kutaki | b5d3d965444fd3e7a0df7821d7ac2343dd3e4feb9fcd12e2be0910cee2b51850

Analysis

max time kernel
150s
max time network
45s
platform
windows7_x64
resource
win7-20220414-en
submitted
11/07/2022, 07:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RTGS_Payment.exe
Size

968KB
MD5

a6e5804f4d6a9a2a823a70ad37db3716
SHA1

f20ce20488fb607162285b0ccac95bc965bf116d
SHA256

5f7e2c3aca868d28e2321913fee896d84b6e648e9289c2dacecd5bf85f7ee743
SHA512

cdea1a027cb63173035c4d0d681ad1bd0c63bb2f0a722d6d5316aaae9e474b2e9d0b21cf7f74388ff348133deab4aab92f431d125db79e8134b98d93c26ba4be

Score

10^/10

kutaki keylogger stealer

Malware Config

Signatures

Kutaki
Information stealer and keylogger that hides inside legitimate Visual Basic applications.
stealer keylogger kutaki

Kutaki Executable 3 IoCs

resource	yara_rule
behavioral1/files/0x0009000000012711-58.dat	family_kutaki
behavioral1/files/0x0009000000012711-61.dat	family_kutaki
behavioral1/files/0x0009000000012711-59.dat	family_kutaki

Executes dropped EXE 1 IoCs

pid	Process
1824	gxquench.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gxquench.exe	RTGS_Payment.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gxquench.exe	RTGS_Payment.exe

Loads dropped DLL 2 IoCs

pid	Process
1944	RTGS_Payment.exe
1944	RTGS_Payment.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1944	RTGS_Payment.exe
1944	RTGS_Payment.exe
1944	RTGS_Payment.exe
1824	gxquench.exe
1824	gxquench.exe
1824	gxquench.exe
1824	gxquench.exe
1824	gxquench.exe
1824	gxquench.exe
1824	gxquench.exe
1824	gxquench.exe
1824	gxquench.exe
1824	gxquench.exe
1824	gxquench.exe
1824	gxquench.exe
1824	gxquench.exe
1824	gxquench.exe
1824	gxquench.exe
1824	gxquench.exe
1824	gxquench.exe
1824	gxquench.exe
1824	gxquench.exe
1824	gxquench.exe
1824	gxquench.exe
1824	gxquench.exe
1824	gxquench.exe
1824	gxquench.exe
1824	gxquench.exe
1824	gxquench.exe
1824	gxquench.exe
1824	gxquench.exe
1824	gxquench.exe
1824	gxquench.exe
1824	gxquench.exe
1824	gxquench.exe
1824	gxquench.exe
1824	gxquench.exe
1824	gxquench.exe
1824	gxquench.exe
1824	gxquench.exe
1824	gxquench.exe
1824	gxquench.exe
1824	gxquench.exe
1824	gxquench.exe
1824	gxquench.exe
1824	gxquench.exe
1824	gxquench.exe
1824	gxquench.exe
1824	gxquench.exe
1824	gxquench.exe
1824	gxquench.exe
1824	gxquench.exe
1824	gxquench.exe
1824	gxquench.exe
1824	gxquench.exe
1824	gxquench.exe
1824	gxquench.exe
1824	gxquench.exe
1824	gxquench.exe
1824	gxquench.exe
1824	gxquench.exe
1824	gxquench.exe
1824	gxquench.exe
1824	gxquench.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 1792	1944	RTGS_Payment.exe	28
PID 1944 wrote to memory of 1792	1944	RTGS_Payment.exe	28
PID 1944 wrote to memory of 1792	1944	RTGS_Payment.exe	28
PID 1944 wrote to memory of 1792	1944	RTGS_Payment.exe	28
PID 1944 wrote to memory of 1824	1944	RTGS_Payment.exe	30
PID 1944 wrote to memory of 1824	1944	RTGS_Payment.exe	30
PID 1944 wrote to memory of 1824	1944	RTGS_Payment.exe	30
PID 1944 wrote to memory of 1824	1944	RTGS_Payment.exe	30

C:\Users\Admin\AppData\Local\Temp\RTGS_Payment.exe
"C:\Users\Admin\AppData\Local\Temp\RTGS_Payment.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  PID:1792
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gxquench.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gxquench.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1824

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gxquench.exe

Filesize
968KB

MD5
a6e5804f4d6a9a2a823a70ad37db3716

SHA1
f20ce20488fb607162285b0ccac95bc965bf116d

SHA256
5f7e2c3aca868d28e2321913fee896d84b6e648e9289c2dacecd5bf85f7ee743

SHA512
cdea1a027cb63173035c4d0d681ad1bd0c63bb2f0a722d6d5316aaae9e474b2e9d0b21cf7f74388ff348133deab4aab92f431d125db79e8134b98d93c26ba4be

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gxquench.exe

Filesize
968KB

MD5
a6e5804f4d6a9a2a823a70ad37db3716

SHA1
f20ce20488fb607162285b0ccac95bc965bf116d

SHA256
5f7e2c3aca868d28e2321913fee896d84b6e648e9289c2dacecd5bf85f7ee743

SHA512
cdea1a027cb63173035c4d0d681ad1bd0c63bb2f0a722d6d5316aaae9e474b2e9d0b21cf7f74388ff348133deab4aab92f431d125db79e8134b98d93c26ba4be

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gxquench.exe

Filesize
968KB

MD5
a6e5804f4d6a9a2a823a70ad37db3716

SHA1
f20ce20488fb607162285b0ccac95bc965bf116d

SHA256
5f7e2c3aca868d28e2321913fee896d84b6e648e9289c2dacecd5bf85f7ee743

SHA512
cdea1a027cb63173035c4d0d681ad1bd0c63bb2f0a722d6d5316aaae9e474b2e9d0b21cf7f74388ff348133deab4aab92f431d125db79e8134b98d93c26ba4be

Download Submit
memory/1944-56-0x0000000075DE1000-0x0000000075DE3000-memory.dmp

Filesize
8KB

Download