Analysis
-
max time kernel
152s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
25-07-2022 14:42
Behavioral task
behavioral1
Sample
55dfd27d50e55d714888455ff76c5cbed787547df9e7f1bf7824d7e0994fdf6c.exe
Resource
win7-20220715-en
General
-
Target
55dfd27d50e55d714888455ff76c5cbed787547df9e7f1bf7824d7e0994fdf6c.exe
-
Size
795KB
-
MD5
feaa99287f22b1fad4acdfec4481daa3
-
SHA1
9e882b1037f36bb2ae131500954c16bc1f0aa26f
-
SHA256
55dfd27d50e55d714888455ff76c5cbed787547df9e7f1bf7824d7e0994fdf6c
-
SHA512
13ed01e3afef06b0596cd549ef814f6aece751f221b806828bde945bb9989979e1b1381875219cb23b8494f186f4120acfa64ddb1c577adf555f5260eb884366
Malware Config
Signatures
-
Kutaki Executable 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hyuder.exe family_kutaki C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hyuder.exe family_kutaki -
Executes dropped EXE 1 IoCs
Processes:
hyuder.exepid process 2836 hyuder.exe -
Drops startup file 2 IoCs
Processes:
55dfd27d50e55d714888455ff76c5cbed787547df9e7f1bf7824d7e0994fdf6c.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hyuder.exe 55dfd27d50e55d714888455ff76c5cbed787547df9e7f1bf7824d7e0994fdf6c.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hyuder.exe 55dfd27d50e55d714888455ff76c5cbed787547df9e7f1bf7824d7e0994fdf6c.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
hyuder.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum hyuder.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 hyuder.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
55dfd27d50e55d714888455ff76c5cbed787547df9e7f1bf7824d7e0994fdf6c.exehyuder.exepid process 2624 55dfd27d50e55d714888455ff76c5cbed787547df9e7f1bf7824d7e0994fdf6c.exe 2624 55dfd27d50e55d714888455ff76c5cbed787547df9e7f1bf7824d7e0994fdf6c.exe 2624 55dfd27d50e55d714888455ff76c5cbed787547df9e7f1bf7824d7e0994fdf6c.exe 2836 hyuder.exe 2836 hyuder.exe 2836 hyuder.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
55dfd27d50e55d714888455ff76c5cbed787547df9e7f1bf7824d7e0994fdf6c.exedescription pid process target process PID 2624 wrote to memory of 2380 2624 55dfd27d50e55d714888455ff76c5cbed787547df9e7f1bf7824d7e0994fdf6c.exe cmd.exe PID 2624 wrote to memory of 2380 2624 55dfd27d50e55d714888455ff76c5cbed787547df9e7f1bf7824d7e0994fdf6c.exe cmd.exe PID 2624 wrote to memory of 2380 2624 55dfd27d50e55d714888455ff76c5cbed787547df9e7f1bf7824d7e0994fdf6c.exe cmd.exe PID 2624 wrote to memory of 2836 2624 55dfd27d50e55d714888455ff76c5cbed787547df9e7f1bf7824d7e0994fdf6c.exe hyuder.exe PID 2624 wrote to memory of 2836 2624 55dfd27d50e55d714888455ff76c5cbed787547df9e7f1bf7824d7e0994fdf6c.exe hyuder.exe PID 2624 wrote to memory of 2836 2624 55dfd27d50e55d714888455ff76c5cbed787547df9e7f1bf7824d7e0994fdf6c.exe hyuder.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\55dfd27d50e55d714888455ff76c5cbed787547df9e7f1bf7824d7e0994fdf6c.exe"C:\Users\Admin\AppData\Local\Temp\55dfd27d50e55d714888455ff76c5cbed787547df9e7f1bf7824d7e0994fdf6c.exe"1⤵
- Drops startup file
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Users\Admin\AppData\Local\Temp\2⤵PID:2380
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hyuder.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hyuder.exe"2⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious use of SetWindowsHookEx
PID:2836
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
795KB
MD5feaa99287f22b1fad4acdfec4481daa3
SHA19e882b1037f36bb2ae131500954c16bc1f0aa26f
SHA25655dfd27d50e55d714888455ff76c5cbed787547df9e7f1bf7824d7e0994fdf6c
SHA51213ed01e3afef06b0596cd549ef814f6aece751f221b806828bde945bb9989979e1b1381875219cb23b8494f186f4120acfa64ddb1c577adf555f5260eb884366
-
Filesize
795KB
MD5feaa99287f22b1fad4acdfec4481daa3
SHA19e882b1037f36bb2ae131500954c16bc1f0aa26f
SHA25655dfd27d50e55d714888455ff76c5cbed787547df9e7f1bf7824d7e0994fdf6c
SHA51213ed01e3afef06b0596cd549ef814f6aece751f221b806828bde945bb9989979e1b1381875219cb23b8494f186f4120acfa64ddb1c577adf555f5260eb884366