Analysis

  • max time kernel
    155s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    03-07-2022 10:15

General

  • Target

    408e62f6612f1ace5d52c48c850a16881504dd50dd3af9bfc245bae8cb7cfeb0.exe

  • Size

    740KB

  • MD5

    1ba628a1b76f3a2f4133f94c7c18f91c

  • SHA1

    876664b10a1fc68dba94efbb6aaa9f8eae3d1fac

  • SHA256

    408e62f6612f1ace5d52c48c850a16881504dd50dd3af9bfc245bae8cb7cfeb0

  • SHA512

    219a3a6e8cea16a58b90d7e2a044c4e7e26145e7e33c5a73033e382b2ccd8f8e16767af8af22f7f1db973733619a03e5cce1a4c2327f2d8f79db67f534f67e24

Malware Config

Signatures

  • Kutaki

    Information stealer and keylogger that hides inside legitimate Visual Basic applications.

  • Kutaki Executable 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Drops startup file 2 IoCs
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\408e62f6612f1ace5d52c48c850a16881504dd50dd3af9bfc245bae8cb7cfeb0.exe
    "C:\Users\Admin\AppData\Local\Temp\408e62f6612f1ace5d52c48c850a16881504dd50dd3af9bfc245bae8cb7cfeb0.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1240
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
      2⤵
        PID:4904
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bknidzch.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bknidzch.exe"
        2⤵
        • Executes dropped EXE
        • Maps connected drives based on registry
        • Suspicious use of SetWindowsHookEx
        PID:644

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bknidzch.exe

      Filesize

      740KB

      MD5

      1ba628a1b76f3a2f4133f94c7c18f91c

      SHA1

      876664b10a1fc68dba94efbb6aaa9f8eae3d1fac

      SHA256

      408e62f6612f1ace5d52c48c850a16881504dd50dd3af9bfc245bae8cb7cfeb0

      SHA512

      219a3a6e8cea16a58b90d7e2a044c4e7e26145e7e33c5a73033e382b2ccd8f8e16767af8af22f7f1db973733619a03e5cce1a4c2327f2d8f79db67f534f67e24

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bknidzch.exe

      Filesize

      740KB

      MD5

      1ba628a1b76f3a2f4133f94c7c18f91c

      SHA1

      876664b10a1fc68dba94efbb6aaa9f8eae3d1fac

      SHA256

      408e62f6612f1ace5d52c48c850a16881504dd50dd3af9bfc245bae8cb7cfeb0

      SHA512

      219a3a6e8cea16a58b90d7e2a044c4e7e26145e7e33c5a73033e382b2ccd8f8e16767af8af22f7f1db973733619a03e5cce1a4c2327f2d8f79db67f534f67e24

    • memory/644-133-0x0000000000000000-mapping.dmp

    • memory/4904-132-0x0000000000000000-mapping.dmp