Analysis

  • max time kernel
    281s
  • max time network
    294s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    11-07-2022 07:51

General

  • Target

    RTGS_Payment.exe

  • Size

    968KB

  • MD5

    a6e5804f4d6a9a2a823a70ad37db3716

  • SHA1

    f20ce20488fb607162285b0ccac95bc965bf116d

  • SHA256

    5f7e2c3aca868d28e2321913fee896d84b6e648e9289c2dacecd5bf85f7ee743

  • SHA512

    cdea1a027cb63173035c4d0d681ad1bd0c63bb2f0a722d6d5316aaae9e474b2e9d0b21cf7f74388ff348133deab4aab92f431d125db79e8134b98d93c26ba4be

Malware Config

Signatures

  • Kutaki

    Information stealer and keylogger that hides inside legitimate Visual Basic applications.

  • Kutaki Executable 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Drops startup file 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RTGS_Payment.exe
    "C:\Users\Admin\AppData\Local\Temp\RTGS_Payment.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2596
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
      2⤵
        PID:3688
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nmbdepch.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nmbdepch.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:4996

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nmbdepch.exe

      Filesize

      968KB

      MD5

      a6e5804f4d6a9a2a823a70ad37db3716

      SHA1

      f20ce20488fb607162285b0ccac95bc965bf116d

      SHA256

      5f7e2c3aca868d28e2321913fee896d84b6e648e9289c2dacecd5bf85f7ee743

      SHA512

      cdea1a027cb63173035c4d0d681ad1bd0c63bb2f0a722d6d5316aaae9e474b2e9d0b21cf7f74388ff348133deab4aab92f431d125db79e8134b98d93c26ba4be

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nmbdepch.exe

      Filesize

      968KB

      MD5

      a6e5804f4d6a9a2a823a70ad37db3716

      SHA1

      f20ce20488fb607162285b0ccac95bc965bf116d

      SHA256

      5f7e2c3aca868d28e2321913fee896d84b6e648e9289c2dacecd5bf85f7ee743

      SHA512

      cdea1a027cb63173035c4d0d681ad1bd0c63bb2f0a722d6d5316aaae9e474b2e9d0b21cf7f74388ff348133deab4aab92f431d125db79e8134b98d93c26ba4be

    • memory/3688-132-0x0000000000000000-mapping.dmp

    • memory/4996-133-0x0000000000000000-mapping.dmp