kutaki | e296a3f9af1ee967a9a919495e2a12917dd4077d794a54e25b9e16c02854a74e

Resubmissions

11/07/2022, 13:08

220711-qdebeahcgm10

11/07/2022, 03:42

220711-d9b5psgga910

Analysis

max time kernel
122s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
11/07/2022, 03:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
E-bill.exe
Size 968KB
Sample220711-d9b5psgga9
SHA256 e296a3f9af1ee967a9a919495e2a12917dd4077d794a54e25b9e16c02854a74e
MD5 e8f5b21f536286d5fb65297300f4b11f
SHA1 c21a5f1668385d581d5ddebdd9907be4c961383a
SHA512 21d16e637bdb9849656f949e46b6f37ad1b3f5338555f514804467a30b75c4f6e574ac6058b7d1ec8235c57aa16b190acb532f3905cb2bbbb9f1ad6c4362df7b
MD5 SHA1 SHA512

Score

10^/10

kutaki keylogger stealer

Malware Config

Extracted

Family

kutaki

http://ojorobia.club/laptop/laptop.php
http://terebinnahicc.club/sec/kool.txt

Signatures

Kutaki
Information stealer and keylogger that hides inside legitimate Visual Basic applications.
stealer keylogger kutaki

Kutaki Executable 2 IoCs

resource	yara_rule
behavioral2/files/0x0009000000023150-134.dat	family_kutaki
behavioral2/files/0x0009000000023150-135.dat	family_kutaki

Executes dropped EXE 1 IoCs

pid	Process
3816	gjmfzpch.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gjmfzpch.exe	E-bill.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gjmfzpch.exe	E-bill.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2824	E-bill.exe
2824	E-bill.exe
2824	E-bill.exe
3816	gjmfzpch.exe
3816	gjmfzpch.exe
3816	gjmfzpch.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 2856	2824	E-bill.exe	77
PID 2824 wrote to memory of 2856	2824	E-bill.exe	77
PID 2824 wrote to memory of 2856	2824	E-bill.exe	77
PID 2824 wrote to memory of 3816	2824	E-bill.exe	79
PID 2824 wrote to memory of 3816	2824	E-bill.exe	79
PID 2824 wrote to memory of 3816	2824	E-bill.exe	79

C:\Users\Admin\AppData\Local\Temp\E-bill.exe
"C:\Users\Admin\AppData\Local\Temp\E-bill.exe"
1⤵
- Drops startup file
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  PID:2856
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gjmfzpch.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gjmfzpch.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3816

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

gjmfzpch.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gjmfzpch.exe
Size 968KB
SHA256 e296a3f9af1ee967a9a919495e2a12917dd4077d794a54e25b9e16c02854a74e
MD5 e8f5b21f536286d5fb65297300f4b11f
SHA1 c21a5f1668385d581d5ddebdd9907be4c961383a
SHA512 21d16e637bdb9849656f949e46b6f37ad1b3f5338555f514804467a30b75c4f6e574ac6058b7d1ec8235c57aa16b190acb532f3905cb2bbbb9f1ad6c4362df7b
SSDEEP 6144:obIiwoxOTLTcO1S4GlA9jmHv/VCSY3hw9lMbk6u1QMS0y+lqiHTonWryFDYR4p:NizIs46A9jmP/uhu/yMS08CkntxYRE
MD5 SHA1 SHA512 SSDEEP

Submit Download