Analysis
-
max time kernel
150s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
24-07-2022 15:07
Behavioral task
behavioral1
Sample
f0719030fe6c57b80d5aa3716e8a878de08112f116e230afc10bfca73a29f2bc.exe
Resource
win7-20220715-en
General
-
Target
f0719030fe6c57b80d5aa3716e8a878de08112f116e230afc10bfca73a29f2bc.exe
-
Size
499KB
-
MD5
3d286767965d3960576a64e772175d6c
-
SHA1
b2fdeb9a1af6ea401c8388b1198a729caf01b4ce
-
SHA256
f0719030fe6c57b80d5aa3716e8a878de08112f116e230afc10bfca73a29f2bc
-
SHA512
217dd95656d7c0e76cda0e25f82857f16e2224b7d13e1fb050083a169450e403699ef65464b7de841820972b1c04a0055780c95e46932d9d24134e997b115ed8
Malware Config
Signatures
-
Kutaki Executable 4 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lunlerio.exe family_kutaki \Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lunlerio.exe family_kutaki C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lunlerio.exe family_kutaki C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lunlerio.exe family_kutaki -
Executes dropped EXE 1 IoCs
Processes:
lunlerio.exepid process 1680 lunlerio.exe -
Drops startup file 2 IoCs
Processes:
f0719030fe6c57b80d5aa3716e8a878de08112f116e230afc10bfca73a29f2bc.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lunlerio.exe f0719030fe6c57b80d5aa3716e8a878de08112f116e230afc10bfca73a29f2bc.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lunlerio.exe f0719030fe6c57b80d5aa3716e8a878de08112f116e230afc10bfca73a29f2bc.exe -
Loads dropped DLL 2 IoCs
Processes:
f0719030fe6c57b80d5aa3716e8a878de08112f116e230afc10bfca73a29f2bc.exepid process 1972 f0719030fe6c57b80d5aa3716e8a878de08112f116e230afc10bfca73a29f2bc.exe 1972 f0719030fe6c57b80d5aa3716e8a878de08112f116e230afc10bfca73a29f2bc.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
lunlerio.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum lunlerio.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 lunlerio.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
lunlerio.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Internet Explorer\Main lunlerio.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
f0719030fe6c57b80d5aa3716e8a878de08112f116e230afc10bfca73a29f2bc.exelunlerio.exepid process 1972 f0719030fe6c57b80d5aa3716e8a878de08112f116e230afc10bfca73a29f2bc.exe 1972 f0719030fe6c57b80d5aa3716e8a878de08112f116e230afc10bfca73a29f2bc.exe 1972 f0719030fe6c57b80d5aa3716e8a878de08112f116e230afc10bfca73a29f2bc.exe 1680 lunlerio.exe 1680 lunlerio.exe 1680 lunlerio.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
f0719030fe6c57b80d5aa3716e8a878de08112f116e230afc10bfca73a29f2bc.exedescription pid process target process PID 1972 wrote to memory of 1708 1972 f0719030fe6c57b80d5aa3716e8a878de08112f116e230afc10bfca73a29f2bc.exe cmd.exe PID 1972 wrote to memory of 1708 1972 f0719030fe6c57b80d5aa3716e8a878de08112f116e230afc10bfca73a29f2bc.exe cmd.exe PID 1972 wrote to memory of 1708 1972 f0719030fe6c57b80d5aa3716e8a878de08112f116e230afc10bfca73a29f2bc.exe cmd.exe PID 1972 wrote to memory of 1708 1972 f0719030fe6c57b80d5aa3716e8a878de08112f116e230afc10bfca73a29f2bc.exe cmd.exe PID 1972 wrote to memory of 1680 1972 f0719030fe6c57b80d5aa3716e8a878de08112f116e230afc10bfca73a29f2bc.exe lunlerio.exe PID 1972 wrote to memory of 1680 1972 f0719030fe6c57b80d5aa3716e8a878de08112f116e230afc10bfca73a29f2bc.exe lunlerio.exe PID 1972 wrote to memory of 1680 1972 f0719030fe6c57b80d5aa3716e8a878de08112f116e230afc10bfca73a29f2bc.exe lunlerio.exe PID 1972 wrote to memory of 1680 1972 f0719030fe6c57b80d5aa3716e8a878de08112f116e230afc10bfca73a29f2bc.exe lunlerio.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f0719030fe6c57b80d5aa3716e8a878de08112f116e230afc10bfca73a29f2bc.exe"C:\Users\Admin\AppData\Local\Temp\f0719030fe6c57b80d5aa3716e8a878de08112f116e230afc10bfca73a29f2bc.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Users\Admin\AppData\Local\Temp\2⤵PID:1708
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lunlerio.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lunlerio.exe"2⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1680
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
499KB
MD53d286767965d3960576a64e772175d6c
SHA1b2fdeb9a1af6ea401c8388b1198a729caf01b4ce
SHA256f0719030fe6c57b80d5aa3716e8a878de08112f116e230afc10bfca73a29f2bc
SHA512217dd95656d7c0e76cda0e25f82857f16e2224b7d13e1fb050083a169450e403699ef65464b7de841820972b1c04a0055780c95e46932d9d24134e997b115ed8
-
Filesize
499KB
MD53d286767965d3960576a64e772175d6c
SHA1b2fdeb9a1af6ea401c8388b1198a729caf01b4ce
SHA256f0719030fe6c57b80d5aa3716e8a878de08112f116e230afc10bfca73a29f2bc
SHA512217dd95656d7c0e76cda0e25f82857f16e2224b7d13e1fb050083a169450e403699ef65464b7de841820972b1c04a0055780c95e46932d9d24134e997b115ed8
-
Filesize
499KB
MD53d286767965d3960576a64e772175d6c
SHA1b2fdeb9a1af6ea401c8388b1198a729caf01b4ce
SHA256f0719030fe6c57b80d5aa3716e8a878de08112f116e230afc10bfca73a29f2bc
SHA512217dd95656d7c0e76cda0e25f82857f16e2224b7d13e1fb050083a169450e403699ef65464b7de841820972b1c04a0055780c95e46932d9d24134e997b115ed8
-
Filesize
499KB
MD53d286767965d3960576a64e772175d6c
SHA1b2fdeb9a1af6ea401c8388b1198a729caf01b4ce
SHA256f0719030fe6c57b80d5aa3716e8a878de08112f116e230afc10bfca73a29f2bc
SHA512217dd95656d7c0e76cda0e25f82857f16e2224b7d13e1fb050083a169450e403699ef65464b7de841820972b1c04a0055780c95e46932d9d24134e997b115ed8