Analysis
-
max time kernel
149s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
25-07-2022 04:34
Behavioral task
behavioral1
Sample
NEFT_Payment.exe
Resource
win7-20220718-en
General
-
Target
NEFT_Payment.exe
-
Size
1.3MB
-
MD5
28ef0988445cc4cdb59d31feca704df2
-
SHA1
0c89cb0b531a1bd68cc0c080d16f1a891e3a5a8f
-
SHA256
720f485bb099d1c9b4135b3253ebcd070f0bdedb2185a75748ff3f9d108f5cd1
-
SHA512
fc7f416529cbc4dfc6124a57a5f209974f822b341e10f3a55142dbfe689980265e24c4a79438d17934756274c204823db66a90d738fcf30308216606526a93ec
Malware Config
Extracted
kutaki
http://ojorobia.club/laptop/laptop.php
http://terebinnahicc.club/sec/kool.txt
Signatures
-
Kutaki Executable 3 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe family_kutaki \Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe family_kutaki C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe family_kutaki -
Executes dropped EXE 1 IoCs
Processes:
moeydbch.exepid process 1448 moeydbch.exe -
Drops startup file 2 IoCs
Processes:
NEFT_Payment.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe NEFT_Payment.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe NEFT_Payment.exe -
Loads dropped DLL 2 IoCs
Processes:
NEFT_Payment.exepid process 552 NEFT_Payment.exe 552 NEFT_Payment.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
NEFT_Payment.exemoeydbch.exepid process 552 NEFT_Payment.exe 552 NEFT_Payment.exe 552 NEFT_Payment.exe 1448 moeydbch.exe 1448 moeydbch.exe 1448 moeydbch.exe 1448 moeydbch.exe 1448 moeydbch.exe 1448 moeydbch.exe 1448 moeydbch.exe 1448 moeydbch.exe 1448 moeydbch.exe 1448 moeydbch.exe 1448 moeydbch.exe 1448 moeydbch.exe 1448 moeydbch.exe 1448 moeydbch.exe 1448 moeydbch.exe 1448 moeydbch.exe 1448 moeydbch.exe 1448 moeydbch.exe 1448 moeydbch.exe 1448 moeydbch.exe 1448 moeydbch.exe 1448 moeydbch.exe 1448 moeydbch.exe 1448 moeydbch.exe 1448 moeydbch.exe 1448 moeydbch.exe 1448 moeydbch.exe 1448 moeydbch.exe 1448 moeydbch.exe 1448 moeydbch.exe 1448 moeydbch.exe 1448 moeydbch.exe 1448 moeydbch.exe 1448 moeydbch.exe 1448 moeydbch.exe 1448 moeydbch.exe 1448 moeydbch.exe 1448 moeydbch.exe 1448 moeydbch.exe 1448 moeydbch.exe 1448 moeydbch.exe 1448 moeydbch.exe 1448 moeydbch.exe 1448 moeydbch.exe 1448 moeydbch.exe 1448 moeydbch.exe 1448 moeydbch.exe 1448 moeydbch.exe 1448 moeydbch.exe 1448 moeydbch.exe 1448 moeydbch.exe 1448 moeydbch.exe 1448 moeydbch.exe 1448 moeydbch.exe 1448 moeydbch.exe 1448 moeydbch.exe 1448 moeydbch.exe 1448 moeydbch.exe 1448 moeydbch.exe 1448 moeydbch.exe 1448 moeydbch.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
NEFT_Payment.exedescription pid process target process PID 552 wrote to memory of 1540 552 NEFT_Payment.exe cmd.exe PID 552 wrote to memory of 1540 552 NEFT_Payment.exe cmd.exe PID 552 wrote to memory of 1540 552 NEFT_Payment.exe cmd.exe PID 552 wrote to memory of 1540 552 NEFT_Payment.exe cmd.exe PID 552 wrote to memory of 1448 552 NEFT_Payment.exe moeydbch.exe PID 552 wrote to memory of 1448 552 NEFT_Payment.exe moeydbch.exe PID 552 wrote to memory of 1448 552 NEFT_Payment.exe moeydbch.exe PID 552 wrote to memory of 1448 552 NEFT_Payment.exe moeydbch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEFT_Payment.exe"C:\Users\Admin\AppData\Local\Temp\NEFT_Payment.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Users\Admin\AppData\Local\Temp\2⤵PID:1540
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1448
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD528ef0988445cc4cdb59d31feca704df2
SHA10c89cb0b531a1bd68cc0c080d16f1a891e3a5a8f
SHA256720f485bb099d1c9b4135b3253ebcd070f0bdedb2185a75748ff3f9d108f5cd1
SHA512fc7f416529cbc4dfc6124a57a5f209974f822b341e10f3a55142dbfe689980265e24c4a79438d17934756274c204823db66a90d738fcf30308216606526a93ec
-
Filesize
1.3MB
MD528ef0988445cc4cdb59d31feca704df2
SHA10c89cb0b531a1bd68cc0c080d16f1a891e3a5a8f
SHA256720f485bb099d1c9b4135b3253ebcd070f0bdedb2185a75748ff3f9d108f5cd1
SHA512fc7f416529cbc4dfc6124a57a5f209974f822b341e10f3a55142dbfe689980265e24c4a79438d17934756274c204823db66a90d738fcf30308216606526a93ec
-
Filesize
1.3MB
MD528ef0988445cc4cdb59d31feca704df2
SHA10c89cb0b531a1bd68cc0c080d16f1a891e3a5a8f
SHA256720f485bb099d1c9b4135b3253ebcd070f0bdedb2185a75748ff3f9d108f5cd1
SHA512fc7f416529cbc4dfc6124a57a5f209974f822b341e10f3a55142dbfe689980265e24c4a79438d17934756274c204823db66a90d738fcf30308216606526a93ec