Analysis

  • max time kernel
    168s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    25-06-2022 06:03

General

  • Target

    3a3ea1848d9834a0959b57b6225cc5730b3d576e8a73bdc129622a12d6e51bc0.exe

  • Size

    840KB

  • MD5

    03d14d25935aabae662a09db5146ea35

  • SHA1

    e75ffa7ef6be023be366f95dedffff934e890f06

  • SHA256

    3a3ea1848d9834a0959b57b6225cc5730b3d576e8a73bdc129622a12d6e51bc0

  • SHA512

    3f1cd8d0032f49a5a724479f45c3767910cfb9196aeec051a3e162af99631814cfb7fa9729274c091d6ca49a3db87a3f53d3d01eb72eb573f771eaca5617f61a

Malware Config

Signatures

  • Kutaki

    Information stealer and keylogger that hides inside legitimate Visual Basic applications.

  • Kutaki Executable 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Drops startup file 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3a3ea1848d9834a0959b57b6225cc5730b3d576e8a73bdc129622a12d6e51bc0.exe
    "C:\Users\Admin\AppData\Local\Temp\3a3ea1848d9834a0959b57b6225cc5730b3d576e8a73bdc129622a12d6e51bc0.exe"
    1⤵
    • Drops startup file
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:948
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
      2⤵
        PID:1348
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dzidfich.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dzidfich.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:320

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dzidfich.exe

      Filesize

      840KB

      MD5

      03d14d25935aabae662a09db5146ea35

      SHA1

      e75ffa7ef6be023be366f95dedffff934e890f06

      SHA256

      3a3ea1848d9834a0959b57b6225cc5730b3d576e8a73bdc129622a12d6e51bc0

      SHA512

      3f1cd8d0032f49a5a724479f45c3767910cfb9196aeec051a3e162af99631814cfb7fa9729274c091d6ca49a3db87a3f53d3d01eb72eb573f771eaca5617f61a

    • \Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dzidfich.exe

      Filesize

      840KB

      MD5

      03d14d25935aabae662a09db5146ea35

      SHA1

      e75ffa7ef6be023be366f95dedffff934e890f06

      SHA256

      3a3ea1848d9834a0959b57b6225cc5730b3d576e8a73bdc129622a12d6e51bc0

      SHA512

      3f1cd8d0032f49a5a724479f45c3767910cfb9196aeec051a3e162af99631814cfb7fa9729274c091d6ca49a3db87a3f53d3d01eb72eb573f771eaca5617f61a

    • \Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dzidfich.exe

      Filesize

      840KB

      MD5

      03d14d25935aabae662a09db5146ea35

      SHA1

      e75ffa7ef6be023be366f95dedffff934e890f06

      SHA256

      3a3ea1848d9834a0959b57b6225cc5730b3d576e8a73bdc129622a12d6e51bc0

      SHA512

      3f1cd8d0032f49a5a724479f45c3767910cfb9196aeec051a3e162af99631814cfb7fa9729274c091d6ca49a3db87a3f53d3d01eb72eb573f771eaca5617f61a

    • memory/320-60-0x0000000000000000-mapping.dmp

    • memory/948-56-0x00000000769D1000-0x00000000769D3000-memory.dmp

      Filesize

      8KB

    • memory/1348-57-0x0000000000000000-mapping.dmp