Malware Analysis Report

2024-11-13 14:55

Sample ID 220724-y6vsvsfdgj
Target b5b970b6d52e53a875ffc8e03065bd6dc200431b9f8f88b6632a73193407e0bf
SHA256 b5b970b6d52e53a875ffc8e03065bd6dc200431b9f8f88b6632a73193407e0bf
Tags
kutaki keylogger stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b5b970b6d52e53a875ffc8e03065bd6dc200431b9f8f88b6632a73193407e0bf

Threat Level: Known bad

The file b5b970b6d52e53a875ffc8e03065bd6dc200431b9f8f88b6632a73193407e0bf was found to be: Known bad.

Malicious Activity Summary

kutaki keylogger stealer

Kutaki Executable

Kutaki family

Kutaki

Executes dropped EXE

Loads dropped DLL

Drops startup file

Maps connected drives based on registry

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-07-24 20:24

Signatures

Kutaki Executable

Description Indicator Process Target
N/A N/A N/A N/A

Kutaki family

kutaki

Analysis: behavioral1

Detonation Overview

Submitted

2022-07-24 20:24

Reported

2022-07-24 20:26

Platform

win7-20220718-en

Max time kernel

78s

Max time network

46s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b5b970b6d52e53a875ffc8e03065bd6dc200431b9f8f88b6632a73193407e0bf.exe"

Signatures

Kutaki

stealer keylogger kutaki

Kutaki Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe C:\Users\Admin\AppData\Local\Temp\b5b970b6d52e53a875ffc8e03065bd6dc200431b9f8f88b6632a73193407e0bf.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe C:\Users\Admin\AppData\Local\Temp\b5b970b6d52e53a875ffc8e03065bd6dc200431b9f8f88b6632a73193407e0bf.exe N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b5b970b6d52e53a875ffc8e03065bd6dc200431b9f8f88b6632a73193407e0bf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b5b970b6d52e53a875ffc8e03065bd6dc200431b9f8f88b6632a73193407e0bf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b5b970b6d52e53a875ffc8e03065bd6dc200431b9f8f88b6632a73193407e0bf.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 892 wrote to memory of 944 N/A C:\Users\Admin\AppData\Local\Temp\b5b970b6d52e53a875ffc8e03065bd6dc200431b9f8f88b6632a73193407e0bf.exe C:\Windows\SysWOW64\cmd.exe
PID 892 wrote to memory of 944 N/A C:\Users\Admin\AppData\Local\Temp\b5b970b6d52e53a875ffc8e03065bd6dc200431b9f8f88b6632a73193407e0bf.exe C:\Windows\SysWOW64\cmd.exe
PID 892 wrote to memory of 944 N/A C:\Users\Admin\AppData\Local\Temp\b5b970b6d52e53a875ffc8e03065bd6dc200431b9f8f88b6632a73193407e0bf.exe C:\Windows\SysWOW64\cmd.exe
PID 892 wrote to memory of 944 N/A C:\Users\Admin\AppData\Local\Temp\b5b970b6d52e53a875ffc8e03065bd6dc200431b9f8f88b6632a73193407e0bf.exe C:\Windows\SysWOW64\cmd.exe
PID 892 wrote to memory of 1328 N/A C:\Users\Admin\AppData\Local\Temp\b5b970b6d52e53a875ffc8e03065bd6dc200431b9f8f88b6632a73193407e0bf.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe
PID 892 wrote to memory of 1328 N/A C:\Users\Admin\AppData\Local\Temp\b5b970b6d52e53a875ffc8e03065bd6dc200431b9f8f88b6632a73193407e0bf.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe
PID 892 wrote to memory of 1328 N/A C:\Users\Admin\AppData\Local\Temp\b5b970b6d52e53a875ffc8e03065bd6dc200431b9f8f88b6632a73193407e0bf.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe
PID 892 wrote to memory of 1328 N/A C:\Users\Admin\AppData\Local\Temp\b5b970b6d52e53a875ffc8e03065bd6dc200431b9f8f88b6632a73193407e0bf.exe C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b5b970b6d52e53a875ffc8e03065bd6dc200431b9f8f88b6632a73193407e0bf.exe

"C:\Users\Admin\AppData\Local\Temp\b5b970b6d52e53a875ffc8e03065bd6dc200431b9f8f88b6632a73193407e0bf.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c C:\Users\Admin\AppData\Local\Temp\

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe"

