d0f8ea776cdec752d604a68a3037eadbd38723f50ee655821eda51d21a528c00313e505575816c2ad659856fad886da7b

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hyuder.exe

      Filesize

      707KB

      MD5

      2600b7e78f3a1d996294bcc27b309594

      SHA1

      a90f63310dca46b419cfcbe95d90e1517932d6d3

      SHA256

      8b12a088323095e7307e40be4b3194cebd6756d9414d360e06e2015804ad6b58

      SHA512

      db6926d1cf359712dd7c77b48444f00d0f8ea776cdec752d604a68a3037eadbd38723f50ee655821eda51d21a528c00313e505575816c2ad659856fad886da7b

    • \Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hyuder.exe

      Filesize

      707KB

      MD5

      2600b7e78f3a1d996294bcc27b309594

      SHA1

      a90f63310dca46b419cfcbe95d90e1517932d6d3

      SHA256

      8b12a088323095e7307e40be4b3194cebd6756d9414d360e06e2015804ad6b58

      SHA512

      db6926d1cf359712dd7c77b48444f00d0f8ea776cdec752d604a68a3037eadbd38723f50ee655821eda51d21a528c00313e505575816c2ad659856fad886da7b

    • \Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hyuder.exe

      Filesize

      707KB

      MD5

      2600b7e78f3a1d996294bcc27b309594

      SHA1

      a90f63310dca46b419cfcbe95d90e1517932d6d3

      SHA256

      8b12a088323095e7307e40be4b3194cebd6756d9414d360e06e2015804ad6b58

      SHA512

      db6926d1cf359712dd7c77b48444f00d0f8ea776cdec752d604a68a3037eadbd38723f50ee655821eda51d21a528c00313e505575816c2ad659856fad886da7b

    • memory/1380-57-0x0000000000000000-mapping.dmp

    • memory/1736-60-0x0000000000000000-mapping.dmp

    • memory/1764-56-0x0000000075BF1000-0x0000000075BF3000-memory.dmp

      Filesize

      8KB