kutaki | 59f20bfe00956a55cfdf0403942b51d5ee17207eac28e9ea6ea6c6a5840b1ec0

Analysis

max time kernel
152s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20220722-en
resource tags

arch:x64arch:x86image:win10v2004-20220722-enlocale:en-usos:windows10-2004-x64system
submitted
24/07/2022, 02:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TDS Challan.exe
Size

707KB
MD5

2600b7e78f3a1d996294bcc27b309594
SHA1

a90f63310dca46b419cfcbe95d90e1517932d6d3
SHA256

8b12a088323095e7307e40be4b3194cebd6756d9414d360e06e2015804ad6b58
SHA512

db6926d1cf359712dd7c77b48444f00d0f8ea776cdec752d604a68a3037eadbd38723f50ee655821eda51d21a528c00313e505575816c2ad659856fad886da7b

Score

10^/10

kutaki keylogger stealer

Malware Config

Signatures

Kutaki
Information stealer and keylogger that hides inside legitimate Visual Basic applications.
stealer keylogger kutaki

Kutaki Executable 2 IoCs

resource	yara_rule
behavioral2/files/0x0006000000020926-136.dat	family_kutaki
behavioral2/files/0x0006000000020926-137.dat	family_kutaki

Executes dropped EXE 1 IoCs

pid	Process
916	hyuder.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hyuder.exe	TDS Challan.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hyuder.exe	TDS Challan.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	hyuder.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	hyuder.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
5064	TDS Challan.exe
5064	TDS Challan.exe
5064	TDS Challan.exe
916	hyuder.exe
916	hyuder.exe
916	hyuder.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 4788	5064	TDS Challan.exe	77
PID 5064 wrote to memory of 4788	5064	TDS Challan.exe	77
PID 5064 wrote to memory of 4788	5064	TDS Challan.exe	77
PID 5064 wrote to memory of 916	5064	TDS Challan.exe	79
PID 5064 wrote to memory of 916	5064	TDS Challan.exe	79
PID 5064 wrote to memory of 916	5064	TDS Challan.exe	79

C:\Users\Admin\AppData\Local\Temp\TDS Challan.exe
"C:\Users\Admin\AppData\Local\Temp\TDS Challan.exe"
1⤵
- Drops startup file
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  PID:4788
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hyuder.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hyuder.exe"
  2⤵
  - Executes dropped EXE
  - Maps connected drives based on registry
  - Suspicious use of SetWindowsHookEx
  PID:916

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hyuder.exe

Filesize
707KB

MD5
2600b7e78f3a1d996294bcc27b309594

SHA1
a90f63310dca46b419cfcbe95d90e1517932d6d3

SHA256
8b12a088323095e7307e40be4b3194cebd6756d9414d360e06e2015804ad6b58

SHA512
db6926d1cf359712dd7c77b48444f00d0f8ea776cdec752d604a68a3037eadbd38723f50ee655821eda51d21a528c00313e505575816c2ad659856fad886da7b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hyuder.exe

Filesize
707KB

MD5
2600b7e78f3a1d996294bcc27b309594

SHA1
a90f63310dca46b419cfcbe95d90e1517932d6d3

SHA256
8b12a088323095e7307e40be4b3194cebd6756d9414d360e06e2015804ad6b58

SHA512
db6926d1cf359712dd7c77b48444f00d0f8ea776cdec752d604a68a3037eadbd38723f50ee655821eda51d21a528c00313e505575816c2ad659856fad886da7b

Download Submit