Malware Analysis Report

2024-11-13 14:55

Sample ID 220725-e647raegh8
Target c6f03fe1e88eba449e3d525aebb408e4
SHA256 56a6bca7c19df8d148d6662a92c118035254d929df721f4112b7f59aece15866
Tags
kutaki keylogger stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

56a6bca7c19df8d148d6662a92c118035254d929df721f4112b7f59aece15866

Threat Level: Known bad

The file c6f03fe1e88eba449e3d525aebb408e4 was found to be: Known bad.

Malicious Activity Summary

kutaki keylogger stealer

Kutaki

Kutaki family

Kutaki Executable

Executes dropped EXE

Loads dropped DLL

Drops startup file

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-07-25 04:34

Signatures

Kutaki Executable

Description Indicator Process Target
N/A N/A N/A N/A

Kutaki family

kutaki

Analysis: behavioral2

Detonation Overview

Submitted

2022-07-25 04:34

Reported

2022-07-25 09:45

Platform

win10v2004-20220721-en

Max time kernel

124s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\NEFT_Payment.exe"

Signatures

Kutaki

stealer keylogger kutaki

Kutaki Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\oupbuech.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\oupbuech.exe C:\Users\Admin\AppData\Local\Temp\NEFT_Payment.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\oupbuech.exe C:\Users\Admin\AppData\Local\Temp\NEFT_Payment.exe N/A

Enumerates physical storage devices

Processes

C:\Users\Admin\AppData\Local\Temp\NEFT_Payment.exe

"C:\Users\Admin\AppData\Local\Temp\NEFT_Payment.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c C:\Users\Admin\AppData\Local\Temp\

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\oupbuech.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\oupbuech.exe"

Network

Country Destination Domain Proto
US 8.253.146.121:80 tcp
US 8.253.146.121:80 tcp
US 8.253.146.121:80 tcp
US 8.253.146.121:80 tcp
US 93.184.220.29:80 tcp
FR 40.79.141.154:443 tcp
US 8.8.8.8:53 151.122.125.40.in-addr.arpa udp
FR 2.18.109.224:443 tcp
US 93.184.220.29:80 tcp

Files

memory/4400-132-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\oupbuech.exe

MD5 28ef0988445cc4cdb59d31feca704df2
SHA1 0c89cb0b531a1bd68cc0c080d16f1a891e3a5a8f
SHA256 720f485bb099d1c9b4135b3253ebcd070f0bdedb2185a75748ff3f9d108f5cd1
SHA512 fc7f416529cbc4dfc6124a57a5f209974f822b341e10f3a55142dbfe689980265e24c4a79438d17934756274c204823db66a90d738fcf30308216606526a93ec

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\oupbuech.exe

MD5 28ef0988445cc4cdb59d31feca704df2
SHA1 0c89cb0b531a1bd68cc0c080d16f1a891e3a5a8f
SHA256 720f485bb099d1c9b4135b3253ebcd070f0bdedb2185a75748ff3f9d108f5cd1
SHA512 fc7f416529cbc4dfc6124a57a5f209974f822b341e10f3a55142dbfe689980265e24c4a79438d17934756274c204823db66a90d738fcf30308216606526a93ec

memory/4024-133-0x0000000000000000-mapping.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2022-07-25 04:34

Reported

2022-07-25 09:44

Platform

win7-20220718-en

Max time kernel

149s

Max time network

47s

Command Line

"C:\Users\Admin\AppData\Local\Temp\NEFT_Payment.exe"

Signatures

Kutaki

stealer keylogger kutaki

Kutaki Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe C:\Users\Admin\AppData\Local\Temp\NEFT_Payment.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe C:\Users\Admin\AppData\Local\Temp\NEFT_Payment.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEFT_Payment.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEFT_Payment.exe N/A

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEFT_Payment.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEFT_Payment.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NEFT_Payment.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\NEFT_Payment.exe

"C:\Users\Admin\AppData\Local\Temp\NEFT_Payment.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c C:\Users\Admin\AppData\Local\Temp\

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe

"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe"

Network

N/A

Files

memory/552-56-0x0000000075CB1000-0x0000000075CB3000-memory.dmp

memory/1540-57-0x0000000000000000-mapping.dmp

memory/1448-60-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe

MD5 28ef0988445cc4cdb59d31feca704df2
SHA1 0c89cb0b531a1bd68cc0c080d16f1a891e3a5a8f
SHA256 720f485bb099d1c9b4135b3253ebcd070f0bdedb2185a75748ff3f9d108f5cd1
SHA512 fc7f416529cbc4dfc6124a57a5f209974f822b341e10f3a55142dbfe689980265e24c4a79438d17934756274c204823db66a90d738fcf30308216606526a93ec

\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe

MD5 28ef0988445cc4cdb59d31feca704df2
SHA1 0c89cb0b531a1bd68cc0c080d16f1a891e3a5a8f
SHA256 720f485bb099d1c9b4135b3253ebcd070f0bdedb2185a75748ff3f9d108f5cd1
SHA512 fc7f416529cbc4dfc6124a57a5f209974f822b341e10f3a55142dbfe689980265e24c4a79438d17934756274c204823db66a90d738fcf30308216606526a93ec

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\moeydbch.exe

MD5 28ef0988445cc4cdb59d31feca704df2
SHA1 0c89cb0b531a1bd68cc0c080d16f1a891e3a5a8f
SHA256 720f485bb099d1c9b4135b3253ebcd070f0bdedb2185a75748ff3f9d108f5cd1
SHA512 fc7f416529cbc4dfc6124a57a5f209974f822b341e10f3a55142dbfe689980265e24c4a79438d17934756274c204823db66a90d738fcf30308216606526a93ec