Network

N/A

Files

memory/892-56-0x0000000075831000-0x0000000075833000-memory.dmp

memory/944-57-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe

MD5 d31babbee891b978c01df4bc1598b453
SHA1 973ec9c69c496bc7984388f7541e8f5f34d1721d
SHA256 b5b970b6d52e53a875ffc8e03065bd6dc200431b9f8f88b6632a73193407e0bf
SHA512 028ba6e00e41594e6d77ec6ecc216378cf59b5a33a936b9237b7f4ac8ab8fd265bf5f3914e61ad1bcb9927b204c51b706140d451fb4910992b3d4694331980b3

memory/1328-60-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe

MD5 d31babbee891b978c01df4bc1598b453
SHA1 973ec9c69c496bc7984388f7541e8f5f34d1721d
SHA256 b5b970b6d52e53a875ffc8e03065bd6dc200431b9f8f88b6632a73193407e0bf
SHA512 028ba6e00e41594e6d77ec6ecc216378cf59b5a33a936b9237b7f4ac8ab8fd265bf5f3914e61ad1bcb9927b204c51b706140d451fb4910992b3d4694331980b3

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bkkmpxch.exe

MD5 d31babbee891b978c01df4bc1598b453
SHA1 973ec9c69c496bc7984388f7541e8f5f34d1721d
SHA256 b5b970b6d52e53a875ffc8e03065bd6dc200431b9f8f88b6632a73193407e0bf
SHA512 028ba6e00e41594e6d77ec6ecc216378cf59b5a33a936b9237b7f4ac8ab8fd265bf5f3914e61ad1bcb9927b204c51b706140d451fb4910992b3d4694331980b3

Analysis: behavioral2

Detonation Overview

Submitted

2022-07-24 20:24

Reported

2022-07-24 20:26

Platform

win10v2004-20220721-en

Max time kernel

150s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b5b970b6d52e53a875ffc8e03065bd6dc200431b9f8f88b6632a73193407e0bf.exe"

Signatures

Kutaki

stealer keylogger kutaki

Kutaki Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ifoaovch.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ifoaovch.exe C:\Users\Admin\AppData\Local\Temp\b5b970b6d52e53a875ffc8e03065bd6dc200431b9f8f88b6632a73193407e0bf.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ifoaovch.exe C:\Users\Admin\AppData\Local\Temp\b5b970b6d52e53a875ffc8e03065bd6dc200431b9f8f88b6632a73193407e0bf.exe N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ifoaovch.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ifoaovch.exe N/A

Enumerates physical storage devices

Processes

C:\Users\Admin\AppData\Local\Temp\b5b970b6d52e53a875ffc8e03065bd6dc200431b9f8f88b6632a73193407e0bf.exe

"C:\Users\Admin\AppData\Local\Temp\b5b970b6d52e53a875ffc8e03065bd6dc200431b9f8f88b6632a73193407e0bf.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c C:\Users\Admin\AppData\Local\Temp\

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ifoaovch.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ifoaovch.exe"

Network

Country Destination Domain Proto
US 52.109.8.21:443 tcp
US 20.42.65.88:443 tcp
US 8.253.208.112:80 tcp
US 8.253.208.112:80 tcp
US 8.253.208.112:80 tcp
US 93.184.221.240:80 tcp

Files

memory/5000-132-0x0000000000000000-mapping.dmp

memory/1208-133-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ifoaovch.exe

MD5 d31babbee891b978c01df4bc1598b453
SHA1 973ec9c69c496bc7984388f7541e8f5f34d1721d
SHA256 b5b970b6d52e53a875ffc8e03065bd6dc200431b9f8f88b6632a73193407e0bf
SHA512 028ba6e00e41594e6d77ec6ecc216378cf59b5a33a936b9237b7f4ac8ab8fd265bf5f3914e61ad1bcb9927b204c51b706140d451fb4910992b3d4694331980b3

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ifoaovch.exe

MD5 d31babbee891b978c01df4bc1598b453
SHA1 973ec9c69c496bc7984388f7541e8f5f34d1721d
SHA256 b5b970b6d52e53a875ffc8e03065bd6dc200431b9f8f88b6632a73193407e0bf
SHA512 028ba6e00e41594e6d77ec6ecc216378cf59b5a33a936b9237b7f4ac8ab8fd265bf5f3914e61ad1bcb9927b204c51b706140d451fb4910992b3d4694331980b3